Spyware / Malware / Virus Removal

[Resolved] Infected by TR/Crypt.XPack.Gen

14 min read

Looking for the outcome? Ask AI

kunrod3 Topic Starter

Post #1March 9, 2009, 2:17 AM UTC

Saturday night (3/7/09) while I was updating AntiVir I had numerous pop-ups from the anti-virus software stating that I had this infection of TR/Crypt.XPack.Gen. No matter which of the choices I clicked on, the pop-ups came right back up. The system grinded to a halt. I am running Windows XP Home Edition.

There were three files associated with these pop-ups; meyizate.dll, sezadowi.dll and hexydzy.dll - all located
in the C:\Windows\System32 folder. I tried deleting them manually but got an "access denied". I tried booting into
Safe Mode with a command prompt and deleting them with no luck. I downloaded Microsoft's Malicious Software Removal Tool - no luck. I downloaded Avast - no luck. And so here I am.

I followed your instructions in the topic "Before posting a HijackThis Log Self Help" - I changed the folder options in My Computer, I downloaded and ran ATF Cleaner, I downloaded and ran Malwarebytes Anti-Malware. I also downloaded and ran ERUNT and HijackThis. The Anti-Malware program found some stuff, but I'm still seeing two of the three dll files listed above - I don't see them in the C:\Windows\System32 folder anymore, but I do see them when I run AutoRuns and in the HijackThis log. I uninstalled AntiVir and am currently using Avast. Except for seeing these files listed I don't notice any system problems. I'm sure that doesn't mean they don't exist. I think I covered everything. Below are the mbam log and the HijackThis log. Any help would be appreciated. Thanks.

Malwarebytes' Anti-Malware 1.34
Database version: 1827
Windows 5.1.2600 Service Pack 2

3/8/2009 1:13:05 PM
mbam-log-2009-03-08 (13-13-05).txt

Scan type: Quick Scan
Objects scanned: 69414
Time elapsed: 4 minute(s), 18 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 1
Registry Keys Infected: 7
Registry Values Infected: 2
Registry Data Items Infected: 0
Folders Infected: 2
Files Infected: 4

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
C:\WINDOWS\system32\tewameko.dll (Trojan.Vundo.H) -> Delete on reboot.

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{a57ecb0d-518c-4aff-9bfd-08d17530fe86} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{a57ecb0d-518c-4aff-9bfd-08d17530fe86} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{a57ecb0d-518c-4aff-9bfd-08d17530fe86} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{ec43e3fd-5c60-46a6-97d7-e0b85dbdd6c4} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\MediaHoldings (Adware.PlayMP3Z) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yurukijilu (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\{4d25f926-b9fe-4682-bf72-8ab8210d6d75} (Adware.MyWebSearch) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\Program Files\MyWaySA (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWaySA\SrchAsDe (Adware.MyWebSearch) -> Quarantined and deleted successfully.

Files Infected:
C:\WINDOWS\system32\zalohema.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ameholaz.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\tewameko.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\Documents and Settings\Davis\Local Settings\Temp\svchost.exe (Trojan.Agent) -> Quarantined and deleted successfully.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:33:12 PM, on 3/8/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\Program Files\Webroot\Spy Sweeper\WRConsumerService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\Davis\My Documents\My Downloads\Set Up and Tried\ghrone-0.271\Ghrone.exe
C:\Program Files\XemiComputers\Active Desktop Calendar\ADC.exe
C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\WINDOWS\system32\crypserv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\runservice.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\CDBurnerXP\NMSAccessU.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe
C:\WINDOWS\system32\hpzipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\Compact Wireless-G USB Network Adapter with SpeedBooster\WLService.exe
C:\Program Files\Compact Wireless-G USB Network Adapter with SpeedBooster\WUSB54GSC.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Webroot\Spy Sweeper\SSU.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://mysearch.myway.com/jsp/dellsidebar.jsp?p=DE
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: (no name) - AutorunsDisabled - (no file)
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: StumbleUpon Launcher - {145B29F4-A56B-4b90-BBAC-45784EBEBBB7} - C:\Program Files\StumbleUpon\StumbleUponIEBar.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: (no name) - {4D25F921-B9FE-4682-BF72-8AB8210D6D75} - (no file)
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: StumbleUpon Toolbar - {5093EB4C-3E93-40AB-9266-B607BA87BDC8} - C:\Program Files\StumbleUpon\StumbleUponIEBar.dll
O4 - HKLM\..\Run: [NvCplDaemon] "C:\WINDOWS\system32\RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [CTSysVol] "C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe" /r
O4 - HKLM\..\Run: [P17Helper] "C:\WINDOWS\system32\rundll32.exe" P17.dll,P17Helper
O4 - HKLM\..\Run: [UpdReg] "C:\WINDOWS\UpdReg.EXE"
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [nwiz] "C:\WINDOWS\system32\nwiz.exe" /install
O4 - HKLM\..\Run: [NvMediaCenter] "C:\WINDOWS\system32\RUNDLL32.EXE" C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] "C:\WINDOWS\system32\dumprep.exe" 0 -k
O4 - HKLM\..\Run: [DLA] "C:\WINDOWS\System32\DLA\DLACTRLW.EXE"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray
O4 - HKCU\..\Run: [ctfmon.exe] "C:\WINDOWS\system32\ctfmon.exe"
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Davis\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [Ghrone] "C:\Documents and Settings\Davis\My Documents\My Downloads\Set Up and Tried\ghrone-0.271\Ghrone.exe"
O4 - HKCU\..\Run: [Active Desktop Calendar] "C:\Program Files\XemiComputers\Active Desktop Calendar\ADC.exe"
O4 - HKUS\S-1-5-19\..\Run: [yurukijilu] Rundll32.exe "C:\WINDOWS\system32\sezadowi.dll",s (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [yurukijilu] Rundll32.exe "C:\WINDOWS\system32\sezadowi.dll",s (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [yurukijilu] Rundll32.exe "C:\WINDOWS\system32\sezadowi.dll",s (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [yurukijilu] Rundll32.exe "C:\WINDOWS\system32\sezadowi.dll",s (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: StumbleUpon PhotoBlog It! - res://StumbleUponIEBar.dll/blogimage
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/…lscbase6662.cab
O20 - AppInit_DLLs: C:\WINDOWS\system32\meyizate.dll
O23 - Service: Adobe Active File Monitor (AdobeActiveFileMonitor) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: Crypkey License - CrypKey (Canada) Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LicCtrl Service (LicCtrlService) - Unknown owner - C:\WINDOWS\runservice.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Photoshop Elements Device Connect (PhotoshopElementsDeviceConnect) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\hpzipm12.exe
O23 - Service: SolidWorks Licensing Service - SolidWorks - C:\Program Files\Common Files\SolidWorks Shared\Service\SolidWorksLicensing.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. (www.webroot.com) - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
O23 - Service: Webroot Client Service (WRConsumerService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRConsumerService.exe
O23 - Service: WUSB54GSCSVC - GEMTEKS - C:\Program Files\Compact Wireless-G USB Network Adapter with SpeedBooster\WLService.exe

–
End of file - 12031 bytes

Tomk

Post #2March 9, 2009, 3:17 AM UTC

Hi kunrod3,

My name is Tomk. I would be glad to take a look at your log and help you with solving any malware problems. HijackThis logs can take a while to research, so please be patient and I'd be grateful if you would note the following:

I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
The fixes are specific to your problem and should only be used for the issues on this machine.
Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
It's often worth reading through these instructions and printing them for ease of reference.
If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
Please reply to this thread. Do not start a new topic.

Download ComboFix from one of these locations:

Link 1
Link 2
Link 3

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link –> http://forums.whatthetech.com/How_Disable_…ams_t96260.html
Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Notes:

1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
4. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
5. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

kunrod3

Post #3March 9, 2009, 3:52 PM UTC

Hi Tom -

Thanks for your response.

First a little update. Last night (Sunday) after I had posted I re-ran Malwarebytes - no problems found. Overnight, my Webroot Spy Sweeper,
during it's daily scan found the adware virtumonde. This morning, after seeing the Spy Sweeper notice I re-ran Malwarebytes
and Spy Sweeper - no problems found.

After finding you response I followed your directions - I downloaded ComboFix, I disabled Avast and Spy Sweeper, I ran ComboFix - it installed the Microsoft Windows Recovery Console - and then it did it's scan. Below is the ComboFix log.

ComboFix 09-03-06.02 - Davis 2009-03-09 10:21:35.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.3326.2671 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: avast! antivirus 4.8.1335 [VPS 090308-0] *On-access scanning disabled* (Updated)
FW: Webroot Internet Security Essentials *disabled*
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
c:\program files\INSTALL.LOG
c:\windows\IE4 Error Log.txt
c:\windows\system32\hexdzy.dll
c:\windows\system32\hunupave.dll
c:\windows\system32\vezaliyu.dll

—– BITS: Possible infected sites —–

hxxp://82.98.235.205
.
((((((((((((((((((((((((( Files Created from 2009-02-09 to 2009-03-09 )))))))))))))))))))))))))))))))
.

2009-03-08 13:06 . 2009-03-08 13:06 d——– c:\documents and settings\Davis\Application Data\Malwarebytes
2009-03-08 13:05 . 2009-03-08 13:05 d——– c:\program files\Malwarebytes' Anti-Malware
2009-03-08 13:05 . 2009-03-08 13:05 d——– c:\documents and settings\All Users\Application Data\Malwarebytes
2009-03-08 13:05 . 2009-02-11 10:19 38,496 –a—— c:\windows\system32\drivers\mbamswissarmy.sys
2009-03-08 13:05 . 2009-02-11 10:19 15,504 –a—— c:\windows\system32\drivers\mbam.sys
2009-03-08 12:37 . 2009-03-08 12:37 d——– c:\program files\ERUNT
2009-03-08 12:08 . 2009-03-08 12:08 d——– c:\program files\Trend Micro
2009-03-08 10:45 . 2009-03-08 10:45 2,713 —hs—- c:\windows\system32\letojomu.dll
2009-03-08 10:44 . 2009-03-08 10:44 2,713 —hs—- c:\windows\system32\notabage.dll
2009-03-08 08:41 . 2009-03-08 08:41 d——– c:\program files\Alwil Software
2009-03-08 08:33 . 2009-03-08 08:37 d——– c:\program files\Windows Live Safety Center
2009-03-08 05:36 . 2005-08-31 22:39 d——– c:\documents and settings\Administrator\Application Data\Symantec
2009-03-08 05:36 . 2005-08-31 22:31 d——– c:\documents and settings\Administrator\Application Data\Jasc Software Inc
2009-03-08 05:36 . 2005-08-31 22:45 d——– c:\documents and settings\Administrator\Application Data\Creative
2009-03-08 05:36 . 2009-03-08 05:36 d——– c:\documents and settings\Administrator
2009-03-04 12:39 . 2009-03-04 12:39 d——– c:\program files\FSEarthTilesV1_0
2009-03-02 15:02 . 2009-03-02 15:02 d——– c:\program files\Microsoft Silverlight
2009-03-01 16:50 . 2006-05-10 09:50 419,164 –a—— C:\L_M01_FACE_04.TGA
2009-03-01 16:50 . 2006-05-10 09:50 317,226 –a—— C:\L_M01_FACE_03.TGA
2009-03-01 16:50 . 2006-05-10 09:49 317,226 –a—— C:\L_M01_FACE_02.TGA
2009-03-01 16:50 . 2006-05-10 09:49 317,226 –a—— C:\L_M01_FACE_01.TGA
2009-02-26 18:35 . 2009-02-26 18:35 d——– c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2009-02-26 18:33 . 2009-02-26 18:33 d——– c:\program files\Bonjour
2009-02-26 18:32 . 2009-02-26 18:33 d——– c:\program files\QuickTime
2009-02-15 20:47 . 2009-02-15 20:47 145 –a—— c:\windows\fcp5.cfg
2009-02-15 20:28 . 2007-08-21 19:54 1,511,424 –a—— c:\windows\system32\Flash8.ocx
2009-02-15 20:28 . 2007-08-21 19:56 196,608 –a—— c:\windows\system32\Utility.dll
2009-02-15 20:28 . 2007-08-21 19:54 109,248 –a—— c:\windows\system32\Mswinsck.ocx
2009-02-15 20:28 . 2007-08-21 19:54 32,768 –a—— c:\windows\system32\Flash8.oca
2009-02-15 20:27 . 1996-11-08 03:48 368,912 –a—— c:\windows\system32\vbar332.dll
2009-02-11 18:58 . 2009-02-11 18:58 d——– c:\documents and settings\All Users\Application Data\MSScanAppDataDir
2009-02-11 17:27 . 2009-02-11 17:27 d——– c:\program files\LiknoWebButtonMakerFree
2009-02-11 17:27 . 2002-10-21 16:31 1,013,760 –a—— c:\windows\system32\Ltwvc13n.dll
2009-02-11 17:27 . 2002-10-21 16:01 446,464 –a—— c:\windows\system32\ltimg13n.dll
2009-02-11 17:27 . 2002-10-24 18:08 443,392 –a—— c:\windows\system32\ltkrn13n.dll
2009-02-11 17:27 . 2002-10-22 14:53 393,216 –a—— c:\windows\system32\LFCMP13n.DLL
2009-02-11 17:27 . 2002-10-21 15:53 265,728 –a—— c:\windows\system32\LTDIS13n.dll
2009-02-11 17:27 . 2002-10-21 16:01 205,824 –a—— c:\windows\system32\ltefx13n.dll
2009-02-11 17:27 . 2002-10-21 16:39 181,248 –a—— c:\windows\system32\Lfpng13n.dll
2009-02-11 17:27 . 2002-10-21 16:00 139,776 –a—— c:\windows\system32\ltfil13n.DLL
2009-02-11 17:27 . 2002-10-21 16:03 35,328 –a—— c:\windows\system32\lfgif13n.dll
2009-02-11 17:27 . 2002-10-21 16:02 30,208 –a—— c:\windows\system32\lfbmp13n.dll
2009-02-11 16:55 . 2009-02-11 16:55 d——– c:\program files\AWC
2009-02-11 16:55 . 2005-09-04 20:01 1,056,768 –a—— c:\windows\system32\FreeImage.dll
2009-02-11 16:55 . 1999-10-30 02:00 167,936 –a—— c:\windows\system32\ccrpftv6.ocx
2009-02-11 16:55 . 1999-09-16 10:04 151,552 –a—— c:\windows\system32\ccrpFD6.ocx
2009-02-11 16:55 . 2000-10-11 19:07 98,304 –a—— c:\windows\system32\ccrpUCW6.dll
2009-02-11 16:55 . 2000-10-11 19:18 98,304 –a—— c:\windows\system32\ccrpDtp6.ocx
2009-02-11 16:55 . 1998-11-23 17:10 90,112 –a—— c:\windows\system32\ccrpTmr6.dll
2009-02-11 16:55 . 2000-03-15 19:22 86,016 –a—— c:\windows\system32\ccrpudn6.ocx
2009-02-11 16:55 . 2003-08-11 00:25 40,960 –a—— c:\windows\system32\DLLDesktop.dll
2009-02-11 16:55 . 2003-08-10 13:04 36,864 –a—— c:\windows\system32\AlphaImageCreator.dll
2009-02-09 23:27 . 2009-02-09 23:27 0 –ah—– c:\windows\SwSys2.bmp
2009-02-09 23:27 . 2009-02-09 23:27 0 –ah—– c:\windows\SwSys1.bmp

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-27 00:45 ——— d—–w c:\program files\Winamp
2009-02-26 23:35 ——— d—–w c:\program files\iTunes
2009-02-26 23:35 ——— d—–w c:\program files\iPod
2009-02-26 23:35 ——— d—–w c:\program files\Common Files\Apple
2009-02-26 23:30 ——— d—–w c:\program files\Apple Software Update
2009-02-24 17:54 ——— d—–w c:\documents and settings\Davis\Application Data\Winamp
2009-02-24 01:53 ——— d—–w c:\documents and settings\Davis\Application Data\FrostWire
2009-02-19 03:45 ——— d—–w c:\documents and settings\Davis\Application Data\LimeWire
2009-02-15 19:22 ——— d—–w c:\program files\Notepad++
2009-02-08 04:00 ——— d—–w c:\program files\Common Files\xing shared
2009-02-08 03:59 ——— d—–w c:\program files\Common Files\Real
2009-02-02 12:30 ——— d—–w c:\program files\HP
2009-01-31 00:44 ——— d—–w c:\documents and settings\Davis\Application Data\U3
2009-01-29 23:14 ——— d—–w c:\program files\MDK2
2009-01-29 20:25 ——— d—–w c:\program files\NovaLogic
2009-01-29 20:20 ——— d–h–w c:\program files\InstallShield Installation Information
2009-01-27 15:21 ——— d—–w c:\program files\National Instruments
2009-01-27 15:20 ——— d—–w c:\program files\VWS Installer
2009-01-26 23:55 ——— d—–w c:\documents and settings\Davis\Application Data\Inkscape
2009-01-26 23:54 ——— d—–w c:\program files\Inkscape
2009-01-26 01:17 ——— d–h–w c:\documents and settings\Davis\Application Data\Move Networks
2009-01-20 18:00 ——— d—–w c:\program files\iDailyDiary
2009-01-20 17:49 ——— d—–w c:\program files\Pro Imaging Powertoys
2009-01-20 17:49 ——— d—–w c:\program files\Common Files\Nikon
2009-01-20 17:33 ——— d—–w c:\program files\RegScrubVistaXP
2009-01-17 00:37 ——— d—–w c:\program files\ColorCop
2009-01-15 15:13 ——— d—–w c:\program files\Reference Assemblies
2009-01-15 15:13 ——— d—–w c:\program files\MSBuild
2009-01-15 15:11 ——— d—–w c:\program files\MSXML 6.0
2008-09-18 12:38 40,283 ——w c:\program files\AlphaChessHistory.dat
2007-04-16 13:20 9,469,496 ——w c:\program files\Acoustica-Spin-It-Again-Installer.exe
2004-08-04 10:00 94,784 –sh–w c:\windows\twain.dll
2004-08-04 10:00 50,688 –sh–w c:\windows\twain_32.dll
2005-11-08 00:02 56 –sh–r c:\windows\system32\325DB1D331.sys
2005-11-08 00:02 1,682 –sh–w c:\windows\system32\KGyGaAvL.sys
2004-08-04 10:00 1,028,096 –sh–w c:\windows\system32\mfc42.dll
2004-08-04 10:00 54,784 –sh–w c:\windows\system32\msvcirt.dll
2004-08-04 10:00 413,696 –sh–w c:\windows\system32\msvcp60.dll
2004-08-04 10:00 11,776 –sh–w c:\windows\system32\regsvr32.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"Google Update"="c:\documents and settings\Davis\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-09-05 133104]
"Ghrone"="c:\documents and settings\Davis\My Documents\My Downloads\Set Up and Tried\ghrone-0.271\Ghrone.exe" [2002-02-19 385024]
"Active Desktop Calendar"="c:\program files\XemiComputers\Active Desktop Calendar\ADC.exe" [2009-02-02 4483584]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-12-05 8523776]
"CTSysVol"="c:\program files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe" [2003-09-17 57344]
"UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112]
"DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-02-23 53248]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 81920]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"nwiz"="c:\windows\system32\nwiz.exe" [2007-12-05 1626112]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-12-05 81920]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2008-08-03 36352]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-01 136600]
"DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2006-06-13 127036]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-02-07 198160]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-01-06 290088]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]
"P17Helper"="P17.dll" [2004-06-10 c:\windows\system32\P17.dll]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2004-10-04 113664]
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2005-08-31 24576]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.iv31"= c:\windows\system32\ir32_32.dll
"vidc.iv32"= c:\windows\system32\ir32_32.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WRConsumerService]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\fxsclnt.exe"=
"c:\\Program Files\\MSN\\MSNCoreFiles\\msn.exe"=
"c:\\Program Files\\Compact Wireless-G USB Network Adapter with SpeedBooster\\InvokeSvc2.exe"=
"c:\\WINDOWS\\system32\\mmc.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\NovaLogic\\Delta Force Land Warrior\\Update.exe"=
"c:\\Program Files\\AnalogX\\Atomic TimeSync\\ats.exe"=
"c:\\Program Files\\Microsoft Games\\Links 2003\\LinksMMIII.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\WINDOWS\\system32\\wscntfy.exe"=
"c:\\Program Files\\Compact Wireless-G USB Network Adapter with SpeedBooster\\WUSB54GSC.exe"=

R0 ssfs0bbc;ssfs0bbc;c:\windows\system32\drivers\ssfs0bbc.sys [2008-08-09 29808]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2009-03-08 114768]
R2 AdobeActiveFileMonitor;Adobe Active File Monitor;c:\program files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe [2004-10-04 98304]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009-03-08 20560]
R2 LicCtrlService;LicCtrl Service;c:\windows\Runservice.exe [2008-03-01 2560]
R2 PhotoshopElementsDeviceConnect;Photoshop Elements Device Connect;c:\program files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe [2004-10-04 118784]
R2 WRConsumerService;Webroot Client Service;c:\program files\Webroot\Spy Sweeper\WRConsumerService.exe [2008-12-03 1086840]
R2 WUSB54GSCSVC;WUSB54GSCSVC;c:\program files\Compact Wireless-G USB Network Adapter with SpeedBooster\WLService.exe [2008-01-17 53307]
R3 HPPLSBULK;HPPLSBULK;c:\windows\system32\drivers\hpplsbulk.sys [2009-02-02 9344]
S3 krdpdre;krdpdre;\??\c:\docume~1\Davis\LOCALS~1\Temp\krdpdre.sys –> c:\docume~1\Davis\LOCALS~1\Temp\krdpdre.sys [?]

— Other Services/Drivers In Memory —

*NewlyCreated* - GTNDIS5

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
\Shell\AutoRun\command - F:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{29b16419-ec03-11dd-9cd3-001839106225}]
\Shell\AutoRun\command - G:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{424a0a66-de5a-11dc-9c52-001839106225}]
\Shell\AutoRun\command - F:\LaunchU3.exe -a
.
Contents of the 'Scheduled Tasks' folder

2009-03-09 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4067109724-245733308-1790967868-1006.job
- c:\documents and settings\Davis\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-05 21:39]

2009-03-09 c:\windows\Tasks\wrSpySweeper20060215133100.job
- c:\program files\Webroot\Spy Sweeper\SpySweeperUI.exe [2008-11-13 18:11]

2009-03-09 c:\windows\Tasks\wrSpySweeper20060215133100.job
- c:\program files\Webroot\Spy Sweeper\SpySweeperUI.exe [2008-11-13 18:11]

2009-03-09 c:\windows\Tasks\wrSpySweeper20060215133100.job
- A:\ []
.
- - - - ORPHANS REMOVED - - - -

HKU-Default-Run-yurukijilu - c:\windows\system32\sezadowi.dll

.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
uDefault_Search_URL = hxxp://www.google.com/ie
uInternet Settings,ProxyServer = http=
uInternet Settings,ProxyOverride = *.local
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
IE: StumbleUpon PhotoBlog It! - StumbleUponIEBar.dll/blogimage
FF - ProfilePath - c:\documents and settings\Davis\Application Data\Mozilla\Firefox\Profiles\s980j43o.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - component: c:\documents and settings\Davis\Application Data\Mozilla\Firefox\Profiles\s980j43o.default\extensions\{81BF1D23-5F17-408D-AC6B-BD6DF7CAF670}\components\XpcomOpusConnector.dll
FF - component: c:\program files\Real\RealPlayer\browserrecord\components\nprpbrowserrecordplugin.dll
FF - plugin: c:\documents and settings\Davis\Application Data\Mozilla\Firefox\Profiles\s980j43o.default\extensions\[removed]\platform\WINNT_x86-msvc\plugins\npmnqmp071101000055.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Virtual Earth 3D\npVE3D.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-09 10:26:17
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\software\LicCtrl\LicCtrl\LicCtrl\LicCtrl*lkzs$i&#&y@^t! #^$ g9^$&pgb SDB36o \501529F2142DBB50]
"1"=hex:55,71,d5,88,d4,e8,c4,23,86,c5,84,77,3a,01,80,8c
"2"=hex:f5,fd,d2,af,b2,50,3f,e2,89,4b,5a,85,2d,92,a5,eb,e1,d6,58,1d,4d,0e,b6,
ab
"3"=hex:55,71,d5,88,d4,e8,c4,23,cc,0d,cd,35,65,2b,d2,55,b5,8a,e0,a5,a3,ab,e8,
77,08,f0,c2,34,61,83,02,00

[HKEY_LOCAL_MACHINE\software\LicCtrl\LicCtrl\LicCtrl\LicCtrl*lkzs$i&#&y@^t! #^$ g9^$&pgb SDB36o \501529F2142DBB50\3D0835C2F0236EA610F4A663E871DFB7]
"1"=hex:80,21,ee,d1,6b,60,09,6f,4b,f1,56,5e,2d,04,5e,d5,8d,17,94,38,2e,5b,ef,
24
"2"=hex:81,20,8f,ab,28,6a,52,9c
"3"=hex:88,a1,cf,fa,0d,74,49,96,bc,57,04,bd,a1,13,3e,e6,76,1e,cb,3c,66,6b,72,
ab,66,a2,73,59,1b,ba,6f,74,90,60,fd,9c,ea,a5,62,f3,b2,23,b6,2c,1c,04,48,22,\
"4"=hex:2f,ad,a2,e7,8a,bf,05,5e
"5"=hex:bf,e5,23,7b,b0,66,d6,fc,b8,e8,6b,a0,96,52,f7,32,80,09,8f,24,b7,b3,55,
1a,98,d1,47,16,02,43,61,1c,b9,d5,8f,2a,7b,81,b1,fb,95,22,f8,b3,2c,53,9d,ae,\
"6"=hex:80,21,ee,d1,6b,60,09,6f,4b,f1,56,5e,2d,04,5e,d5,36,9b,83,74,43,8b,78,
83,97,7c,06,42,9c,4b,26,2d,b8,50,6f,94,d7,23,a9,55,d8,b1,35,e2,3e,8d,3a,b2,\
"7"=hex:80,21,ee,d1,6b,60,09,6f,4b,f1,56,5e,2d,04,5e,d5,46,b3,d0,ab,2e,9c,08,
36,32,7a,4f,d5,08,17,06,88,dc,f5,4a,66,15,9f,97,67,69,f1,ad,3b,38,6d,a6,74
"8"=hex:9d,9e,b2,b9,a7,a5,f4,ae,4d,29,c2,a3,c0,78,c4,c5,65,47,71,48,e9,1d,9d,
ae,29,98,1a,e8,c6,8a,ea,0a,ff,18,6b,ec,1f,9e,d0,2c,a3,52,2c,56,64,9d,46,ea,\
"9"=hex:81,20,8f,ab,28,6a,52,9c
"18"=hex:4b,72,8f,bc,6c,3f,e4,15
"10"=hex:0f,1f,9e,11,ed,e3,a4,c9
"11"=hex:81,20,8f,ab,28,6a,52,9c
"12"=hex:38,44,5a,a7,93,b5,98,e6,55,31,55,fc,73,20,83,e0,bd,81,fb,46,3f,10,36,
33,f7,ba,b8,8a,a8,c3,90,07,c5,d0,e0,29,2d,d9,b9,7e,25,3a,51,09,cf,46,b9,46,\
"13"=hex:7d,b9,26,d8,f0,72,ba,f8,dc,58,65,4c,c7,bf,68,10,db,d0,cf,4f,e6,2d,e0,
c5
"14"=hex:b5,71,0d,86,6e,74,ea,86,e1,d3,42,28,14,b6,31,28
"24"=hex:81,20,8f,ab,28,6a,52,9c
"26"=hex:81,20,8f,ab,28,6a,52,9c
"27"=hex:81,20,8f,ab,28,6a,52,9c
"19"=hex:f9,52,3a,8c,51,6f,4d,95,c2,4f,f6,c4,20,8e,26,ce
"22"=hex:81,20,8f,ab,28,6a,52,9c
"15"=hex:9c,16,4d,d1,1f,d9,6a,e3,7d,c4,70,88,8c,d0,2f,4c,c8,b8,2f,87,81,d7,7e,
85,21,cf,ed,10,97,ae,a5,77,af,7d,c7,a4,0b,a0,92,b9,fd,7f,8d,c9,9b,67,2f,ea,\

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Windows\AutorunsDisabled]
"Appinit_Dlls"=hex(184):43,3a,5c,57,49,4e,44,4f,57,53,5c,73,79,73,74,65,6d,33,
32,5c,6d,65,79,69,7a,61,74,65,2e,64,6c,6c,43,3a,5c,57,49,4e,44,4f,57,53,5c,\
.
———————— Other Running Processes ————————
.
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\system32\CTSVCCDA.EXE
c:\windows\system32\Crypserv.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\CDBurnerXP\NMSAccessU.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\hpzipm12.exe
c:\windows\system32\rundll32.exe
c:\program files\Webroot\Spy Sweeper\SpySweeper.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\MsPMSPSv.exe
c:\program files\Compact Wireless-G USB Network Adapter with SpeedBooster\WUSB54GSC.exe
c:\program files\Alwil Software\Avast4\ashMaiSv.exe
c:\program files\Alwil Software\Avast4\ashWebSv.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2009-03-09 10:29:05 - machine was rebooted
ComboFix-quarantined-files.txt 2009-03-09 15:29:01

Pre-Run: 12,493,586,432 bytes free
Post-Run: 12,832,100,352 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

309 — E O F — 2009-01-18 08:05:48

Tomk

Post #4March 9, 2009, 5:05 PM UTC

kunrod3,

COMBOFIX-Script

Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

File::
c:\windows\system32\letojomu.dll
c:\windows\system32\notabage.dll
c:\windows\SwSys2.bmp
c:\windows\SwSys1.bmp
c:\docume~1\Davis\LOCALS~1\Temp\krdpdre.sys

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{29b16419-ec03-11dd-9cd3-001839106225}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{424a0a66-de5a-11dc-9c52-001839106225}]

Driver::
krdpdre

Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

[external image: Posted Image]
Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

Then

Please go to Kaspersky website and perform an online antivirus scan.

Read through the requirements and privacy statement and click on Accept button.
It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
When the downloads have finished, click on Settings.
Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
- Spyware, Adware, Dialers, and other potentially dangerous programs
  Archives
  Mail databases
Click on My Computer under Scan.
Once the scan is complete, it will display the results. Click on View Scan Report.
You will see a list of infected items there. Click on Save Report As….
Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
Please post this log in your next reply.

kunrod3

Post #5March 9, 2009, 8:07 PM UTC

Tom - You mention to …

Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection

I know how to disable Avast.

I don't know if I have script blocking and if I do I don't know how to disable it.

Malwarebytes is the only anti-malware program I have and I don't think it has real-time protection - but I'm not sure.

And you don't mention anti-spyware - should I disable Spy Sweeper like I did before?

Thanks.

Tomk

Post #6March 9, 2009, 9:21 PM UTC

kunrod3, Malwarebytes doesn't have any real-time protection. Avast appears to be all you need to worry about. You do it the same as you did to run ComboFix the first time. It's quite possible it is still disabled.

kunrod3

Post #7March 10, 2009, 3:12 AM UTC

Tom - Below are the logs from ComboFix and Kapersky.

ComboFix 09-03-06.02 - Davis 2009-03-09 16:29:00.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.3326.2832 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Davis\Desktop\CFScript.txt
AV: avast! antivirus 4.8.1335 [VPS 090308-0] *On-access scanning disabled* (Updated)
FW: Webroot Internet Security Essentials *disabled*
* Created a new restore point
FILE ::
c:\docume~1\Davis\LOCALS~1\Temp\krdpdre.sys
c:\windows\SwSys1.bmp
c:\windows\SwSys2.bmp
c:\windows\system32\letojomu.dll
c:\windows\system32\notabage.dll
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\SwSys1.bmp
c:\windows\SwSys2.bmp
c:\windows\system32\letojomu.dll
c:\windows\system32\notabage.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_KRDPDRE
——-\Service_krdpdre

((((((((((((((((((((((((( Files Created from 2009-02-09 to 2009-03-09 )))))))))))))))))))))))))))))))
.

2009-03-08 13:06 . 2009-03-08 13:06 d——– c:\documents and settings\Davis\Application Data\Malwarebytes
2009-03-08 13:05 . 2009-03-08 13:05 d——– c:\program files\Malwarebytes' Anti-Malware
2009-03-08 13:05 . 2009-03-08 13:05 d——– c:\documents and settings\All Users\Application Data\Malwarebytes
2009-03-08 13:05 . 2009-02-11 10:19 38,496 –a—— c:\windows\system32\drivers\mbamswissarmy.sys
2009-03-08 13:05 . 2009-02-11 10:19 15,504 –a—— c:\windows\system32\drivers\mbam.sys
2009-03-08 12:37 . 2009-03-08 12:37 d——– c:\program files\ERUNT
2009-03-08 12:08 . 2009-03-08 12:08 d——– c:\program files\Trend Micro
2009-03-08 08:41 . 2009-03-08 08:41 d——– c:\program files\Alwil Software
2009-03-08 08:33 . 2009-03-08 08:37 d——– c:\program files\Windows Live Safety Center
2009-03-08 05:36 . 2005-08-31 22:39 d——– c:\documents and settings\Administrator\Application Data\Symantec
2009-03-08 05:36 . 2005-08-31 22:31 d——– c:\documents and settings\Administrator\Application Data\Jasc Software Inc
2009-03-08 05:36 . 2005-08-31 22:45 d——– c:\documents and settings\Administrator\Application Data\Creative
2009-03-08 05:36 . 2009-03-08 05:36 d——– c:\documents and settings\Administrator
2009-03-04 12:39 . 2009-03-04 12:39 d——– c:\program files\FSEarthTilesV1_0
2009-03-02 15:02 . 2009-03-02 15:02 d——– c:\program files\Microsoft Silverlight
2009-03-01 16:50 . 2006-05-10 09:50 419,164 –a—— C:\L_M01_FACE_04.TGA
2009-03-01 16:50 . 2006-05-10 09:50 317,226 –a—— C:\L_M01_FACE_03.TGA
2009-03-01 16:50 . 2006-05-10 09:49 317,226 –a—— C:\L_M01_FACE_02.TGA
2009-03-01 16:50 . 2006-05-10 09:49 317,226 –a—— C:\L_M01_FACE_01.TGA
2009-02-26 18:35 . 2009-02-26 18:35 d——– c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2009-02-26 18:33 . 2009-02-26 18:33 d——– c:\program files\Bonjour
2009-02-26 18:32 . 2009-02-26 18:33 d——– c:\program files\QuickTime
2009-02-15 20:47 . 2009-02-15 20:47 145 –a—— c:\windows\fcp5.cfg
2009-02-15 20:28 . 2007-08-21 19:54 1,511,424 –a—— c:\windows\system32\Flash8.ocx
2009-02-15 20:28 . 2007-08-21 19:56 196,608 –a—— c:\windows\system32\Utility.dll
2009-02-15 20:28 . 2007-08-21 19:54 109,248 –a—— c:\windows\system32\Mswinsck.ocx
2009-02-15 20:28 . 2007-08-21 19:54 32,768 –a—— c:\windows\system32\Flash8.oca
2009-02-15 20:27 . 1996-11-08 03:48 368,912 –a—— c:\windows\system32\vbar332.dll
2009-02-11 18:58 . 2009-02-11 18:58 d——– c:\documents and settings\All Users\Application Data\MSScanAppDataDir
2009-02-11 17:27 . 2009-02-11 17:27 d——– c:\program files\LiknoWebButtonMakerFree
2009-02-11 17:27 . 2002-10-21 16:31 1,013,760 –a—— c:\windows\system32\Ltwvc13n.dll
2009-02-11 17:27 . 2002-10-21 16:01 446,464 –a—— c:\windows\system32\ltimg13n.dll
2009-02-11 17:27 . 2002-10-24 18:08 443,392 –a—— c:\windows\system32\ltkrn13n.dll
2009-02-11 17:27 . 2002-10-22 14:53 393,216 –a—— c:\windows\system32\LFCMP13n.DLL
2009-02-11 17:27 . 2002-10-21 15:53 265,728 –a—— c:\windows\system32\LTDIS13n.dll
2009-02-11 17:27 . 2002-10-21 16:01 205,824 –a—— c:\windows\system32\ltefx13n.dll
2009-02-11 17:27 . 2002-10-21 16:39 181,248 –a—— c:\windows\system32\Lfpng13n.dll
2009-02-11 17:27 . 2002-10-21 16:00 139,776 –a—— c:\windows\system32\ltfil13n.DLL
2009-02-11 17:27 . 2002-10-21 16:03 35,328 –a—— c:\windows\system32\lfgif13n.dll
2009-02-11 17:27 . 2002-10-21 16:02 30,208 –a—— c:\windows\system32\lfbmp13n.dll
2009-02-11 16:55 . 2009-02-11 16:55 d——– c:\program files\AWC
2009-02-11 16:55 . 2005-09-04 20:01 1,056,768 –a—— c:\windows\system32\FreeImage.dll
2009-02-11 16:55 . 1999-10-30 02:00 167,936 –a—— c:\windows\system32\ccrpftv6.ocx
2009-02-11 16:55 . 1999-09-16 10:04 151,552 –a—— c:\windows\system32\ccrpFD6.ocx
2009-02-11 16:55 . 2000-10-11 19:07 98,304 –a—— c:\windows\system32\ccrpUCW6.dll
2009-02-11 16:55 . 2000-10-11 19:18 98,304 –a—— c:\windows\system32\ccrpDtp6.ocx
2009-02-11 16:55 . 1998-11-23 17:10 90,112 –a—— c:\windows\system32\ccrpTmr6.dll
2009-02-11 16:55 . 2000-03-15 19:22 86,016 –a—— c:\windows\system32\ccrpudn6.ocx
2009-02-11 16:55 . 2003-08-11 00:25 40,960 –a—— c:\windows\system32\DLLDesktop.dll
2009-02-11 16:55 . 2003-08-10 13:04 36,864 –a—— c:\windows\system32\AlphaImageCreator.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-27 00:45 ——— d—–w c:\program files\Winamp
2009-02-26 23:35 ——— d—–w c:\program files\iTunes
2009-02-26 23:35 ——— d—–w c:\program files\iPod
2009-02-26 23:35 ——— d—–w c:\program files\Common Files\Apple
2009-02-26 23:30 ——— d—–w c:\program files\Apple Software Update
2009-02-24 17:54 ——— d—–w c:\documents and settings\Davis\Application Data\Winamp
2009-02-24 01:53 ——— d—–w c:\documents and settings\Davis\Application Data\FrostWire
2009-02-19 03:45 ——— d—–w c:\documents and settings\Davis\Application Data\LimeWire
2009-02-15 19:22 ——— d—–w c:\program files\Notepad++
2009-02-08 04:00 ——— d—–w c:\program files\Common Files\xing shared
2009-02-08 03:59 ——— d—–w c:\program files\Common Files\Real
2009-02-02 12:30 ——— d—–w c:\program files\HP
2009-01-31 00:44 ——— d—–w c:\documents and settings\Davis\Application Data\U3
2009-01-29 23:14 ——— d—–w c:\program files\MDK2
2009-01-29 20:25 ——— d—–w c:\program files\NovaLogic
2009-01-29 20:20 ——— d–h–w c:\program files\InstallShield Installation Information
2009-01-27 15:21 ——— d—–w c:\program files\National Instruments
2009-01-27 15:20 ——— d—–w c:\program files\VWS Installer
2009-01-26 23:55 ——— d—–w c:\documents and settings\Davis\Application Data\Inkscape
2009-01-26 23:54 ——— d—–w c:\program files\Inkscape
2009-01-26 01:17 ——— d–h–w c:\documents and settings\Davis\Application Data\Move Networks
2009-01-20 18:00 ——— d—–w c:\program files\iDailyDiary
2009-01-20 17:49 ——— d—–w c:\program files\Pro Imaging Powertoys
2009-01-20 17:49 ——— d—–w c:\program files\Common Files\Nikon
2009-01-20 17:33 ——— d—–w c:\program files\RegScrubVistaXP
2009-01-17 00:37 ——— d—–w c:\program files\ColorCop
2009-01-15 15:13 ——— d—–w c:\program files\Reference Assemblies
2009-01-15 15:13 ——— d—–w c:\program files\MSBuild
2009-01-15 15:11 ——— d—–w c:\program files\MSXML 6.0
2008-09-18 12:38 40,283 ——w c:\program files\AlphaChessHistory.dat
2007-04-16 13:20 9,469,496 ——w c:\program files\Acoustica-Spin-It-Again-Installer.exe
2004-08-04 10:00 94,784 –sh–w c:\windows\twain.dll
2004-08-04 10:00 50,688 –sh–w c:\windows\twain_32.dll
2005-11-08 00:02 56 –sh–r c:\windows\system32\325DB1D331.sys
2005-11-08 00:02 1,682 –sh–w c:\windows\system32\KGyGaAvL.sys
2004-08-04 10:00 1,028,096 –sh–w c:\windows\system32\mfc42.dll
2004-08-04 10:00 54,784 –sh–w c:\windows\system32\msvcirt.dll
2004-08-04 10:00 413,696 –sh–w c:\windows\system32\msvcp60.dll
2004-08-04 10:00 11,776 –sh–w c:\windows\system32\regsvr32.exe
.

((((((((((((((((((((((((((((( SnapShot@2009-03-09_10.27.59.07 )))))))))))))))))))))))))))))))))))))))))
.
- 2009-03-09 02:27:26 32,768 —-a-w c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2009-03-09 21:34:10 32,768 —-a-w c:\windows\system32\config\systemprofile\Cookies\index.dat
- 2009-03-09 02:27:26 32,768 —-a-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2009-03-09 21:34:10 32,768 —-a-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2009-03-09 02:27:26 32,768 —-a-w c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2009-03-09 21:34:10 32,768 —-a-w c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2009-03-09 21:34:26 16,384 —-atw c:\windows\Temp\Perflib_Perfdata_5e8.dat
+ 2009-03-09 21:34:16 16,384 —-atw c:\windows\Temp\Perflib_Perfdata_624.dat
+ 2009-03-09 21:35:01 3,644 —-a-w c:\windows\Temp\wrstemp\S-1-5-18.dat
+ 2009-03-09 21:35:01 4,182 —-a-w c:\windows\Temp\wrstemp\S-1-5-19.dat
+ 2009-03-09 21:35:01 4,250 —-a-w c:\windows\Temp\wrstemp\S-1-5-20.dat
+ 2009-03-09 21:36:38 5,042 —-a-w c:\windows\Temp\wrstemp\S-1-5-21-4067109724-245733308-1790967868-1006.dat
+ 2009-03-09 21:35:01 4,710 —-a-w c:\windows\Temp\wrstemp\S-1-5-21-4067109724-245733308-1790967868-500.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"Google Update"="c:\documents and settings\Davis\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-09-05 133104]
"Ghrone"="c:\documents and settings\Davis\My Documents\My Downloads\Set Up and Tried\ghrone-0.271\Ghrone.exe" [2002-02-19 385024]
"Active Desktop Calendar"="c:\program files\XemiComputers\Active Desktop Calendar\ADC.exe" [2009-02-02 4483584]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-12-05 8523776]
"CTSysVol"="c:\program files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe" [2003-09-17 57344]
"UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112]
"DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-02-23 53248]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 81920]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"nwiz"="c:\windows\system32\nwiz.exe" [2007-12-05 1626112]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-12-05 81920]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2008-08-03 36352]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-01 136600]
"DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2006-06-13 127036]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-02-07 198160]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-01-06 290088]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]
"SpySweeper"="c:\program files\Webroot\Spy Sweeper\SpySweeperUI.exe" [2008-11-13 6273400]
"P17Helper"="P17.dll" [2004-06-10 c:\windows\system32\P17.dll]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2004-10-04 113664]
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2005-08-31 24576]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.iv31"= c:\windows\system32\ir32_32.dll
"vidc.iv32"= c:\windows\system32\ir32_32.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WRConsumerService]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\fxsclnt.exe"=
"c:\\Program Files\\MSN\\MSNCoreFiles\\msn.exe"=
"c:\\Program Files\\Compact Wireless-G USB Network Adapter with SpeedBooster\\InvokeSvc2.exe"=
"c:\\WINDOWS\\system32\\mmc.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\NovaLogic\\Delta Force Land Warrior\\Update.exe"=
"c:\\Program Files\\AnalogX\\Atomic TimeSync\\ats.exe"=
"c:\\Program Files\\Microsoft Games\\Links 2003\\LinksMMIII.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\WINDOWS\\system32\\wscntfy.exe"=
"c:\\Program Files\\Compact Wireless-G USB Network Adapter with SpeedBooster\\WUSB54GSC.exe"=

R0 ssfs0bbc;ssfs0bbc;c:\windows\system32\drivers\ssfs0bbc.sys [2008-08-09 29808]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2009-03-08 114768]
R2 AdobeActiveFileMonitor;Adobe Active File Monitor;c:\program files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe [2004-10-04 98304]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009-03-08 20560]
R2 LicCtrlService;LicCtrl Service;c:\windows\Runservice.exe [2008-03-01 2560]
R2 PhotoshopElementsDeviceConnect;Photoshop Elements Device Connect;c:\program files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe [2004-10-04 118784]
R2 WRConsumerService;Webroot Client Service;c:\program files\Webroot\Spy Sweeper\WRConsumerService.exe [2008-12-03 1086840]
R2 WUSB54GSCSVC;WUSB54GSCSVC;c:\program files\Compact Wireless-G USB Network Adapter with SpeedBooster\WLService.exe [2008-01-17 53307]
S3 HPPLSBULK;HPPLSBULK;c:\windows\system32\drivers\hpplsbulk.sys [2009-02-02 9344]
.
Contents of the 'Scheduled Tasks' folder

2009-03-09 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4067109724-245733308-1790967868-1006.job
- c:\documents and settings\Davis\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-05 21:39]

2009-03-09 c:\windows\Tasks\wrSpySweeper20060215133100.job
- c:\program files\Webroot\Spy Sweeper\SpySweeperUI.exe [2008-11-13 18:11]

2009-03-09 c:\windows\Tasks\wrSpySweeper20060215133100.job
- c:\program files\Webroot\Spy Sweeper\SpySweeperUI.exe [2008-11-13 18:11]

2009-03-09 c:\windows\Tasks\wrSpySweeper20060215133100.job
- A:\ []
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
uDefault_Search_URL = hxxp://www.google.com/ie
uSearch Bar = hxxp://mysearch.myway.com/jsp/dellsidebar.jsp?p=DE
uInternet Settings,ProxyServer = http=
uInternet Settings,ProxyOverride = *.local
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
IE: StumbleUpon PhotoBlog It! - StumbleUponIEBar.dll/blogimage
FF - ProfilePath - c:\documents and settings\Davis\Application Data\Mozilla\Firefox\Profiles\s980j43o.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - component: c:\documents and settings\Davis\Application Data\Mozilla\Firefox\Profiles\s980j43o.default\extensions\{81BF1D23-5F17-408D-AC6B-BD6DF7CAF670}\components\XpcomOpusConnector.dll
FF - component: c:\program files\Real\RealPlayer\browserrecord\components\nprpbrowserrecordplugin.dll
FF - plugin: c:\documents and settings\Davis\Application Data\Mozilla\Firefox\Profiles\s980j43o.default\extensions\[removed]\platform\WINNT_x86-msvc\plugins\npmnqmp071101000055.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Virtual Earth 3D\npVE3D.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-09 16:34:50
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

c:\windows\TEMP\_av_proI.tm~a03444\setup.lok 0 bytes

scan completed successfully
hidden files: 1

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\software\LicCtrl\LicCtrl\LicCtrl\LicCtrl*lkzs$i&#&y@^t! #^$ g9^$&pgb SDB36o \501529F2142DBB50]
"1"=hex:55,71,d5,88,d4,e8,c4,23,86,c5,84,77,3a,01,80,8c
"2"=hex:f5,fd,d2,af,b2,50,3f,e2,89,4b,5a,85,2d,92,a5,eb,e1,d6,58,1d,4d,0e,b6,
ab
"3"=hex:55,71,d5,88,d4,e8,c4,23,cc,0d,cd,35,65,2b,d2,55,b5,8a,e0,a5,a3,ab,e8,
77,08,f0,c2,34,61,83,02,00

[HKEY_LOCAL_MACHINE\software\LicCtrl\LicCtrl\LicCtrl\LicCtrl*lkzs$i&#&y@^t! #^$ g9^$&pgb SDB36o \501529F2142DBB50\3D0835C2F0236EA610F4A663E871DFB7]
"1"=hex:80,21,ee,d1,6b,60,09,6f,4b,f1,56,5e,2d,04,5e,d5,8d,17,94,38,2e,5b,ef,
24
"2"=hex:81,20,8f,ab,28,6a,52,9c
"3"=hex:88,a1,cf,fa,0d,74,49,96,bc,57,04,bd,a1,13,3e,e6,76,1e,cb,3c,66,6b,72,
ab,66,a2,73,59,1b,ba,6f,74,90,60,fd,9c,ea,a5,62,f3,b2,23,b6,2c,1c,04,48,22,\
"4"=hex:2f,ad,a2,e7,8a,bf,05,5e
"5"=hex:bf,e5,23,7b,b0,66,d6,fc,b8,e8,6b,a0,96,52,f7,32,80,09,8f,24,b7,b3,55,
1a,98,d1,47,16,02,43,61,1c,b9,d5,8f,2a,7b,81,b1,fb,95,22,f8,b3,2c,53,9d,ae,\
"6"=hex:80,21,ee,d1,6b,60,09,6f,4b,f1,56,5e,2d,04,5e,d5,36,9b,83,74,43,8b,78,
83,97,7c,06,42,9c,4b,26,2d,b8,50,6f,94,d7,23,a9,55,d8,b1,35,e2,3e,8d,3a,b2,\
"7"=hex:80,21,ee,d1,6b,60,09,6f,4b,f1,56,5e,2d,04,5e,d5,46,b3,d0,ab,2e,9c,08,
36,32,7a,4f,d5,08,17,06,88,dc,f5,4a,66,15,9f,97,67,69,f1,ad,3b,38,6d,a6,74
"8"=hex:9d,9e,b2,b9,a7,a5,f4,ae,4d,29,c2,a3,c0,78,c4,c5,65,47,71,48,e9,1d,9d,
ae,29,98,1a,e8,c6,8a,ea,0a,ff,18,6b,ec,1f,9e,d0,2c,a3,52,2c,56,64,9d,46,ea,\
"9"=hex:81,20,8f,ab,28,6a,52,9c
"18"=hex:4b,72,8f,bc,6c,3f,e4,15
"10"=hex:0f,1f,9e,11,ed,e3,a4,c9
"11"=hex:81,20,8f,ab,28,6a,52,9c
"12"=hex:38,44,5a,a7,93,b5,98,e6,55,31,55,fc,73,20,83,e0,bd,81,fb,46,3f,10,36,
33,f7,ba,b8,8a,a8,c3,90,07,c5,d0,e0,29,2d,d9,b9,7e,25,3a,51,09,cf,46,b9,46,\
"13"=hex:7d,b9,26,d8,f0,72,ba,f8,dc,58,65,4c,c7,bf,68,10,db,d0,cf,4f,e6,2d,e0,
c5
"14"=hex:b5,71,0d,86,6e,74,ea,86,e1,d3,42,28,14,b6,31,28
"24"=hex:81,20,8f,ab,28,6a,52,9c
"26"=hex:81,20,8f,ab,28,6a,52,9c
"27"=hex:81,20,8f,ab,28,6a,52,9c
"19"=hex:f9,52,3a,8c,51,6f,4d,95,c2,4f,f6,c4,20,8e,26,ce
"22"=hex:81,20,8f,ab,28,6a,52,9c
"15"=hex:9c,16,4d,d1,1f,d9,6a,e3,7d,c4,70,88,8c,d0,2f,4c,c8,b8,2f,87,81,d7,7e,
85,21,cf,ed,10,97,ae,a5,77,af,7d,c7,a4,0b,a0,92,b9,fd,7f,8d,c9,9b,67,2f,ea,\

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Windows\AutorunsDisabled]
"Appinit_Dlls"=hex(184):43,3a,5c,57,49,4e,44,4f,57,53,5c,73,79,73,74,65,6d,33,
32,5c,6d,65,79,69,7a,61,74,65,2e,64,6c,6c,43,3a,5c,57,49,4e,44,4f,57,53,5c,\
.
———————— Other Running Processes ————————
.
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\system32\CTSVCCDA.EXE
c:\windows\system32\Crypserv.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\CDBurnerXP\NMSAccessU.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\hpzipm12.exe
c:\program files\Webroot\Spy Sweeper\SpySweeper.exe
c:\windows\system32\MsPMSPSv.exe
c:\program files\Compact Wireless-G USB Network Adapter with SpeedBooster\WUSB54GSC.exe
c:\program files\Alwil Software\Avast4\ashMaiSv.exe
c:\program files\Alwil Software\Avast4\ashWebSv.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\rundll32.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\Webroot\Spy Sweeper\SSU.exe
.
**************************************************************************
.
Completion time: 2009-03-09 16:39:57 - machine was rebooted
ComboFix-quarantined-files.txt 2009-03-09 21:39:52
ComboFix2.txt 2009-03-09 15:29:07

Pre-Run: 13,249,261,568 bytes free
Post-Run: 13,242,613,760 bytes free

314 — E O F — 2009-01-18 08:05:48

——————————————————————————–
KASPERSKY ONLINE SCANNER 7 REPORT
Monday, March 9, 2009
Operating System: Microsoft Windows XP Home Edition Service Pack 2 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Monday, March 09, 2009 21:56:02
Records in database: 1883538——————————————————————————–

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
A:\
C:\
D:\
E:\

Scan statistics:
Files scanned: 93127
Threat name: 2
Infected objects: 2
Suspicious objects: 0
Duration of the scan: 01:45:35

File name / Threat name / Threats count
C:\Links Files\linksmod106_final_.zip Infected: not-a-virus:AdWare.Win32.Rabio.jg 1
C:\Program Files\Active Desktop Clock\adc.exe Infected: not-a-virus:Monitor.Win32.KeyPressHooker.f 1

The selected area was scanned.

Tomk

Post #8March 10, 2009, 4:08 AM UTC

kunrod3,

COMBOFIX-Script

Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

File::
c:\windows\TEMP\_av_proI.tm~a03444\setup.lok
c:\windows\Tasks\wrSpySweeper20060215133100.job
C:\Links Files\linksmod106_final_.zip
C:\Program Files\Active Desktop Clock\adc.exe

Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

[external image: Posted Image]
Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

Also please give me a new HijackThis log and let me know how it's running.

kunrod3

Post #9March 10, 2009, 12:25 PM UTC

Tom - The files below got deleted already. Short story, my sister and her boyfriend were over last night, I had to leave, he's fairly computer savvy, he said he'd run through your instructions for me, I said okay but don't do anything else, he did. Do you want me to still run ComboFix? C:\Links Files\linksmod106_final_.zip C:\Program Files\Active Desktop Clock\adc.exe

Tomk

Post #10March 10, 2009, 2:03 PM UTC

kunrod3, Please continue with instructions, Leave the script as is, if the file is gone, it just won't find it.

kunrod3

Post #11March 10, 2009, 2:42 PM UTC

Tom - Here are the ComboFix and HJT reports. This is the first time the ComboFix did not reboot the computer(?)

Also please give me a new HijackThis log and let me know how it's running.

The only thing about the HJT scan that seemed different was the speed - it seemed to finish pretty quick(?)

ComboFix 09-03-06.02 - Davis 2009-03-10 9:19:57.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.3326.2845 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Davis\Desktop\CFScript.txt
AV: avast! antivirus 4.8.1335 [VPS 090309-0] *On-access scanning disabled* (Updated)
FW: Webroot Internet Security Essentials *disabled*
* Created a new restore point
FILE ::
c:\links files\linksmod106_final_.zip
c:\program files\Active Desktop Clock\adc.exe
c:\windows\Tasks\wrSpySweeper20060215133100.job
c:\windows\TEMP\_av_proI.tm~a03444\setup.lok
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\Tasks\wrSpySweeper20060215133100.job

.
((((((((((((((((((((((((( Files Created from 2009-02-10 to 2009-03-10 )))))))))))))))))))))))))))))))
.

2009-03-08 13:06 . 2009-03-08 13:06 d——– c:\documents and settings\Davis\Application Data\Malwarebytes
2009-03-08 13:05 . 2009-03-08 13:05 d——– c:\program files\Malwarebytes' Anti-Malware
2009-03-08 13:05 . 2009-03-08 13:05 d——– c:\documents and settings\All Users\Application Data\Malwarebytes
2009-03-08 13:05 . 2009-02-11 10:19 38,496 –a—— c:\windows\system32\drivers\mbamswissarmy.sys
2009-03-08 13:05 . 2009-02-11 10:19 15,504 –a—— c:\windows\system32\drivers\mbam.sys
2009-03-08 12:37 . 2009-03-08 12:37 d——– c:\program files\ERUNT
2009-03-08 12:08 . 2009-03-08 12:08 d——– c:\program files\Trend Micro
2009-03-08 08:41 . 2009-03-08 08:41 d——– c:\program files\Alwil Software
2009-03-08 08:33 . 2009-03-08 08:37 d——– c:\program files\Windows Live Safety Center
2009-03-08 05:36 . 2005-08-31 22:39 d——– c:\documents and settings\Administrator\Application Data\Symantec
2009-03-08 05:36 . 2005-08-31 22:31 d——– c:\documents and settings\Administrator\Application Data\Jasc Software Inc
2009-03-08 05:36 . 2005-08-31 22:45 d——– c:\documents and settings\Administrator\Application Data\Creative
2009-03-08 05:36 . 2009-03-08 05:36 d——– c:\documents and settings\Administrator
2009-03-04 12:39 . 2009-03-04 12:39 d——– c:\program files\FSEarthTilesV1_0
2009-03-02 15:02 . 2009-03-02 15:02 d——– c:\program files\Microsoft Silverlight
2009-03-01 16:50 . 2006-05-10 09:50 419,164 –a—— C:\L_M01_FACE_04.TGA
2009-03-01 16:50 . 2006-05-10 09:50 317,226 –a—— C:\L_M01_FACE_03.TGA
2009-03-01 16:50 . 2006-05-10 09:49 317,226 –a—— C:\L_M01_FACE_02.TGA
2009-03-01 16:50 . 2006-05-10 09:49 317,226 –a—— C:\L_M01_FACE_01.TGA
2009-02-26 18:35 . 2009-02-26 18:35 d——– c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2009-02-26 18:33 . 2009-02-26 18:33 d——– c:\program files\Bonjour
2009-02-26 18:32 . 2009-02-26 18:33 d——– c:\program files\QuickTime
2009-02-15 20:47 . 2009-02-15 20:47 145 –a—— c:\windows\fcp5.cfg
2009-02-15 20:28 . 2007-08-21 19:54 1,511,424 –a—— c:\windows\system32\Flash8.ocx
2009-02-15 20:28 . 2007-08-21 19:56 196,608 –a—— c:\windows\system32\Utility.dll
2009-02-15 20:28 . 2007-08-21 19:54 109,248 –a—— c:\windows\system32\Mswinsck.ocx
2009-02-15 20:28 . 2007-08-21 19:54 32,768 –a—— c:\windows\system32\Flash8.oca
2009-02-15 20:27 . 1996-11-08 03:48 368,912 –a—— c:\windows\system32\vbar332.dll
2009-02-11 18:58 . 2009-02-11 18:58 d——– c:\documents and settings\All Users\Application Data\MSScanAppDataDir
2009-02-11 17:27 . 2009-02-11 17:27 d——– c:\program files\LiknoWebButtonMakerFree
2009-02-11 17:27 . 2002-10-21 16:31 1,013,760 –a—— c:\windows\system32\Ltwvc13n.dll
2009-02-11 17:27 . 2002-10-21 16:01 446,464 –a—— c:\windows\system32\ltimg13n.dll
2009-02-11 17:27 . 2002-10-24 18:08 443,392 –a—— c:\windows\system32\ltkrn13n.dll
2009-02-11 17:27 . 2002-10-22 14:53 393,216 –a—— c:\windows\system32\LFCMP13n.DLL
2009-02-11 17:27 . 2002-10-21 15:53 265,728 –a—— c:\windows\system32\LTDIS13n.dll
2009-02-11 17:27 . 2002-10-21 16:01 205,824 –a—— c:\windows\system32\ltefx13n.dll
2009-02-11 17:27 . 2002-10-21 16:39 181,248 –a—— c:\windows\system32\Lfpng13n.dll
2009-02-11 17:27 . 2002-10-21 16:00 139,776 –a—— c:\windows\system32\ltfil13n.DLL
2009-02-11 17:27 . 2002-10-21 16:03 35,328 –a—— c:\windows\system32\lfgif13n.dll
2009-02-11 17:27 . 2002-10-21 16:02 30,208 –a—— c:\windows\system32\lfbmp13n.dll
2009-02-11 16:55 . 2009-02-11 16:55 d——– c:\program files\AWC
2009-02-11 16:55 . 2005-09-04 20:01 1,056,768 –a—— c:\windows\system32\FreeImage.dll
2009-02-11 16:55 . 1999-10-30 02:00 167,936 –a—— c:\windows\system32\ccrpftv6.ocx
2009-02-11 16:55 . 1999-09-16 10:04 151,552 –a—— c:\windows\system32\ccrpFD6.ocx
2009-02-11 16:55 . 2000-10-11 19:07 98,304 –a—— c:\windows\system32\ccrpUCW6.dll
2009-02-11 16:55 . 2000-10-11 19:18 98,304 –a—— c:\windows\system32\ccrpDtp6.ocx
2009-02-11 16:55 . 1998-11-23 17:10 90,112 –a—— c:\windows\system32\ccrpTmr6.dll
2009-02-11 16:55 . 2000-03-15 19:22 86,016 –a—— c:\windows\system32\ccrpudn6.ocx
2009-02-11 16:55 . 2003-08-11 00:25 40,960 –a—— c:\windows\system32\DLLDesktop.dll
2009-02-11 16:55 . 2003-08-10 13:04 36,864 –a—— c:\windows\system32\AlphaImageCreator.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-09 23:26 ——— d–h–w c:\program files\InstallShield Installation Information
2009-03-09 23:26 ——— d—–w c:\program files\MDK2
2009-03-09 23:23 ——— d—–w c:\documents and settings\Davis\Application Data\Inkscape
2009-03-09 23:22 ——— d—–w c:\program files\iDailyDiary
2009-02-27 00:45 ——— d—–w c:\program files\Winamp
2009-02-26 23:35 ——— d—–w c:\program files\iTunes
2009-02-26 23:35 ——— d—–w c:\program files\iPod
2009-02-26 23:35 ——— d—–w c:\program files\Common Files\Apple
2009-02-26 23:30 ——— d—–w c:\program files\Apple Software Update
2009-02-24 17:54 ——— d—–w c:\documents and settings\Davis\Application Data\Winamp
2009-02-24 01:53 ——— d—–w c:\documents and settings\Davis\Application Data\FrostWire
2009-02-19 03:45 ——— d—–w c:\documents and settings\Davis\Application Data\LimeWire
2009-02-15 19:22 ——— d—–w c:\program files\Notepad++
2009-02-08 04:00 203,776 —-a-w c:\windows\system32\clrviddc.dll
2009-02-08 04:00 ——— d—–w c:\program files\Common Files\xing shared
2009-02-08 03:59 499,712 —-a-w c:\windows\system32\msvcp71.dll
2009-02-08 03:59 348,160 —-a-w c:\windows\system32\msvcr71.dll
2009-02-08 03:59 ——— d—–w c:\program files\Common Files\Real
2009-02-02 12:30 ——— d—–w c:\program files\HP
2009-01-31 00:44 ——— d—–w c:\documents and settings\Davis\Application Data\U3
2009-01-29 20:25 ——— d—–w c:\program files\NovaLogic
2009-01-29 20:23 713,728 —-a-w c:\windows\system32\opengl32.dll
2009-01-27 15:21 ——— d—–w c:\program files\National Instruments
2009-01-27 15:20 ——— d—–w c:\program files\VWS Installer
2009-01-26 01:17 ——— d–h–w c:\documents and settings\Davis\Application Data\Move Networks
2009-01-20 17:49 ——— d—–w c:\program files\Pro Imaging Powertoys
2009-01-20 17:49 ——— d—–w c:\program files\Common Files\Nikon
2009-01-20 17:33 ——— d—–w c:\program files\RegScrubVistaXP
2009-01-17 03:35 3,594,752 ——w c:\windows\system32\dllcache\mshtml.dll
2009-01-17 00:37 ——— d—–w c:\program files\ColorCop
2009-01-15 15:13 ——— d—–w c:\program files\Reference Assemblies
2009-01-15 15:13 ——— d—–w c:\program files\MSBuild
2009-01-15 15:11 ——— d—–w c:\program files\MSXML 6.0
2009-01-05 22:33 3,751,995 —-a-w c:\windows\system32\GPhotos.scr
2008-12-19 09:10 70,656 ——w c:\windows\system32\dllcache\ie4uinit.exe
2008-12-19 09:10 13,824 ——w c:\windows\system32\dllcache\ieudinit.exe
2008-12-19 05:25 634,024 ——w c:\windows\system32\dllcache\iexplore.exe
2008-12-19 05:23 161,792 ——w c:\windows\system32\dllcache\ieakui.dll
2008-12-11 11:57 333,184 ——w c:\windows\system32\dllcache\srv.sys
2008-09-18 12:38 40,283 ——w c:\program files\AlphaChessHistory.dat
2007-04-16 13:20 9,469,496 ——w c:\program files\Acoustica-Spin-It-Again-Installer.exe
2004-08-04 10:00 94,784 –sh–w c:\windows\twain.dll
2004-08-04 10:00 50,688 –sh–w c:\windows\twain_32.dll
2005-11-08 00:02 56 –sh–r c:\windows\system32\325DB1D331.sys
2005-11-08 00:02 1,682 –sh–w c:\windows\system32\KGyGaAvL.sys
2004-08-04 10:00 1,028,096 –sh–w c:\windows\system32\mfc42.dll
2004-08-04 10:00 54,784 –sh–w c:\windows\system32\msvcirt.dll
2004-08-04 10:00 413,696 –sh–w c:\windows\system32\msvcp60.dll
2004-08-04 10:00 11,776 –sh–w c:\windows\system32\regsvr32.exe
.

((((((((((((((((((((((((((((( SnapShot@2009-03-09_10.27.59.07 )))))))))))))))))))))))))))))))))))))))))
.
- 2009-03-09 02:27:26 32,768 —-a-w c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2009-03-10 13:57:01 32,768 —-a-w c:\windows\system32\config\systemprofile\Cookies\index.dat
- 2009-03-09 02:27:26 32,768 —-a-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2009-03-10 13:57:01 32,768 —-a-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2009-03-09 02:27:26 32,768 —-a-w c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2009-03-10 13:57:01 32,768 —-a-w c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2009-02-12 01:56:18 21,244,872 —-a-w c:\windows\system32\MRT.exe
+ 2009-03-10 13:57:14 16,384 —-atw c:\windows\Temp\Perflib_Perfdata_458.dat
+ 2009-03-10 13:57:08 16,384 —-atw c:\windows\Temp\Perflib_Perfdata_59c.dat
+ 2009-03-10 14:23:44 3,648 —-a-w c:\windows\Temp\wrstemp\S-1-5-18.dat
+ 2009-03-10 14:23:44 4,182 —-a-w c:\windows\Temp\wrstemp\S-1-5-19.dat
+ 2009-03-10 14:23:44 4,250 —-a-w c:\windows\Temp\wrstemp\S-1-5-20.dat
+ 2009-03-10 14:23:44 5,042 —-a-w c:\windows\Temp\wrstemp\S-1-5-21-4067109724-245733308-1790967868-1006.dat
+ 2009-03-10 14:23:44 4,710 —-a-w c:\windows\Temp\wrstemp\S-1-5-21-4067109724-245733308-1790967868-500.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"Google Update"="c:\documents and settings\Davis\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-09-05 133104]
"Ghrone"="c:\documents and settings\Davis\My Documents\My Downloads\Set Up and Tried\ghrone-0.271\Ghrone.exe" [2002-02-19 385024]
"Active Desktop Calendar"="c:\program files\XemiComputers\Active Desktop Calendar\ADC.exe" [2009-02-02 4483584]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-12-05 8523776]
"CTSysVol"="c:\program files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe" [2003-09-17 57344]
"UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112]
"DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-02-23 53248]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 81920]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"nwiz"="c:\windows\system32\nwiz.exe" [2007-12-05 1626112]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-12-05 81920]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2008-08-03 36352]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-01 136600]
"DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2006-06-13 127036]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-02-07 198160]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-01-06 290088]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]
"SpySweeper"="c:\program files\Webroot\Spy Sweeper\SpySweeperUI.exe" [2008-11-13 6273400]
"P17Helper"="P17.dll" [2004-06-10 c:\windows\system32\P17.dll]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2004-10-04 113664]
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2005-08-31 24576]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.iv31"= c:\windows\system32\ir32_32.dll
"vidc.iv32"= c:\windows\system32\ir32_32.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WRConsumerService]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\fxsclnt.exe"=
"c:\\Program Files\\MSN\\MSNCoreFiles\\msn.exe"=
"c:\\Program Files\\Compact Wireless-G USB Network Adapter with SpeedBooster\\InvokeSvc2.exe"=
"c:\\WINDOWS\\system32\\mmc.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\NovaLogic\\Delta Force Land Warrior\\Update.exe"=
"c:\\Program Files\\AnalogX\\Atomic TimeSync\\ats.exe"=
"c:\\Program Files\\Microsoft Games\\Links 2003\\LinksMMIII.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\WINDOWS\\system32\\wscntfy.exe"=
"c:\\Program Files\\Compact Wireless-G USB Network Adapter with SpeedBooster\\WUSB54GSC.exe"=

R0 ssfs0bbc;ssfs0bbc;c:\windows\system32\drivers\ssfs0bbc.sys [2008-08-09 29808]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2009-03-08 114768]
R2 AdobeActiveFileMonitor;Adobe Active File Monitor;c:\program files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe [2004-10-04 98304]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009-03-08 20560]
R2 LicCtrlService;LicCtrl Service;c:\windows\Runservice.exe [2008-03-01 2560]
R2 PhotoshopElementsDeviceConnect;Photoshop Elements Device Connect;c:\program files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe [2004-10-04 118784]
R2 WRConsumerService;Webroot Client Service;c:\program files\Webroot\Spy Sweeper\WRConsumerService.exe [2008-12-03 1086840]
R2 WUSB54GSCSVC;WUSB54GSCSVC;c:\program files\Compact Wireless-G USB Network Adapter with SpeedBooster\WLService.exe [2008-01-17 53307]
S3 HPPLSBULK;HPPLSBULK;c:\windows\system32\drivers\hpplsbulk.sys [2009-02-02 9344]

— Other Services/Drivers In Memory —

*NewlyCreated* - GTNDIS5
.
Contents of the 'Scheduled Tasks' folder

2009-03-10 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4067109724-245733308-1790967868-1006.job
- c:\documents and settings\Davis\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-05 21:39]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
uDefault_Search_URL = hxxp://www.google.com/ie
uSearch Bar = hxxp://mysearch.myway.com/jsp/dellsidebar.jsp?p=DE
uInternet Settings,ProxyServer = http=
uInternet Settings,ProxyOverride = *.local
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
IE: StumbleUpon PhotoBlog It! - StumbleUponIEBar.dll/blogimage
FF - ProfilePath - c:\documents and settings\Davis\Application Data\Mozilla\Firefox\Profiles\s980j43o.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - component: c:\documents and settings\Davis\Application Data\Mozilla\Firefox\Profiles\s980j43o.default\extensions\{81BF1D23-5F17-408D-AC6B-BD6DF7CAF670}\components\XpcomOpusConnector.dll
FF - component: c:\program files\Real\RealPlayer\browserrecord\components\nprpbrowserrecordplugin.dll
FF - plugin: c:\documents and settings\Davis\Application Data\Mozilla\Firefox\Profiles\s980j43o.default\extensions\[removed]\platform\WINNT_x86-msvc\plugins\npmnqmp071101000055.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Virtual Earth 3D\npVE3D.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-10 09:23:34
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\software\LicCtrl\LicCtrl\LicCtrl\LicCtrl*lkzs$i&#&y@^t! #^$ g9^$&pgb SDB36o \501529F2142DBB50]
"1"=hex:55,71,d5,88,d4,e8,c4,23,86,c5,84,77,3a,01,80,8c
"2"=hex:f5,fd,d2,af,b2,50,3f,e2,89,4b,5a,85,2d,92,a5,eb,e1,d6,58,1d,4d,0e,b6,
ab
"3"=hex:55,71,d5,88,d4,e8,c4,23,cc,0d,cd,35,65,2b,d2,55,b5,8a,e0,a5,a3,ab,e8,
77,08,f0,c2,34,61,83,02,00

[HKEY_LOCAL_MACHINE\software\LicCtrl\LicCtrl\LicCtrl\LicCtrl*lkzs$i&#&y@^t! #^$ g9^$&pgb SDB36o \501529F2142DBB50\3D0835C2F0236EA610F4A663E871DFB7]
"1"=hex:80,21,ee,d1,6b,60,09,6f,4b,f1,56,5e,2d,04,5e,d5,8d,17,94,38,2e,5b,ef,
24
"2"=hex:81,20,8f,ab,28,6a,52,9c
"3"=hex:88,a1,cf,fa,0d,74,49,96,bc,57,04,bd,a1,13,3e,e6,76,1e,cb,3c,66,6b,72,
ab,66,a2,73,59,1b,ba,6f,74,90,60,fd,9c,ea,a5,62,f3,b2,23,b6,2c,1c,04,48,22,\
"4"=hex:2f,ad,a2,e7,8a,bf,05,5e
"5"=hex:bf,e5,23,7b,b0,66,d6,fc,b8,e8,6b,a0,96,52,f7,32,80,09,8f,24,b7,b3,55,
1a,98,d1,47,16,02,43,61,1c,b9,d5,8f,2a,7b,81,b1,fb,95,22,f8,b3,2c,53,9d,ae,\
"6"=hex:80,21,ee,d1,6b,60,09,6f,4b,f1,56,5e,2d,04,5e,d5,36,9b,83,74,43,8b,78,
83,97,7c,06,42,9c,4b,26,2d,b8,50,6f,94,d7,23,a9,55,d8,b1,35,e2,3e,8d,3a,b2,\
"7"=hex:80,21,ee,d1,6b,60,09,6f,4b,f1,56,5e,2d,04,5e,d5,46,b3,d0,ab,2e,9c,08,
36,32,7a,4f,d5,08,17,06,88,dc,f5,4a,66,15,9f,97,67,69,f1,ad,3b,38,6d,a6,74
"8"=hex:9d,9e,b2,b9,a7,a5,f4,ae,4d,29,c2,a3,c0,78,c4,c5,65,47,71,48,e9,1d,9d,
ae,29,98,1a,e8,c6,8a,ea,0a,ff,18,6b,ec,1f,9e,d0,2c,a3,52,2c,56,64,9d,46,ea,\
"9"=hex:81,20,8f,ab,28,6a,52,9c
"18"=hex:4b,72,8f,bc,6c,3f,e4,15
"10"=hex:0f,1f,9e,11,ed,e3,a4,c9
"11"=hex:81,20,8f,ab,28,6a,52,9c
"12"=hex:38,44,5a,a7,93,b5,98,e6,55,31,55,fc,73,20,83,e0,bd,81,fb,46,3f,10,36,
33,f7,ba,b8,8a,a8,c3,90,07,c5,d0,e0,29,2d,d9,b9,7e,25,3a,51,09,cf,46,b9,46,\
"13"=hex:7d,b9,26,d8,f0,72,ba,f8,dc,58,65,4c,c7,bf,68,10,db,d0,cf,4f,e6,2d,e0,
c5
"14"=hex:b5,71,0d,86,6e,74,ea,86,e1,d3,42,28,14,b6,31,28
"24"=hex:81,20,8f,ab,28,6a,52,9c
"26"=hex:81,20,8f,ab,28,6a,52,9c
"27"=hex:81,20,8f,ab,28,6a,52,9c
"19"=hex:f9,52,3a,8c,51,6f,4d,95,c2,4f,f6,c4,20,8e,26,ce
"22"=hex:81,20,8f,ab,28,6a,52,9c
"15"=hex:9c,16,4d,d1,1f,d9,6a,e3,7d,c4,70,88,8c,d0,2f,4c,c8,b8,2f,87,81,d7,7e,
85,21,cf,ed,10,97,ae,a5,77,af,7d,c7,a4,0b,a0,92,b9,fd,7f,8d,c9,9b,67,2f,ea,\

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Windows\AutorunsDisabled]
"Appinit_Dlls"=hex(184):43,3a,5c,57,49,4e,44,4f,57,53,5c,73,79,73,74,65,6d,33,
32,5c,6d,65,79,69,7a,61,74,65,2e,64,6c,6c,43,3a,5c,57,49,4e,44,4f,57,53,5c,\
.
Completion time: 2009-03-10 9:25:24
ComboFix-quarantined-files.txt 2009-03-10 14:25:21
ComboFix2.txt 2009-03-09 21:39:59
ComboFix3.txt 2009-03-09 15:29:07

Pre-Run: 13,543,297,024 bytes free
Post-Run: 13,593,010,176 bytes free

288 — E O F — 2009-03-10 13:23:58

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:27:13 AM, on 3/10/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\Program Files\Webroot\Spy Sweeper\WRConsumerService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\crypserv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
C:\WINDOWS\runservice.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Documents and Settings\Davis\My Documents\My Downloads\Set Up and Tried\ghrone-0.271\Ghrone.exe
C:\Program Files\CDBurnerXP\NMSAccessU.exe
C:\Program Files\XemiComputers\Active Desktop Calendar\ADC.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe
C:\WINDOWS\system32\hpzipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\Compact Wireless-G USB Network Adapter with SpeedBooster\WLService.exe
C:\Program Files\Compact Wireless-G USB Network Adapter with SpeedBooster\WUSB54GSC.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Webroot\Spy Sweeper\SSU.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\imapi.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://mysearch.myway.com/jsp/dellsidebar.jsp?p=DE
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: (no name) - AutorunsDisabled - (no file)
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: StumbleUpon Launcher - {145B29F4-A56B-4b90-BBAC-45784EBEBBB7} - C:\Program Files\StumbleUpon\StumbleUponIEBar.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: (no name) - {4D25F921-B9FE-4682-BF72-8AB8210D6D75} - (no file)
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: StumbleUpon Toolbar - {5093EB4C-3E93-40AB-9266-B607BA87BDC8} - C:\Program Files\StumbleUpon\StumbleUponIEBar.dll
O4 - HKLM\..\Run: [NvCplDaemon] "C:\WINDOWS\system32\RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [CTSysVol] "C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe" /r
O4 - HKLM\..\Run: [P17Helper] "C:\WINDOWS\system32\rundll32.exe" P17.dll,P17Helper
O4 - HKLM\..\Run: [UpdReg] "C:\WINDOWS\UpdReg.EXE"
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [nwiz] "C:\WINDOWS\system32\nwiz.exe" /install
O4 - HKLM\..\Run: [NvMediaCenter] "C:\WINDOWS\system32\RUNDLL32.EXE" C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [DLA] "C:\WINDOWS\System32\DLA\DLACTRLW.EXE"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray
O4 - HKCU\..\Run: [ctfmon.exe] "C:\WINDOWS\system32\ctfmon.exe"
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Davis\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [Ghrone] C:\Documents and Settings\Davis\My Documents\My Downloads\Set Up and Tried\ghrone-0.271\Ghrone.exe
O4 - HKCU\..\Run: [Active Desktop Calendar] "C:\Program Files\XemiComputers\Active Desktop Calendar\ADC.exe"
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: StumbleUpon PhotoBlog It! - res://StumbleUponIEBar.dll/blogimage
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/…lscbase6662.cab
O23 - Service: Adobe Active File Monitor (AdobeActiveFileMonitor) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: Crypkey License - CrypKey (Canada) Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LicCtrl Service (LicCtrlService) - Unknown owner - C:\WINDOWS\runservice.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Photoshop Elements Device Connect (PhotoshopElementsDeviceConnect) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\hpzipm12.exe
O23 - Service: SolidWorks Licensing Service - SolidWorks - C:\Program Files\Common Files\SolidWorks Shared\Service\SolidWorksLicensing.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. (www.webroot.com) - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
O23 - Service: Webroot Client Service (WRConsumerService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRConsumerService.exe
O23 - Service: WUSB54GSCSVC - GEMTEKS - C:\Program Files\Compact Wireless-G USB Network Adapter with SpeedBooster\WLService.exe

–
End of file - 11225 bytes

Tomk

Post #12March 10, 2009, 3:34 PM UTC

kunrod3,

ComboFix didn't need to reboot that time. It's not a problem.

Please open HijackThis and run Do a system scan only
Check the boxes next to ONLY the entries listed below(if present):
- O2 - BHO: (no name) - AutorunsDisabled - (no file)
  O2 - BHO: (no name) - {4D25F921-B9FE-4682-BF72-8AB8210D6D75} - (no file)
  O4 - HKLM\..\Run: [ISUSPM Startup] "C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" -startup
  O4 - HKLM\..\Run: [nwiz] "C:\WINDOWS\system32\nwiz.exe" /install
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
Close all programs except for HijackThis.
Click on Fix checked
A box will pop up asking you if you wish to fix the selected items. Please choose YES.
Once it has fixed them, please exit/close HijackThis.

With that done, Log looks good

Time for some housekeeping

Click START then RUN
Now type Combofix /u in the runbox and click OK
Note the space between the X and the U, it needs to be there.
[external image: Posted Image]

The above procedure will:

Implement some cleanup procedures.
Reset System Restore.

Please re-enable any security that was disabled.

The following is my standard advice for the future. Use what you can and pat yourself on the back for what you're already doing.

Please take time to read Preventing Malware - Tools and Practices for Safe Computing. Very important information for your consideration is contained therein.

I would also suggest you read this:
So how did I get infected in the first place?
by Tony Klein

Also: "How to prevent malware"
by miekiemoes

Please respond back that you understand the above and let me know if you have any questions. Otherwise, this thread will be closed Resolved.

kunrod3

Post #13March 10, 2009, 6:50 PM UTC

Tom - I ran HJT and "fixed" those five entries. I also ran Combofix /u. Thank you very much for your time and assistance! You guys provide a great service here. I do have some questions. HJT is free? Should I keep that on my PC? Should I run that on a regular basis? Malwarebytes is free to try? Is it worth it to purchase it? Or is there another malware fighter that maybe prevents malware from getting on the PC in the first place? I haven't read your three suggested links yet, but I will, so my apologies if these questions are answered there?! Also, AntiVir is the program that discovered my problem in the first place - I uninstalled it because the multiple notices I was getting crippled my system. Your recommendation; - should I go back to AntiVir, stay with Avast or is AVG a better option? Lastly, is there a particular browser that is more secure? I have Firefox, IE and Google Chrome. I use Firefox regularly, IE once in a while and Chrome only occasionly. I also downloaded Opera, but haven't installed as of yet. Once again, thanks Tom - it's a big relief to know that things are back to "normal".

Tomk

Post #14March 10, 2009, 7:14 PM UTC

kunrod3, HJT is free. Doesn't hurt anything to have as long as you don't "play" with it. It is possible to bork your system. The only good reason for keeping it is if you had a problem and couldn't get on the internet to download a new copy - you could run what you have and post the log to the forum. This would require you to transfer the text file to a different computer, using some sort of removable media, and post from the computer that did have internet access. By the same token, if you had this situation without already having HJT, you could download on a different computer and transfer to the problem computer and then run. Your choice but it definitely won't hurt to delete it. Mbam is free. You can purchase if you want automatic updates and scheduled scans. Keep the free version for sure. Update it and run it once a month. It has no "real-time" component so it will not interfere with anything else you have. I have Avira and am happy with it. I have installed AVAST on computers of friends and have been happy with it and I know people who wouldn't use anything else. I used to use AVG. I currently think it's a resource hog and don't specifically recommend it. And lasly, I typically use Firefox. The bottom line with browser security is the person running the keyboard. Malware writers target the products that are used the most. Obviously, this allows them to cause pain and suffering to the greatest number of people. The security "bump" you get from using "3rd party" browsers is vastly overshadowed by browsing habits. If someone frequents crack and warez sites, they will get infected. The security programs in place and the browser used will not make a difference. Any further questions?

kunrod3

Post #15March 10, 2009, 7:50 PM UTC

Hey Tom - I forgot to ask about the other two programs you had me download, ERUNT and ATF. Should I uninstall them or keep them around like HJT? Thanks again.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] Infected by TR/Crypt.XPack.Gen

✨ Ask AI

Ask AI