thndrroad
Here are the logs:
ComboFix 09-02-21.01 - Chuck 2009-02-22 20:28:33.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1022.490 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Chuck\Desktop\CFScript.txt
AV: Trend Micro Internet Security *On-access scanning disabled* (Updated)
FW: Trend Micro Personal Firewall *disabled*
* Created a new restore point
FILE ::
c:\windows\system32\7RS4S8Pg.exe
c:\windows\system32\exitwx.exe
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\exitwx.exe
c:\windows\Tasks\At25.job
c:\windows\Tasks\At26.job
c:\windows\Tasks\At27.job
c:\windows\Tasks\At28.job
c:\windows\Tasks\At29.job
c:\windows\Tasks\At30.job
c:\windows\Tasks\At31.job
c:\windows\Tasks\At32.job
c:\windows\Tasks\At33.job
c:\windows\Tasks\At34.job
c:\windows\Tasks\At35.job
c:\windows\Tasks\At36.job
c:\windows\Tasks\At37.job
c:\windows\Tasks\At38.job
c:\windows\Tasks\At39.job
c:\windows\Tasks\At40.job
c:\windows\Tasks\At41.job
c:\windows\Tasks\At42.job
c:\windows\Tasks\At43.job
c:\windows\Tasks\At44.job
c:\windows\Tasks\At45.job
c:\windows\Tasks\At46.job
c:\windows\Tasks\At47.job
c:\windows\Tasks\At48.job
.
((((((((((((((((((((((((( Files Created from 2009-01-23 to 2009-02-23 )))))))))))))))))))))))))))))))
.
2009-02-22 20:20 . 2009-02-22 20:21 1,648 –a—— c:\windows\system32\drivers\kgpcpy.cfg
2009-02-22 19:09 . 2009-02-22 19:09 488,144 –a—— C:\HJTsetup.exe
2009-02-22 15:29 . 2009-02-22 15:29 d——– c:\documents and settings\Chuck\DoctorWeb
2009-02-22 14:33 . 2009-02-22 14:33 d——– c:\windows\system32\Service
2009-02-22 14:23 . 2009-02-22 14:23 d——– c:\program files\Malwarebytes' Anti-Malware
2009-02-22 14:23 . 2009-02-22 14:23 d——– c:\documents and settings\Chuck\Application Data\Malwarebytes
2009-02-22 14:23 . 2009-02-22 14:23 d——– c:\documents and settings\All Users\Application Data\Malwarebytes
2009-02-22 14:23 . 2009-02-11 10:19 38,496 –a—— c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-22 14:23 . 2009-02-11 10:19 15,504 –a—— c:\windows\system32\drivers\mbam.sys
2009-02-22 13:00 . 2009-02-22 13:00 d——– c:\windows\system32\XPSViewer
2009-02-22 13:00 . 2009-02-22 13:00 d——– c:\program files\Reference Assemblies
2009-02-22 13:00 . 2009-02-22 13:00 d——– c:\program files\MSBuild
2009-02-22 12:58 . 2008-07-06 07:06 1,676,288 ——— c:\windows\system32\xpssvcs.dll
2009-02-22 12:58 . 2008-07-06 07:06 1,676,288 —–c— c:\windows\system32\dllcache\xpssvcs.dll
2009-02-22 12:58 . 2008-07-06 05:50 597,504 —–c— c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-02-22 12:58 . 2008-07-06 07:06 575,488 ——— c:\windows\system32\xpsshhdr.dll
2009-02-22 12:58 . 2008-07-06 07:06 575,488 —–c— c:\windows\system32\dllcache\xpsshhdr.dll
2009-02-22 12:58 . 2008-07-06 07:06 117,760 ——— c:\windows\system32\prntvpt.dll
2009-02-22 12:58 . 2008-07-06 07:06 89,088 —–c— c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-02-22 12:42 . 2009-02-22 12:42 d——– c:\documents and settings\Chuck\Application Data\Windows Desktop Search
2009-02-22 12:40 . 2009-02-22 12:40 d——– c:\windows\system32\GroupPolicy
2009-02-22 12:40 . 2009-02-22 12:40 d——– c:\program files\Windows Desktop Search
2009-02-22 12:38 . 2009-02-22 12:38 d——– c:\program files\Windows Media Connect 2
2009-02-22 12:33 . 2009-02-22 14:07 d——– c:\windows\system32\LogFiles
2009-02-22 12:33 . 2009-02-22 12:36 d——– c:\windows\system32\drivers\UMDF
2009-02-22 09:37 . 2009-02-22 09:37 2,560 –a—— c:\windows\system32\drivers\mchInjDrv.sys
2009-02-22 09:16 . 2009-02-22 09:16 d–h—– c:\windows\$hf_mig$
2009-02-21 21:52 . 2009-02-22 17:08 d——– c:\documents and settings\All Users\Application Data\SITEguard
2009-02-21 21:51 . 2009-02-21 21:51 d——– c:\program files\STOPzilla!
2009-02-21 21:51 . 2009-02-21 21:51 d——– c:\program files\Common Files\iS3
2009-02-21 21:51 . 2009-02-22 20:25 d——– c:\documents and settings\All Users\Application Data\STOPzilla!
2009-02-21 21:38 . 2009-02-21 20:47 15,688 –a—— c:\windows\system32\lsdelete.exe
2009-02-21 20:47 . 2009-02-21 20:47 64,160 –a—— c:\windows\system32\drivers\Lbd.sys
2009-02-21 20:45 . 2009-02-21 20:45 d——– c:\program files\Lavasoft
2009-02-21 20:45 . 2009-02-21 20:47 d——– c:\documents and settings\All Users\Application Data\Lavasoft
2009-02-21 20:45 . 2009-02-21 20:45 d–h-c— c:\documents and settings\All Users\Application Data\{83C91755-2546-441D-AC40-9A6B4B860800}
2009-02-21 16:18 . 2009-02-21 16:18 d——– c:\program files\IObit
2009-02-21 16:18 . 2009-02-21 16:18 d——– c:\documents and settings\Chuck\Application Data\IObit
2009-02-21 12:32 . 2009-02-21 12:32 d——– c:\program files\RegCure
2009-02-21 12:27 . 2009-02-21 12:27 d——– c:\program files\CCleaner
2009-02-20 19:43 . 2009-02-22 09:43 d——– c:\program files\Enigma Software Group
2009-02-20 19:38 . 2008-10-16 14:06 268,648 –a—— c:\windows\system32\mucltui.dll
2009-02-20 19:38 . 2008-10-16 14:06 27,496 –a—— c:\windows\system32\mucltui.dll.mui
2009-02-19 20:21 . 2009-02-19 22:17 d——– c:\documents and settings\All Users\Application Data\Trend Micro
2009-02-19 20:21 . 2009-02-19 20:19 144,912 –a—— c:\windows\system32\drivers\tmcomm.sys
2009-02-19 20:21 . 2009-02-19 20:19 50,192 –a—— c:\windows\system32\drivers\tmactmon.sys
2009-02-19 20:21 . 2009-02-19 20:19 49,680 –a—— c:\windows\system32\drivers\tmevtmgr.sys
2009-02-19 20:20 . 2009-02-22 19:13 d——– c:\program files\Trend Micro
2009-02-19 20:19 . 2008-11-26 20:39 1,195,384 –a—— c:\windows\system32\drivers\vsapint.sys
2009-02-19 20:19 . 2009-02-19 20:19 661,808 –a—— c:\windows\system32\UfWSC.cpl
2009-02-19 20:19 . 2009-02-19 20:19 334,352 –a—— c:\windows\system32\drivers\TM_CFW.sys
2009-02-19 20:19 . 2008-11-26 20:42 205,328 –a—— c:\windows\system32\drivers\tmxpflt.sys
2009-02-19 20:19 . 2009-02-19 20:19 80,400 –a—— c:\windows\system32\drivers\tmtdi.sys
2009-02-19 20:19 . 2008-11-26 20:42 36,368 –a—— c:\windows\system32\drivers\tmpreflt.sys
2009-02-19 20:07 . 2009-02-19 20:07 d——– c:\documents and settings\NetworkService\Application Data\Yahoo!
2009-02-01 10:18 . 2009-02-01 10:18 d——– c:\program files\MSECache
2009-01-25 13:19 . 2006-10-26 19:56 32,592 –a—— c:\windows\system32\msonpmon.dll
2009-01-25 13:18 . 2009-01-25 13:18 d——– c:\program files\Microsoft Works
2009-01-25 13:17 . 2009-01-25 13:17 d——– c:\program files\Microsoft.NET
2009-01-25 13:15 . 2009-02-20 21:36 d——– c:\documents and settings\All Users\Application Data\Microsoft Help
2009-01-25 13:14 . 2009-01-25 13:14 dr-h—– C:\MSOCache
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-21 20:39 ——— d—–w c:\program files\Yahoo!
2009-02-21 20:37 ——— d—–w c:\program files\Common Files\Scanner
2009-01-31 15:27 ——— d—–w c:\documents and settings\Chuck\Application Data\MiniLyrics
2009-01-31 14:41 1,682 –sha-w c:\windows\system32\KGyGaAvL.sys
2009-01-19 01:10 ——— d–h–w c:\program files\InstallShield Installation Information
2009-01-18 22:46 ——— d—–w c:\documents and settings\Chuck\Application Data\GetRightToGo
2009-01-13 01:48 ——— d—–w c:\documents and settings\Chuck\Application Data\FlySuite
2009-01-13 01:47 ——— d—–w c:\documents and settings\Chuck\Application Data\Yahoo!
2009-01-13 01:47 ——— d—–w c:\documents and settings\All Users\Application Data\yahoo!
2008-12-28 20:49 ——— d—–w c:\program files\Canon
2008-12-28 20:48 ——— d—–w c:\program files\Common Files\Canon
2008-12-28 20:44 ——— d–h–w c:\program files\CanonBJ
2008-12-28 20:39 ——— d–h–w c:\documents and settings\All Users\Application Data\CanonBJ
2008-12-28 20:35 410,984 —-a-w c:\windows\system32\deploytk.dll
2008-12-28 20:35 ——— d—–w c:\program files\Java
2008-12-28 18:10 ——— d—–w c:\program files\Common Files\Symantec Shared
2008-12-28 18:10 ——— d—–w c:\documents and settings\All Users\Application Data\Symantec
2008-12-28 18:08 ——— d—–w c:\program files\Symantec
2008-12-20 23:15 826,368 —-a-w c:\windows\system32\wininet.dll
2008-12-17 22:26 17,408 —-a-r c:\windows\system32\SZIO5.dll
2008-12-17 22:25 282,624 —-a-r c:\windows\system32\SZBase5.dll
2008-12-17 22:24 540,672 —-a-r c:\windows\system32\SZComp5.dll
2008-11-24 21:19 364,544 —-a-r c:\windows\system32\IS3DBA5.dll
2008-11-24 21:19 126,976 —-a-r c:\windows\system32\IS3HTUI5.dll
2008-11-24 21:18 61,440 —-a-r c:\windows\system32\IS3Hks5.dll
2008-11-24 21:18 372,736 —-a-r c:\windows\system32\IS3UI5.dll
2008-11-24 21:18 23,040 —-a-r c:\windows\system32\IS3XDat5.dll
2008-11-24 21:17 94,208 —-a-r c:\windows\system32\IS3Inet5.dll
2008-11-24 21:17 90,112 —-a-r c:\windows\system32\IS3Svc5.dll
2008-11-24 21:17 212,992 —-a-r c:\windows\system32\IS3Win325.dll
2008-11-24 21:14 708,608 —-a-r c:\windows\system32\IS3Base5.dll
.
((((((((((((((((((((((((((((( SnapShot@2009-02-22_20.05.41.39 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-02-23 01:20:11 16,384 —-atw c:\windows\Temp\Perflib_Perfdata_6ec.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-13 1695232]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"Yahoo! Pager"="c:\progra~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" [2007-08-30 4670704]
"OE"="c:\program files\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe" [2009-02-19 497008]
"Advanced SystemCare 3"="c:\program files\IObit\Advanced SystemCare 3\AWC.exe" [2009-01-09 2262352]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-05 64512]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 81920]
"DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2005-09-08 122940]
"Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 57344]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-28 136600]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-11-07 111936]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-11-04 413696]
"CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2008-03-10 689488]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2008-03-17 1848648]
"UfSeAgnt.exe"="c:\program files\Trend Micro\Internet Security\UfSeAgnt.exe" [2009-02-19 970808]
"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-02-21 509784]
"SigmatelSysTrayApp"="stsystra.exe" [2006-02-10 c:\windows\stsystra.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"OE"="c:\program files\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe" [2009-02-19 497008]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-05-26 123904]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-26 304128]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
–a—— 2008-11-20 13:20 290088 c:\program files\iTunes\iTunesHelper.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"d:\\StubInstaller.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-02-21 64160]
R0 szkg5;szkg;c:\windows\system32\drivers\SZKG.sys [2008-12-02 54656]
R2 tmpreflt;tmpreflt;c:\windows\system32\drivers\tmpreflt.sys [2009-02-19 36368]
R3 tmcfw;Trend Micro Common Firewall Service;c:\windows\system32\drivers\TM_CFW.sys [2009-02-19 334352]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2009-01-18 950096]
S2 tmevtmgr;tmevtmgr;c:\windows\system32\drivers\tmevtmgr.sys [2009-02-19 49680]
S2 TmPfw;Trend Micro Personal Firewall;c:\program files\Trend Micro\Internet Security\TmPfw.exe [2009-02-19 492888]
S2 TmProxy;Trend Micro Proxy Service;c:\program files\Trend Micro\Internet Security\TmProxy.exe [2009-02-19 677128]
.
Contents of the 'Scheduled Tasks' folder
2009-02-22 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-02-21 20:47]
2009-02-21 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
2009-02-23 c:\windows\Tasks\RegCure Program Check.job
- c:\program files\RegCure\RegCure.exe [2008-12-29 12:58]
2009-02-21 c:\windows\Tasks\RegCure.job
- c:\program files\RegCure\RegCure.exe [2008-12-29 12:58]
.
.
——- Supplementary Scan ——-
.
uStart Page = att.yahoo.com/
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
IE: &Search
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
LSP: c:\program files\Common Files\iS3\Anti-Spyware\iS3lsp.dll
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {48DF87EE-F2DE-11D8-BE7F-302050C10801} - hxxp://www.flysuite.com/flyword/loaderword_win.cab
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-22 20:30:12
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
- - - - - - - > 'lsass.exe'(1016)
c:\program files\Common Files\iS3\Anti-Spyware\iS3lsp.dll
.
Completion time: 2009-02-22 20:31:28
ComboFix-quarantined-files.txt 2009-02-23 01:31:25
ComboFix2.txt 2009-02-23 01:07:01
Pre-Run: 91,730,620,416 bytes free
Post-Run: 91,719,516,160 bytes free
254 — E O F — 2009-02-22 14:16:47
Here is the other log:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:32:56 PM, on 2/22/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Canon\MyPrinter\BJMyPrt.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE
C:\Program Files\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = att.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SITEguard BHO - {1827766B-9F49-4854-8034-F6EE26FCB1EC} - C:\Program Files\STOPzilla!\SZSG.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: STOPzilla Browser Helper Object - {E3215F20-3212-11D6-9F8B-00D0B743919D} - C:\Program Files\STOPzilla!\SZIEBHO.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SidebarAutoLaunch Class - {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D} - C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll
O3 - Toolbar: STOPzilla - {98828DED-A591-462F-83BA-D2F62A68B8B8} - C:\Program Files\STOPzilla!\SZSG.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon
O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
O4 - HKLM\..\Run: [UfSeAgnt.exe] "C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe"
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [OE] C:\Program Files\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe
O4 - HKCU\..\Run: [Advanced SystemCare 3] "C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe" /startup
O4 - HKUS\S-1-5-18\..\Run: [OE] C:\Program Files\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [OE] C:\Program Files\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe (User 'Default user')
O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\common files\is3\anti-spyware\is3lsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\is3\anti-spyware\is3lsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\is3\anti-spyware\is3lsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\is3\anti-spyware\is3lsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\is3\anti-spyware\is3lsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\is3\anti-spyware\is3lsp.dll
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://appldnld.apple.com.edgesuite.net/co…ex/qtplugin.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper20073151.dll
O16 - DPF: {48DF87EE-F2DE-11D8-BE7F-302050C10801} (FlyLoader Class) - http://www.flysuite.com/flyword/loaderword_win.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1235099237468
O16 - DPF: {F137B9BA-89EA-4B04-9C67-2074A9DF61FD} (Photo Upload Plugin Class) - http://cvs.pnimedia.com/upload/activex/v2_…upv2.0.0.10.cab?
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Google Updater Service (gusvc) - Unknown owner - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe (file missing)
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: LiveUpdate - Unknown owner - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE (file missing)
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Trend Micro Central Control Component (SfCtlCom) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe
O23 - Service: STOPzilla Service (szserver) - iS3, Inc. - C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe
O23 - Service: Trend Micro Unauthorized Change Prevention Service (TMBMServer) - Trend Micro Inc. - C:\Program Files\Trend Micro\BM\TMBMSRV.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (TmProxy) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\TmProxy.exe
–
End of file - 9938 bytes
Thanks - what is next
ComboFix 09-02-21.01 - Chuck 2009-02-22 20:28:33.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1022.490 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Chuck\Desktop\CFScript.txt
AV: Trend Micro Internet Security *On-access scanning disabled* (Updated)
FW: Trend Micro Personal Firewall *disabled*
* Created a new restore point
FILE ::
c:\windows\system32\7RS4S8Pg.exe
c:\windows\system32\exitwx.exe
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\exitwx.exe
c:\windows\Tasks\At25.job
c:\windows\Tasks\At26.job
c:\windows\Tasks\At27.job
c:\windows\Tasks\At28.job
c:\windows\Tasks\At29.job
c:\windows\Tasks\At30.job
c:\windows\Tasks\At31.job
c:\windows\Tasks\At32.job
c:\windows\Tasks\At33.job
c:\windows\Tasks\At34.job
c:\windows\Tasks\At35.job
c:\windows\Tasks\At36.job
c:\windows\Tasks\At37.job
c:\windows\Tasks\At38.job
c:\windows\Tasks\At39.job
c:\windows\Tasks\At40.job
c:\windows\Tasks\At41.job
c:\windows\Tasks\At42.job
c:\windows\Tasks\At43.job
c:\windows\Tasks\At44.job
c:\windows\Tasks\At45.job
c:\windows\Tasks\At46.job
c:\windows\Tasks\At47.job
c:\windows\Tasks\At48.job
.
((((((((((((((((((((((((( Files Created from 2009-01-23 to 2009-02-23 )))))))))))))))))))))))))))))))
.
2009-02-22 20:20 . 2009-02-22 20:21 1,648 –a—— c:\windows\system32\drivers\kgpcpy.cfg
2009-02-22 19:09 . 2009-02-22 19:09 488,144 –a—— C:\HJTsetup.exe
2009-02-22 15:29 . 2009-02-22 15:29 d——– c:\documents and settings\Chuck\DoctorWeb
2009-02-22 14:33 . 2009-02-22 14:33 d——– c:\windows\system32\Service
2009-02-22 14:23 . 2009-02-22 14:23 d——– c:\program files\Malwarebytes' Anti-Malware
2009-02-22 14:23 . 2009-02-22 14:23 d——– c:\documents and settings\Chuck\Application Data\Malwarebytes
2009-02-22 14:23 . 2009-02-22 14:23 d——– c:\documents and settings\All Users\Application Data\Malwarebytes
2009-02-22 14:23 . 2009-02-11 10:19 38,496 –a—— c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-22 14:23 . 2009-02-11 10:19 15,504 –a—— c:\windows\system32\drivers\mbam.sys
2009-02-22 13:00 . 2009-02-22 13:00 d——– c:\windows\system32\XPSViewer
2009-02-22 13:00 . 2009-02-22 13:00 d——– c:\program files\Reference Assemblies
2009-02-22 13:00 . 2009-02-22 13:00 d——– c:\program files\MSBuild
2009-02-22 12:58 . 2008-07-06 07:06 1,676,288 ——— c:\windows\system32\xpssvcs.dll
2009-02-22 12:58 . 2008-07-06 07:06 1,676,288 —–c— c:\windows\system32\dllcache\xpssvcs.dll
2009-02-22 12:58 . 2008-07-06 05:50 597,504 —–c— c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-02-22 12:58 . 2008-07-06 07:06 575,488 ——— c:\windows\system32\xpsshhdr.dll
2009-02-22 12:58 . 2008-07-06 07:06 575,488 —–c— c:\windows\system32\dllcache\xpsshhdr.dll
2009-02-22 12:58 . 2008-07-06 07:06 117,760 ——— c:\windows\system32\prntvpt.dll
2009-02-22 12:58 . 2008-07-06 07:06 89,088 —–c— c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-02-22 12:42 . 2009-02-22 12:42 d——– c:\documents and settings\Chuck\Application Data\Windows Desktop Search
2009-02-22 12:40 . 2009-02-22 12:40 d——– c:\windows\system32\GroupPolicy
2009-02-22 12:40 . 2009-02-22 12:40 d——– c:\program files\Windows Desktop Search
2009-02-22 12:38 . 2009-02-22 12:38 d——– c:\program files\Windows Media Connect 2
2009-02-22 12:33 . 2009-02-22 14:07 d——– c:\windows\system32\LogFiles
2009-02-22 12:33 . 2009-02-22 12:36 d——– c:\windows\system32\drivers\UMDF
2009-02-22 09:37 . 2009-02-22 09:37 2,560 –a—— c:\windows\system32\drivers\mchInjDrv.sys
2009-02-22 09:16 . 2009-02-22 09:16 d–h—– c:\windows\$hf_mig$
2009-02-21 21:52 . 2009-02-22 17:08 d——– c:\documents and settings\All Users\Application Data\SITEguard
2009-02-21 21:51 . 2009-02-21 21:51 d——– c:\program files\STOPzilla!
2009-02-21 21:51 . 2009-02-21 21:51 d——– c:\program files\Common Files\iS3
2009-02-21 21:51 . 2009-02-22 20:25 d——– c:\documents and settings\All Users\Application Data\STOPzilla!
2009-02-21 21:38 . 2009-02-21 20:47 15,688 –a—— c:\windows\system32\lsdelete.exe
2009-02-21 20:47 . 2009-02-21 20:47 64,160 –a—— c:\windows\system32\drivers\Lbd.sys
2009-02-21 20:45 . 2009-02-21 20:45 d——– c:\program files\Lavasoft
2009-02-21 20:45 . 2009-02-21 20:47 d——– c:\documents and settings\All Users\Application Data\Lavasoft
2009-02-21 20:45 . 2009-02-21 20:45 d–h-c— c:\documents and settings\All Users\Application Data\{83C91755-2546-441D-AC40-9A6B4B860800}
2009-02-21 16:18 . 2009-02-21 16:18 d——– c:\program files\IObit
2009-02-21 16:18 . 2009-02-21 16:18 d——– c:\documents and settings\Chuck\Application Data\IObit
2009-02-21 12:32 . 2009-02-21 12:32 d——– c:\program files\RegCure
2009-02-21 12:27 . 2009-02-21 12:27 d——– c:\program files\CCleaner
2009-02-20 19:43 . 2009-02-22 09:43 d——– c:\program files\Enigma Software Group
2009-02-20 19:38 . 2008-10-16 14:06 268,648 –a—— c:\windows\system32\mucltui.dll
2009-02-20 19:38 . 2008-10-16 14:06 27,496 –a—— c:\windows\system32\mucltui.dll.mui
2009-02-19 20:21 . 2009-02-19 22:17 d——– c:\documents and settings\All Users\Application Data\Trend Micro
2009-02-19 20:21 . 2009-02-19 20:19 144,912 –a—— c:\windows\system32\drivers\tmcomm.sys
2009-02-19 20:21 . 2009-02-19 20:19 50,192 –a—— c:\windows\system32\drivers\tmactmon.sys
2009-02-19 20:21 . 2009-02-19 20:19 49,680 –a—— c:\windows\system32\drivers\tmevtmgr.sys
2009-02-19 20:20 . 2009-02-22 19:13 d——– c:\program files\Trend Micro
2009-02-19 20:19 . 2008-11-26 20:39 1,195,384 –a—— c:\windows\system32\drivers\vsapint.sys
2009-02-19 20:19 . 2009-02-19 20:19 661,808 –a—— c:\windows\system32\UfWSC.cpl
2009-02-19 20:19 . 2009-02-19 20:19 334,352 –a—— c:\windows\system32\drivers\TM_CFW.sys
2009-02-19 20:19 . 2008-11-26 20:42 205,328 –a—— c:\windows\system32\drivers\tmxpflt.sys
2009-02-19 20:19 . 2009-02-19 20:19 80,400 –a—— c:\windows\system32\drivers\tmtdi.sys
2009-02-19 20:19 . 2008-11-26 20:42 36,368 –a—— c:\windows\system32\drivers\tmpreflt.sys
2009-02-19 20:07 . 2009-02-19 20:07 d——– c:\documents and settings\NetworkService\Application Data\Yahoo!
2009-02-01 10:18 . 2009-02-01 10:18 d——– c:\program files\MSECache
2009-01-25 13:19 . 2006-10-26 19:56 32,592 –a—— c:\windows\system32\msonpmon.dll
2009-01-25 13:18 . 2009-01-25 13:18 d——– c:\program files\Microsoft Works
2009-01-25 13:17 . 2009-01-25 13:17 d——– c:\program files\Microsoft.NET
2009-01-25 13:15 . 2009-02-20 21:36 d——– c:\documents and settings\All Users\Application Data\Microsoft Help
2009-01-25 13:14 . 2009-01-25 13:14 dr-h—– C:\MSOCache
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-21 20:39 ——— d—–w c:\program files\Yahoo!
2009-02-21 20:37 ——— d—–w c:\program files\Common Files\Scanner
2009-01-31 15:27 ——— d—–w c:\documents and settings\Chuck\Application Data\MiniLyrics
2009-01-31 14:41 1,682 –sha-w c:\windows\system32\KGyGaAvL.sys
2009-01-19 01:10 ——— d–h–w c:\program files\InstallShield Installation Information
2009-01-18 22:46 ——— d—–w c:\documents and settings\Chuck\Application Data\GetRightToGo
2009-01-13 01:48 ——— d—–w c:\documents and settings\Chuck\Application Data\FlySuite
2009-01-13 01:47 ——— d—–w c:\documents and settings\Chuck\Application Data\Yahoo!
2009-01-13 01:47 ——— d—–w c:\documents and settings\All Users\Application Data\yahoo!
2008-12-28 20:49 ——— d—–w c:\program files\Canon
2008-12-28 20:48 ——— d—–w c:\program files\Common Files\Canon
2008-12-28 20:44 ——— d–h–w c:\program files\CanonBJ
2008-12-28 20:39 ——— d–h–w c:\documents and settings\All Users\Application Data\CanonBJ
2008-12-28 20:35 410,984 —-a-w c:\windows\system32\deploytk.dll
2008-12-28 20:35 ——— d—–w c:\program files\Java
2008-12-28 18:10 ——— d—–w c:\program files\Common Files\Symantec Shared
2008-12-28 18:10 ——— d—–w c:\documents and settings\All Users\Application Data\Symantec
2008-12-28 18:08 ——— d—–w c:\program files\Symantec
2008-12-20 23:15 826,368 —-a-w c:\windows\system32\wininet.dll
2008-12-17 22:26 17,408 —-a-r c:\windows\system32\SZIO5.dll
2008-12-17 22:25 282,624 —-a-r c:\windows\system32\SZBase5.dll
2008-12-17 22:24 540,672 —-a-r c:\windows\system32\SZComp5.dll
2008-11-24 21:19 364,544 —-a-r c:\windows\system32\IS3DBA5.dll
2008-11-24 21:19 126,976 —-a-r c:\windows\system32\IS3HTUI5.dll
2008-11-24 21:18 61,440 —-a-r c:\windows\system32\IS3Hks5.dll
2008-11-24 21:18 372,736 —-a-r c:\windows\system32\IS3UI5.dll
2008-11-24 21:18 23,040 —-a-r c:\windows\system32\IS3XDat5.dll
2008-11-24 21:17 94,208 —-a-r c:\windows\system32\IS3Inet5.dll
2008-11-24 21:17 90,112 —-a-r c:\windows\system32\IS3Svc5.dll
2008-11-24 21:17 212,992 —-a-r c:\windows\system32\IS3Win325.dll
2008-11-24 21:14 708,608 —-a-r c:\windows\system32\IS3Base5.dll
.
((((((((((((((((((((((((((((( SnapShot@2009-02-22_20.05.41.39 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-02-23 01:20:11 16,384 —-atw c:\windows\Temp\Perflib_Perfdata_6ec.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-13 1695232]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"Yahoo! Pager"="c:\progra~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" [2007-08-30 4670704]
"OE"="c:\program files\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe" [2009-02-19 497008]
"Advanced SystemCare 3"="c:\program files\IObit\Advanced SystemCare 3\AWC.exe" [2009-01-09 2262352]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-05 64512]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 81920]
"DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2005-09-08 122940]
"Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 57344]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-28 136600]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-11-07 111936]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-11-04 413696]
"CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2008-03-10 689488]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2008-03-17 1848648]
"UfSeAgnt.exe"="c:\program files\Trend Micro\Internet Security\UfSeAgnt.exe" [2009-02-19 970808]
"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-02-21 509784]
"SigmatelSysTrayApp"="stsystra.exe" [2006-02-10 c:\windows\stsystra.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"OE"="c:\program files\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe" [2009-02-19 497008]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-05-26 123904]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-26 304128]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
–a—— 2008-11-20 13:20 290088 c:\program files\iTunes\iTunesHelper.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"d:\\StubInstaller.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-02-21 64160]
R0 szkg5;szkg;c:\windows\system32\drivers\SZKG.sys [2008-12-02 54656]
R2 tmpreflt;tmpreflt;c:\windows\system32\drivers\tmpreflt.sys [2009-02-19 36368]
R3 tmcfw;Trend Micro Common Firewall Service;c:\windows\system32\drivers\TM_CFW.sys [2009-02-19 334352]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2009-01-18 950096]
S2 tmevtmgr;tmevtmgr;c:\windows\system32\drivers\tmevtmgr.sys [2009-02-19 49680]
S2 TmPfw;Trend Micro Personal Firewall;c:\program files\Trend Micro\Internet Security\TmPfw.exe [2009-02-19 492888]
S2 TmProxy;Trend Micro Proxy Service;c:\program files\Trend Micro\Internet Security\TmProxy.exe [2009-02-19 677128]
.
Contents of the 'Scheduled Tasks' folder
2009-02-22 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-02-21 20:47]
2009-02-21 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
2009-02-23 c:\windows\Tasks\RegCure Program Check.job
- c:\program files\RegCure\RegCure.exe [2008-12-29 12:58]
2009-02-21 c:\windows\Tasks\RegCure.job
- c:\program files\RegCure\RegCure.exe [2008-12-29 12:58]
.
.
——- Supplementary Scan ——-
.
uStart Page = att.yahoo.com/
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
IE: &Search
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
LSP: c:\program files\Common Files\iS3\Anti-Spyware\iS3lsp.dll
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {48DF87EE-F2DE-11D8-BE7F-302050C10801} - hxxp://www.flysuite.com/flyword/loaderword_win.cab
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-22 20:30:12
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
- - - - - - - > 'lsass.exe'(1016)
c:\program files\Common Files\iS3\Anti-Spyware\iS3lsp.dll
.
Completion time: 2009-02-22 20:31:28
ComboFix-quarantined-files.txt 2009-02-23 01:31:25
ComboFix2.txt 2009-02-23 01:07:01
Pre-Run: 91,730,620,416 bytes free
Post-Run: 91,719,516,160 bytes free
254 — E O F — 2009-02-22 14:16:47
Here is the other log:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:32:56 PM, on 2/22/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Canon\MyPrinter\BJMyPrt.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE
C:\Program Files\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = att.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SITEguard BHO - {1827766B-9F49-4854-8034-F6EE26FCB1EC} - C:\Program Files\STOPzilla!\SZSG.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: STOPzilla Browser Helper Object - {E3215F20-3212-11D6-9F8B-00D0B743919D} - C:\Program Files\STOPzilla!\SZIEBHO.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SidebarAutoLaunch Class - {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D} - C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll
O3 - Toolbar: STOPzilla - {98828DED-A591-462F-83BA-D2F62A68B8B8} - C:\Program Files\STOPzilla!\SZSG.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon
O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
O4 - HKLM\..\Run: [UfSeAgnt.exe] "C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe"
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [OE] C:\Program Files\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe
O4 - HKCU\..\Run: [Advanced SystemCare 3] "C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe" /startup
O4 - HKUS\S-1-5-18\..\Run: [OE] C:\Program Files\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [OE] C:\Program Files\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe (User 'Default user')
O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\common files\is3\anti-spyware\is3lsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\is3\anti-spyware\is3lsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\is3\anti-spyware\is3lsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\is3\anti-spyware\is3lsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\is3\anti-spyware\is3lsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\is3\anti-spyware\is3lsp.dll
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://appldnld.apple.com.edgesuite.net/co…ex/qtplugin.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper20073151.dll
O16 - DPF: {48DF87EE-F2DE-11D8-BE7F-302050C10801} (FlyLoader Class) - http://www.flysuite.com/flyword/loaderword_win.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1235099237468
O16 - DPF: {F137B9BA-89EA-4B04-9C67-2074A9DF61FD} (Photo Upload Plugin Class) - http://cvs.pnimedia.com/upload/activex/v2_…upv2.0.0.10.cab?
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Google Updater Service (gusvc) - Unknown owner - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe (file missing)
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: LiveUpdate - Unknown owner - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE (file missing)
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Trend Micro Central Control Component (SfCtlCom) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe
O23 - Service: STOPzilla Service (szserver) - iS3, Inc. - C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe
O23 - Service: Trend Micro Unauthorized Change Prevention Service (TMBMServer) - Trend Micro Inc. - C:\Program Files\Trend Micro\BM\TMBMSRV.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (TmProxy) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\TmProxy.exe
–
End of file - 9938 bytes
Thanks - what is next
Should have found you sooner!!!
