What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Closed] Ultra Virus

9 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1 last edited
Hey everyone.
Heres my story. The other day I went onto facebook and through some inderect downloads recieved a viurs. This particular one set up a bunch of random site cookies on my computer preventing from going on any site other than the one it wants me to go to. These sites include engines like getsearch0303 and some weird "findhunter" one. With that I also recieve the constant spyware pop-up telling me I need to download spyware along with other annoying advertisements. My computer speed has also dramatically slowed down. If theres ANYONE that can help me with this I would be in your debt :notworthy:

Here is my Hijack log, I already have ComboFix and Malware installed for future refrences.
Thank You!
EDIT: I've had to resort to using my laptop from now, seems this trojan (or whatever it is) has a mind of its own and has decided that everything including google is a threat and won't let me go on it. Im completely baffled about what to do at this point. Sorry for being so inpatient but looks like youre my last resort unless I bring it to a computer shop. Once again thank you and any help would be greatly admired.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:53, on 2009-04-14
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe
c:\WINDOWS\system32\ZuneBusEnum.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Common Files\Ulead Systems\AutoDetector\monitor.exe
C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Zune\ZuneLauncher.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\AIM\aim.exe
C:\program files\steam\steam.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Registry Mechanic\RegMech.exe
C:\WINDOWS\system32\dll32.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Documents and Settings\Me\Desktop\Xfire\xfire.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=localhost:7171
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local;
O1 - Hosts: ::1 localhost
O1 - Hosts: 94.232.248.53 browser-security.microsoft.com
O1 - Hosts: 94.232.248.53 spy-wareprotector2009.com
O1 - Hosts: 94.232.248.53 www.spy-wareprotector2009.com
O1 - Hosts: 94.232.248.53 secure.spy-wareprotector2009.com
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: 887164 helper - {5FF186E7-0957-4095-8A2C-577CE6EA1B1F} - C:\WINDOWS\system32\887164\887164.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: BHO - {ABD45510-9B22-41cd-9ACD-8182A2DA7C63} - C:\WINDOWS\system32\iehelper.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [DXDllRegExe] dxdllreg.exe
O4 - HKLM\..\Run: [Ulead AutoDetector v2] C:\Program Files\Common Files\Ulead Systems\AutoDetector\monitor.exe
O4 - HKLM\..\Run: [USB2Check] RUNDLL32.EXE "C:\WINDOWS\system32\PCLECoInst.dll",CheckUSBController
O4 - HKLM\..\Run: [USBToolTip] "C:\Program Files\Pinnacle\Shared Files\\Programs\USBTip\USBTip.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Zune Launcher] "c:\Program Files\Zune\ZuneLauncher.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [realteczs] "C:\Documents and Settings\Me\Application Data\Google\pfysw721318.exe" 2
O4 - HKLM\..\Run: [sysldtray] C:\windows\ld07.exe
O4 - HKLM\..\Run: [pp] C:\windows\pp06.exe
O4 - HKLM\..\Run: [sysfbtray] C:\windows\freddy40.exe
O4 - HKLM\..\Run: [sysmstray] C:\windows\mstre17.exe
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [RegistryMechanic] C:\Program Files\Registry Mechanic\RegMech.exe /H
O4 - HKCU\..\Run: [dll32] dll32
O4 - HKCU\..\Run: [system tool] C:\WINDOWS\sysguard.exe
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - Startup: hamachi.lnk = C:\Program Files\Hamachi\hamachi.exe
O4 - Startup: Xfire.lnk = C:\Documents and Settings\Me\Desktop\Xfire\xfire.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.srtest.com/srl_bin/sysreqlab3.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) -
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1192098404078
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownlo…/sysreqlab2.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1192098236312
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - http://www.nvidia.com/content/DriverDownlo…iaSmartScan.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe (file missing)

–
End of file - 8722 bytes
Post #2
Hi,

Please do the following

(delete the Combofix you downloaded previously, updates are made to the program often and we need the most up to date version)

First:

Download Rooter.exe to your desktop

  • Doubleclick it to start the tool
  • A Notepad file containing the report will open, also found at %systemdrive%\Rooter.txt (Where %systemdrive% is usually C: or the drive that you have installed Windows).
  • Post that in your next reply.

Second:

Please download SDFix and save it to your Desktop.
  • You should print out these instructions, or copy them to a NotePad file for reading while in Safe Mode, because you will not be able to connect to the Internet to read from this site.
Double click on SDFix.exe. It should automatically extract a folder called SDFix to your system drive (usually C:\).
Please reboot your computer in Safe Mode by doing the following :
  • Restart your computer
  • After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key repeatedly;
  • Instead of Windows loading as normal, a menu with options should appear;
  • Select the first option, to run Windows in Safe Mode, then press "Enter".
  • Choose your usual user account.
  • Open the SDFix folder and double click on RunThis.bat to start the script.
  • Type Y and press Enter to begin the script.
  • It will start cleaning your PC and then prompt you to press any key to Reboot.
  • Press any key to restart the PC.
  • Your system will take longer than normal to restart as the fixtool will be removing files.
  • When the desktop loads the Fixtool will complete the removal and display Finished.
  • Press any key to end the script and to load your desktop icons.
  • A text file should automatically open, so please copy the contents and post them here.

Finally:

Download ComboFix from one of these locations:
Link 1
Link 2
Link 3

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
  • Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

  • Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]
  • Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
4. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please advise.
5. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.


Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now



In your next reply I need:

  • Rooter log
  • SDFix log
  • ComboFixLog
  • Fresh HJT Log
Post #3 last edited
Sorry it took so long to respond, but thanks a lot for responding! :D
Here are my logs in order
1. Rooter log
2. SDFix log
3. ComboFixLog
4. Fresh HJT Log

Rooter Log

Microsoft Windows XP Home Edition (5.1.2600) Service Pack 2

A:\ [Removable] (Total:0 Mo/Free:0 Mo)
C:\ [Fixed] - NTFS - (Total:305234 Mo/Free:2440 Mo)
D:\ [CD-Rom] (Total:0 Mo/Free:0 Mo)
E:\ [Fixed] - NTFS - (Total:194466 Mo/Free:2955 Mo)
F:\ [Removable] (Total:1919 Mo/Free:1371 Mo)

2009-04-19|17:47

———————-\\ Processes..

–Locked– [System Process]
———- System
———- \SystemRoot\System32\smss.exe
———- \??\C:\WINDOWS\system32\csrss.exe
———- \??\C:\WINDOWS\system32\winlogon.exe
———- C:\WINDOWS\system32\services.exe
———- C:\WINDOWS\system32\lsass.exe
———- C:\WINDOWS\system32\svchost.exe
———- C:\WINDOWS\system32\svchost.exe
———- C:\WINDOWS\System32\svchost.exe
———- C:\WINDOWS\system32\svchost.exe
———- C:\WINDOWS\system32\svchost.exe
———- C:\WINDOWS\system32\svchost.exe
———- C:\WINDOWS\system32\spoolsv.exe
———- C:\WINDOWS\system32\svchost.exe
———- C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
———- C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
———- C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
———- C:\WINDOWS\System32\svchost.exe
———- C:\Program Files\Java\jre6\bin\jqs.exe
———- c:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe
———- C:\WINDOWS\system32\nvsvc32.exe
———- c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
———- C:\WINDOWS\system32\svchost.exe
———- c:\WINDOWS\system32\ZuneBusEnum.exe
———- c:\Program Files\Zune\ZuneNss.exe
———- C:\WINDOWS\System32\alg.exe
———- C:\WINDOWS\system32\wscntfy.exe
———- C:\WINDOWS\Explorer.EXE
———- C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
———- C:\Program Files\QuickTime\qttask.exe
———- C:\Program Files\HP\HP Software Update\HPWuSchd.exe
———- C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
———- C:\Program Files\Common Files\Ulead Systems\AutoDetector\monitor.exe
———- C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe
———- C:\WINDOWS\system32\rundll32.exe
———- C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
———- C:\WINDOWS\RTHDCPL.EXE
———- C:\Program Files\Zune\ZuneLauncher.exe
———- C:\WINDOWS\system32\RUNDLL32.EXE
———- C:\Program Files\Java\jre6\bin\jusched.exe
———- C:\Program Files\AIM\aim.exe
———- C:\program files\steam\steam.exe
———- C:\Program Files\Messenger\msmsgs.exe
———- C:\WINDOWS\system32\ctfmon.exe
———- C:\Program Files\Registry Mechanic\RegMech.exe
———- C:\WINDOWS\sysguard.exe
———- C:\WINDOWS\system32\wuauclt.exe
———- C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
———- C:\Documents and Settings\Me\Desktop\Xfire\xfire.exe
———- C:\WINDOWS\system32\wbem\wmiprvse.exe
———- C:\WINDOWS\system32\wuauclt.exe
———- C:\PROGRA~1\WINDOW~1\ACCESS~1\wordpad.exe
———- C:\WINDOWS\system32\cmd.exe
———- C:\Rooter$\RK.exe

———————-\\ Search..

———————-\\ ROOTKIT !!


———————-\\ KoobFace !

C:\WINDOWS\msmark2.dat


1 - "C:\Rooter$\Rooter_1.txt" - 2009-04-19|17:48

———————-\\ Scan completed at 17:48

SDFix Log


SDFix: Version 1.240
Run by [removed] on 2009-04-19 at 17:59

Microsoft Windows XP [Version 5.1.2600]
Running From: C:\SDFix

Checking Services :


Restoring Default Security Values
Restoring Default Hosts File

Rebooting


Checking Files :

No Trojan Files Found






Removing Temp Files

ADS Check :



Final Check :

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-19 18:10:21
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden services & system hive …

scanning hidden registry entries …

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher]
"TracesProcessed"=dword:0000015c
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"DeviceNotSelectedTimeout"="15"
"GDIProcessHandleQuota"=dword:00002710
"Spooler"="yes"
"swapdisk"=""
"TransmissionRetryTimeout"="90"
"USERProcessHandleQuota"=dword:00002710
"appinit_dlls"=""
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{2B508D48-0306-9B9A-2351-4EAA4AB67FDD}]

scanning hidden files …

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Remaining Services :




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"="C:\\Program Files\\Grisoft\\AVG7\\avginet.exe:*:Enabled:avginet.exe"
"C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"="C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe:*:Enabled:avgamsvr.exe"
"C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"="C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe:*:Enabled:avgcc.exe"
"C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"="C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe:*:Enabled:avgemc.exe"
"C:\\Program Files\\THQ\\Dawn of War - Dark Crusade\\DarkCrusade.exe"="C:\\Program Files\\THQ\\Dawn of War - Dark Crusade\\DarkCrusade.exe:*:Enabled:DarkCrusade"
"C:\\Program Files\\EA GAMES\\Battlefield 2\\BF2.exe"="C:\\Program Files\\EA GAMES\\Battlefield 2\\BF2.exe:*:Enabled:Battlefield 2"
"C:\\Program Files\\AIM\\aim.exe"="C:\\Program Files\\AIM\\aim.exe:*:Enabled:AOL Instant Messenger"
"C:\\Program Files\\World of Warcraft\\WoW-2.1.0-enUS-downloader.exe"="C:\\Program Files\\World of Warcraft\\WoW-2.1.0-enUS-downloader.exe:*:Enabled:Blizzard Downloader"
"C:\\Program Files\\Steam\\Steam.exe"="C:\\Program Files\\Steam\\Steam.exe:*:Enabled:Steam Client"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Steam\\steamapps\\01468\\counter-strike source\\hl2.exe"="C:\\Program Files\\Steam\\steamapps\\01468\\counter-strike source\\hl2.exe:*:Enabled:hl2"
"C:\\Program Files\\Pinnacle\\Studio 10\\programs\\RM.exe"="C:\\Program Files\\Pinnacle\\Studio 10\\programs\\RM.exe:*:Enabled:Render Manager"
"C:\\Program Files\\Pinnacle\\Studio 10\\programs\\Studio.exe"="C:\\Program Files\\Pinnacle\\Studio 10\\programs\\Studio.exe:*:Enabled:Studio"
"C:\\Program Files\\Pinnacle\\Studio 10\\programs\\PMSRegisterFile.exe"="C:\\Program Files\\Pinnacle\\Studio 10\\programs\\PMSRegisterFile.exe:*:Enabled:PMSRegisterFile"
"C:\\Program Files\\Pinnacle\\Shared Files\\Programs\\MediaManager\\PMSManager.exe"="C:\\Program Files\\Pinnacle\\Shared Files\\Programs\\MediaManager\\PMSManager.exe:*:Enabled:PMSManager"
"C:\\Program Files\\Pinnacle\\Studio 10\\programs\\umi.exe"="C:\\Program Files\\Pinnacle\\Studio 10\\programs\\umi.exe:*:Enabled:umi"
"C:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe"="C:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe:*:Enabled:Blizzard Downloader"
"C:\\WINDOWS\\system32\\dpvsetup.exe"="C:\\WINDOWS\\system32\\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test"
"C:\\Documents and Settings\\Me\\Desktop\\Xfire\\xfire.exe"="C:\\Documents and Settings\\Me\\Desktop\\Xfire\\xfire.exe:*:Enabled:Xfire"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\\Program Files\\Common Files\\Microsoft Shared\\XNA\\XnaTrans\\v3.0\\XnaTransX.exe"="C:\\Program Files\\Common Files\\Microsoft Shared\\XNA\\XnaTrans\\v3.0\\XnaTransX.exe:LocalSubNet:Enabled:XNA Game Studio 3.0 Transport"
"C:\\Program Files\\Microsoft XNA\\XNA Game Studio\\v3.0\\Bin\\XnaLiveProxy.exe"="C:\\Program Files\\Microsoft XNA\\XNA Game Studio\\v3.0\\Bin\\XnaLiveProxy.exe:LocalSubNet:Enabled:XNA Framework Games for Windows - LIVE"
"C:\\Program Files\\Steam\\steamapps\\01468\\source sdk base\\hl2.exe"="C:\\Program Files\\Steam\\steamapps\\01468\\source sdk base\\hl2.exe:*:Enabled:hl2"
"C:\\Program Files\\THQ\\Titan Quest Immortal Throne\\Tqit.exe"="C:\\Program Files\\THQ\\Titan Quest Immortal Throne\\Tqit.exe:*:Enabled:Tqit"
"C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire"
"C:\\Program Files\\THQ\\Titan Quest\\Titan Quest.exe"="C:\\Program Files\\THQ\\Titan Quest\\Titan Quest.exe:*:Enabled:Titan Quest"
"C:\\Documents and Settings\\Me\\Desktop\\Phone\\Skype.exe"="C:\\Documents and Settings\\Me\\Desktop\\Phone\\Skype.exe:*:Enabled:Skype"
"%windir%\\system32\\drivers\\svchost.exe"="%windir%\\system32\\drivers\\svchost.exe:*:Enabled:svchost"
"C:\\Documents and Settings\\Me\\Desktop\\Skype.exe"="C:\\Documents and Settings\\Me\\Desktop\\Skype.exe:*:Enabled:Skype"
"C:\\Program Files\\Common Files\\Ulead Systems\\AutoDetector\\Monitor.exe"="C:\\Program Files\\Common Files\\Ulead Systems\\AutoDetector\\Monitor.exe:*:Enabled:monitor"
"C:\\Program Files\\Java\\jre6\\bin\\jucheck.exe"="C:\\Program Files\\Java\\jre6\\bin\\jucheck.exe:*:Enabled:jucheck"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\\system32\\drivers\\svchost.exe"="%windir%\\system32\\drivers\\svchost.exe:*:Enabled:svchost"

Remaining Files :



Files with Hidden Attributes :

Tue 14 Apr 2009 28,160 …H. — "C:\WINDOWS\freddy41.exe"
Sun 12 Apr 2009 24,576 …H. — "C:\WINDOWS\mstre16.exe"
Wed 22 Oct 2008 949,072 A.SHR — "C:\Program Files\File Scanner Library (Spybot - Search & Destroy)\advcheck.dll"
Wed 22 Oct 2008 962,896 A.SHR — "C:\Program Files\Misc. Support Library (Spybot - Search & Destroy)\Tools.dll"
Mon 15 Sep 2008 1,562,960 A.SHR — "C:\Program Files\SDHelper (Spybot - Search & Destroy)\SDHelper.dll"
Tue 16 Sep 2008 1,833,296 A.SHR — "C:\Program Files\TeaTimer (Spybot - Search & Destroy)\TeaTimer.exe"
Sun 11 Jan 2009 69,632 A.SH. — "C:\WINDOWS\system32\bufezeza.dll.tmp"
Sun 12 Apr 2009 64,000 A.SH. — "C:\WINDOWS\system32\tiyunike.exe"
Sat 11 Apr 2009 62,976 A.SH. — "C:\WINDOWS\system32\yivozizi.exe"
Thu 11 Oct 2007 4,348 A.SH. — "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Sat 20 Aug 2005 121,237 A..HR — "C:\Program Files\THQ\Dawn of War\Disk1Check.EXE"
Tue 23 Sep 2008 0 A.SH. — "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"

Finished!

Combo Fix Log

ComboFix 09-04-20.02 - Me 2009-04-19 18:26.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.2559.2002 [GMT -4:00]
Running from: F:\ComboFix.exe
AV: AVG 7.5.524 *On-access scanning enabled* (Outdated)
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\sysguard.exe
c:\windows\system32\887164
c:\windows\system32\887164\887164.dll
c:\windows\system32\iehelper.dll
c:\windows\system32\nfr.assembly
c:\windows\system32\nfr.gpref
.
—- Previous Run ——-
.
c:\windows\system32\batiweja.dll
c:\windows\system32\bekoduya.dll
c:\windows\system32\jonefede.dll
c:\windows\system32\juvoguru.dll
c:\windows\system32\puwisuro.dll
c:\windows\system32\titohoru.dll
c:\windows\system32\urugovuj.ini

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_SERVERTIME
——-\Service_ServerTime


((((((((((((((((((((((((( Files Created from 2009-03-20 to 2009-04-20 )))))))))))))))))))))))))))))))
.

2009-04-19 21:53 . 2009-04-19 21:53 ——– d—–w c:\windows\ERUNT
2009-04-19 21:49 . 2009-04-19 22:12 ——– d—–w C:\SDFix
2009-04-19 21:47 . 2009-04-19 21:48 ——– d—–w C:\Rooter$
2009-04-15 22:54 . 2009-04-15 22:54 197 —-a-w c:\windows\system32\MRT.INI
2009-04-15 19:29 . 2009-04-15 19:29 138 —-a-w C:\pch.bat
2009-04-15 19:27 . 2009-04-15 19:27 2 —h–w c:\windows\t55ft2772f44.dat
2009-04-14 22:42 . 2009-04-14 22:42 2 —h–w c:\windows\t55ft2831f44.dat
2009-04-14 22:42 . 2009-04-14 22:42 28160 —h–w c:\windows\freddy41.exe
2009-04-14 22:42 . 2009-04-14 22:42 2 —h–w c:\windows\t55ft2804f44.dat
2009-04-12 19:39 . 2009-04-12 19:39 1 —-a-w c:\windows\9g2234wesdf3dfgjf23
2009-04-12 19:39 . 2009-04-12 19:39 24576 —h–w c:\windows\mstre16.exe
2009-04-12 19:39 . 2009-04-12 19:39 2 —h–w c:\windows\t55ft2830f44.dat
2009-04-12 19:39 . 2009-04-12 19:39 1 —h–w c:\windows\msmark2.dat
2009-04-12 19:39 . 2009-04-12 19:39 2 —h–w c:\windows\t55ft2803f44.dat
2009-04-12 19:39 . 2009-04-12 19:39 1 —h–w c:\windows\f23567.dat
2009-04-05 02:11 . 2009-04-05 02:11 54156 —ha-w c:\windows\QTFont.qfn
2009-04-05 02:11 . 2009-04-05 02:11 1409 —-a-w c:\windows\QTFont.for
2009-03-25 17:24 . 2009-03-25 17:24 20472 —-a-w c:\windows\system32\drivers\icsak.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-20 22:26 . 2007-08-13 17:10 ——– d—–w c:\program files\Steam
2009-04-19 22:15 . 2009-01-04 17:23 ——– d—–w c:\documents and settings\Me\Application Data\Hamachi
2009-04-19 22:13 . 2008-01-13 23:48 ——– d—a-w c:\documents and settings\All Users\Application Data\TEMP
2009-04-19 21:48 . 2009-04-19 21:48 3231 —-a-w C:\Rooter.txt
2009-04-14 22:40 . 2007-07-26 19:38 ——– d—–w c:\program files\Spybot - Search & Destroy
2009-04-14 00:53 . 2007-07-26 19:38 ——– d—–w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-04-13 22:56 . 2007-07-26 19:45 ——– d—–w c:\documents and settings\Me\Application Data\AVG7
2009-04-12 19:22 . 2007-07-30 21:01 ——– d—–w c:\documents and settings\Me\Application Data\Xfire
2009-04-12 14:23 . 2009-01-12 14:23 64000 –sha-w c:\windows\system32\tiyunike.exe
2009-04-11 21:12 . 2008-12-29 19:08 ——– d—–w c:\program files\World of Warcraft
2009-04-11 20:06 . 2009-01-11 20:06 62976 –sha-w c:\windows\system32\yivozizi.exe
2009-04-09 02:04 . 2008-10-02 23:06 ——– d—–w c:\documents and settings\Me\Application Data\LimeWire
2009-04-05 19:25 . 2008-10-06 00:54 ——– d—–w c:\program files\FreeUndelete
2009-04-05 19:24 . 2009-04-01 23:58 ——– d—–w c:\program files\MindArk
2009-04-01 23:03 . 2007-07-30 20:58 ——– d—–w c:\documents and settings\Me\Application Data\Skype
2009-03-31 23:37 . 2009-03-01 20:59 ——– d—–w c:\program files\Celtx
2009-03-31 00:20 . 2008-08-16 04:04 ——– d—–w c:\program files\Audacity
2009-03-06 14:00 . 2004-08-04 10:00 284160 —-a-w c:\windows\system32\pdh.dll
2009-03-03 00:18 . 2006-03-04 03:33 826368 —-a-w c:\windows\system32\wininet.dll
2009-03-01 20:59 . 2009-03-01 20:59 ——– d—–w c:\documents and settings\Me\Application Data\Greyfirst
2009-02-22 20:07 . 2008-10-02 23:01 ——– d—–w c:\program files\LimeWire
2009-02-22 16:35 . 2009-02-08 22:11 ——– d—–w c:\documents and settings\Me\Application Data\Audacity
2009-02-20 18:09 . 2004-08-04 10:00 78336 —-a-w c:\windows\system32\ieencode.dll
2009-02-09 10:19 . 2004-08-04 10:00 1846272 —-a-w c:\windows\system32\win32k.sys
2009-02-09 10:01 . 2004-08-04 10:00 728576 —-a-w c:\windows\system32\lsasrv.dll
2009-02-09 10:01 . 2004-08-04 10:00 617984 —-a-w c:\windows\system32\advapi32.dll
2009-02-09 10:01 . 2004-08-04 10:00 401408 —-a-w c:\windows\system32\rpcss.dll
2009-02-09 10:01 . 2004-08-04 10:00 715264 —-a-w c:\windows\system32\ntdll.dll
2009-02-06 10:29 . 2005-03-30 01:21 2142720 —-a-w c:\windows\system32\ntoskrnl.exe
2009-02-06 10:22 . 2004-08-04 10:00 110592 —-a-w c:\windows\system32\services.exe
2009-02-06 09:54 . 2004-08-04 10:00 35328 —-a-w c:\windows\system32\sc.exe
2009-02-06 09:49 . 2005-03-30 01:01 2020864 —-a-w c:\windows\system32\ntkrnlpa.exe
2009-02-03 20:08 . 2004-08-04 10:00 55808 —-a-w c:\windows\system32\secur32.dll
2009-02-03 02:05 . 2009-02-03 02:05 410984 —-a-w c:\windows\system32\deploytk.dll
2009-01-23 01:18 . 2009-01-23 01:18 42320 —-a-w c:\windows\system32\xfcodec.dll
2008-09-23 23:00 . 2007-08-12 01:06 44184 —-a-w c:\documents and settings\Me\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2008-09-23 22:33 . 2008-09-23 22:33 109288 —-a-w c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2008-07-02 18:56 . 2008-07-02 03:19 22328 —-a-w c:\documents and settings\Me\Application Data\PnkBstrK.sys
2008-01-14 00:26 . 2008-01-14 00:26 125 —-a-w c:\documents and settings\Me\Local Settings\Application Data\fusioncache.dat
2002-07-26 21:02 . 2008-01-28 21:55 153088 —-a-w c:\program files\UNWISE.EXE
2009-01-11 20:01 . 2009-01-11 20:01 69632 –sha-w c:\windows\system32\bufezeza.dll.tmp
.

((((((((((((((((((((((((((((((((((((((((((((( AWF ))))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AIM"="c:\program files\AIM\aim.exe" [2006-08-01 67112]
"Steam"="c:\program files\steam\steam.exe" [2008-10-08 1410296]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"RegistryMechanic"="c:\program files\Registry Mechanic\RegMech.exe" [2008-07-08 2828184]
"system tool"="c:\windows\sysguard.exe" [N/A]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVG7_CC"="c:\progra~1\Grisoft\AVG7\avgcc.exe" [2008-04-16 579584]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-09-17 13574144]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-01-14 98304]
"PinnacleDriverCheck"="c:\windows\system32\PSDrvCheck.exe" [2004-03-11 406016]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd.exe" [2003-08-04 49152]
"HP Component Manager"="c:\program files\HP\hpcoretech\hpcmpmgr.exe" [2003-12-22 241664]
"Ulead AutoDetector v2"="c:\program files\Common Files\Ulead Systems\AutoDetector\monitor.exe" [2004-11-26 90112]
"USB2Check"="c:\windows\system32\PCLECoInst.dll" [2005-12-21 73728]
"USBToolTip"="c:\program files\Pinnacle\Shared Files\\Programs\USBTip\USBTip.exe" [2006-01-23 196608]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-12 39792]
"Zune Launcher"="c:\program files\Zune\ZuneLauncher.exe" [2008-09-12 160160]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-09-17 86016]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-02-03 136600]
"realteczs"="c:\documents and settings\Me\Application Data\Google\pfysw721318.exe" [N/A]
"sysmstray"="c:\windows\mstre17.exe" [N/A]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2008-09-17 1657376]
"DXDllRegExe"="dxdllreg.exe" [N/A]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.EXE [2005-09-22 14854144]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="c:\progra~1\Grisoft\AVG7\avgw.exe" [2007-10-30 219136]

c:\documents and settings\Me\Start Menu\Programs\Startup\
hamachi.lnk - c:\program files\Hamachi\hamachi.exe [2009-1-4 625952]
Xfire.lnk - c:\documents and settings\Me\Desktop\Xfire\xfire.exe [2009-1-22 2993488]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2003-9-16 237568]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Grisoft\\AVG7\\avginet.exe"=
"c:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"=
"c:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"=
"c:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"=
"c:\\Program Files\\THQ\\Dawn of War - Dark Crusade\\DarkCrusade.exe"=
"c:\\Program Files\\EA GAMES\\Battlefield 2\\BF2.exe"=
"c:\\Program Files\\AIM\\aim.exe"=
"c:\\Program Files\\Steam\\Steam.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Steam\\steamapps\\01468\\counter-strike source\\hl2.exe"=
"c:\\Program Files\\Pinnacle\\Studio 10\\programs\\RM.exe"=
"c:\\Program Files\\Pinnacle\\Studio 10\\programs\\Studio.exe"=
"c:\\Program Files\\Pinnacle\\Studio 10\\programs\\PMSRegisterFile.exe"=
"c:\\Program Files\\Pinnacle\\Shared Files\\Programs\\MediaManager\\PMSManager.exe"=
"c:\\Program Files\\Pinnacle\\Studio 10\\programs\\umi.exe"=
"c:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Documents and Settings\\Me\\Desktop\\Xfire\\xfire.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Steam\\steamapps\\01468\\source sdk base\\hl2.exe"=
"c:\\Program Files\\THQ\\Titan Quest Immortal Throne\\Tqit.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\THQ\\Titan Quest\\Titan Quest.exe"=
"c:\\Program Files\\World of Warcraft\\WoW-2.4.0-enUS-downloader.exe"=
"c:\\Documents and Settings\\Me\\Desktop\\Phone\\Skype.exe"=
"%windir%\\system32\\drivers\\svchost.exe"=
"c:\\Documents and Settings\\Me\\Desktop\\Skype.exe"=
"c:\\Program Files\\Common Files\\Ulead Systems\\AutoDetector\\Monitor.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\jucheck.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724

R3 icsak;icsak;c:\windows\system32\drivers\icsak.sys [2009-03-25 20472]
R4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\Microsoft SQL Server\100\Shared\SQLADHLP.EXE [2008-07-11 47128]
R4 RsFx0102;RsFx0102 Driver;c:\windows\system32\DRIVERS\RsFx0102.sys [2008-07-10 242712]
R4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);c:\program files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [2008-07-11 369688]


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{63ea380b-276d-11de-a800-003018a7956f}]
\Shell\AutoRun\command - F:\rcaeasyrip_setup.exe
\Shell\install\command - F:\rcaeasyrip_setup.exe
\Shell\usermanualEnglish\command - F:\rcaeasyrip_setup.exe /pdf_English
\Shell\usermanualFrench\command - F:\rcaeasyrip_setup.exe /pdf_French
\Shell\usermanualSpanish\command - F:\rcaeasyrip_setup.exe /pdf_Spanish
.
Contents of the 'Scheduled Tasks' folder
.
- - - - ORPHANS REMOVED - - - -

BHO-{ABD45510-9B22-41cd-9ACD-8182A2DA7C63} - c:\windows\system32\iehelper.dll


.
——- Supplementary Scan ——-
.
uStart Page = www.google.com/
uInternet Settings,ProxyServer = http=localhost:7171
uInternet Settings,ProxyOverride = *.local;
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-20 18:30
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-776561741-606747145-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{2B508D48-0306-9B9A-2351-4EAA4AB67FDD}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"cd042efbbd7f7af1647644e76e06692b"=hex:c8,28,51,af,b0,29,a3,98,df,e8,30,a1,4d,
75,fa,4a,c8,28,51,af,b0,29,a3,98,ca,0b,94,17,0d,b0,21,26,e2,63,26,f1,3f,c8,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"bca643cdc5c2726b20d2ecedcc62c59b"=hex:6a,9c,d6,61,af,45,84,18,7b,0e,43,34,7f,
1d,33,ce,71,3b,04,66,8b,46,0d,96,94,c5,6c,a0,b0,5f,62,f8,6a,9c,d6,61,af,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"2c81e34222e8052573023a60d06dd016"=hex:ff,7c,85,e0,43,d4,0e,fe,10,74,bf,e4,a6,
95,33,3a,25,da,ec,7e,55,20,c9,26,55,20,47,a5,24,61,63,7a,ff,7c,85,e0,43,d4,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"2582ae41fb52324423be06337561aa48"=hex:6b,65,49,6a,7e,99,74,f7,28,19,65,99,0e,
e1,65,8f,3e,1e,9e,e0,57,5a,93,61,03,0b,09,f6,cf,69,af,31,86,8c,21,01,be,91,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"caaeda5fd7a9ed7697d9686d4b818472"=hex:f5,1d,4d,73,a8,13,5c,05,d7,b7,df,18,6e,
64,94,54,cd,44,cd,b9,a6,33,6c,cd,85,1a,42,b6,86,09,ba,84,f5,1d,4d,73,a8,13,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"a4a1bcf2cc2b8bc3716b74b2b4522f5d"=hex:b0,18,ed,a7,3f,8d,37,a4,72,2a,ce,98,d9,
87,b4,29,b0,18,ed,a7,3f,8d,37,a4,f2,6b,ba,80,9b,ee,64,cb,df,20,58,62,78,6b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"4d370831d2c43cd13623e232fed27b7b"=hex:fb,a7,78,e6,12,2f,9a,ea,e0,17,e6,26,23,
f4,82,e8,31,77,e1,ba,b1,f8,68,02,b6,3a,39,98,9f,40,68,c6,fb,a7,78,e6,12,2f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"1d68fe701cdea33e477eb204b76f993d"=hex:83,6c,56,8b,a0,85,96,ab,fc,13,9c,69,2f,
5a,db,ac,83,6c,56,8b,a0,85,96,ab,6f,f6,a6,68,bc,cf,87,d4,01,3a,48,fc,e8,04,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"1fac81b91d8e3c5aa4b0a51804d844a3"=hex:51,fa,6e,91,28,9e,14,cc,11,60,a3,17,71,
1c,4b,76,51,fa,6e,91,28,9e,14,cc,83,56,8d,47,18,07,55,d1,f6,0f,4e,58,98,5b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"f5f62a6129303efb32fbe080bb27835b"=hex:b1,cd,45,5a,a8,c4,f8,b9,00,04,73,82,1a,
d3,96,00,b1,cd,45,5a,a8,c4,f8,b9,e3,99,e5,9e,42,3b,07,86,3d,ce,ea,26,2d,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"fd4e2e1a3940b94dceb5a6a021f2e3c6"=hex:2a,b7,cc,b5,b9,7f,41,e7,75,d1,8d,40,2c,
11,aa,d1,e3,0e,66,d5,eb,bc,2f,6b,9e,87,25,e3,50,1e,0a,1e,2a,b7,cc,b5,b9,7f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"8a8aec57dd6508a385616fbc86791ec2"=hex:fa,ea,66,7f,d4,3b,6b,70,50,7d,a4,cc,33,
ca,57,84,fa,ea,66,7f,d4,3b,6b,70,50,76,1e,a9,d2,03,5f,51,6c,43,2d,1e,aa,22,\
.
Completion time: 2009-04-20 18:32
ComboFix-quarantined-files.txt 2009-04-20 22:31
ComboFix2.txt 2008-12-29 16:48

Pre-Run: 75,462,709,248 bytes free
Post-Run: 75,458,396,160 bytes free

275 — E O F — 2009-04-15 22:55

New HJThis log
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:32, on 2009-04-20
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe
c:\WINDOWS\system32\ZuneBusEnum.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=localhost:7171
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local;
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [DXDllRegExe] dxdllreg.exe
O4 - HKLM\..\Run: [Ulead AutoDetector v2] C:\Program Files\Common Files\Ulead Systems\AutoDetector\monitor.exe
O4 - HKLM\..\Run: [USB2Check] RUNDLL32.EXE "C:\WINDOWS\system32\PCLECoInst.dll",CheckUSBController
O4 - HKLM\..\Run: [USBToolTip] "C:\Program Files\Pinnacle\Shared Files\\Programs\USBTip\USBTip.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Zune Launcher] "c:\Program Files\Zune\ZuneLauncher.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [realteczs] "C:\Documents and Settings\Me\Application Data\Google\pfysw721318.exe" 2
O4 - HKLM\..\Run: [sysmstray] C:\windows\mstre17.exe
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [RegistryMechanic] C:\Program Files\Registry Mechanic\RegMech.exe /H
O4 - HKCU\..\Run: [system tool] C:\WINDOWS\sysguard.exe
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - Startup: hamachi.lnk = C:\Program Files\Hamachi\hamachi.exe
O4 - Startup: Xfire.lnk = C:\Documents and Settings\Me\Desktop\Xfire\xfire.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.srtest.com/srl_bin/sysreqlab3.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) -
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1192098404078
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownlo…/sysreqlab2.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1192098236312
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - http://www.nvidia.com/content/DriverDownlo…iaSmartScan.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe (file missing)

–
End of file - 7432 bytes

Thank You, Hope This Helps!
Post #4
Hi

Please do the following:

  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below.
  • They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Copy/paste the text inside the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Copy all the text inside of the code box - Press Ctrl+C (or right click on the highlighted section and choose 'copy')


Collect::
c:\windows\system32\MRT.INI
C:\pch.bat
c:\windows\t55ft2772f44.dat
c:\windows\t55ft2831f44.dat
c:\windows\freddy41.exe
c:\windows\9g2234wesdf3dfgjf23
c:\windows\mstre16.exe
c:\windows\t55ft2830f44.dat
c:\windows\msmark2.dat
c:\windows\t55ft2803f44.dat
c:\windows\f23567.dat
c:\windows\system32\tiyunike.exe
c:\windows\system32\yivozizi.exe
c:\windows\system32\bufezeza.dll.tmp
c:\documents and settings\Me\Application Data\Google\pfysw721318.exe
C:\windows\mstre17.exe
c:\windows\sysguard.exe

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{63ea380b-276d-11de-a800-003018a7956f}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"realteczs"=-
"sysmstray"=-
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"system tool"=-

Now paste the copied text into the open notepad - press CTRL+V (or right click and choose 'paste')

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:

1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …

[external image: Posted Image]

* Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
* ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
* When finished, it shall produce a log for you.
* Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

NOTE: CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
Post #5 last edited
Hey,
I ran combofix with the proper script and it turned out fine. Im beginning to get my computer back. My only major problem right now is that I cant connect to the internet using Internet Explorer. My online programs run fine like MSN messanger etc but I can even connect to google on the browser. Any ideas?
Here is the new combo fix log,
-Thank you!


ComboFix 09-04-21.03 - Me 2009-04-21 15:36.4 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.2559.1940 [GMT -4:00]
Running from: F:\ComboFix.exe
Command switches used :: c:\documents and settings\Me\Desktop\CFScript.txt
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\pch.bat
c:\windows\9g2234wesdf3dfgjf23
c:\windows\f23567.dat
c:\windows\freddy41.exe
c:\windows\msmark2.dat
c:\windows\mstre16.exe
c:\windows\system32\bufezeza.dll.tmp
c:\windows\system32\MRT.INI
c:\windows\system32\tiyunike.exe
c:\windows\system32\yivozizi.exe
c:\windows\t55ft2772f44.dat
c:\windows\t55ft2803f44.dat
c:\windows\t55ft2830f44.dat
c:\windows\t55ft2831f44.dat

.
((((((((((((((((((((((((( Files Created from 2009-03-21 to 2009-04-21 )))))))))))))))))))))))))))))))
.

2009-04-19 21:53 . 2009-04-19 21:53 ——– d—–w c:\windows\ERUNT
2009-04-19 21:49 . 2009-04-19 22:12 ——– d—–w C:\SDFix
2009-04-19 21:47 . 2009-04-19 21:48 ——– d—–w C:\Rooter$
2009-04-14 22:42 . 2009-04-14 22:42 2 —h–w c:\windows\t55ft2804f44.dat
2009-04-05 02:11 . 2009-04-05 02:11 54156 —ha-w c:\windows\QTFont.qfn
2009-04-05 02:11 . 2009-04-05 02:11 1409 —-a-w c:\windows\QTFont.for
2009-03-25 17:24 . 2009-03-25 17:24 20472 —-a-w c:\windows\system32\drivers\icsak.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-21 19:37 . 2007-08-13 17:10 ——– d—–w c:\program files\Steam
2009-04-21 19:32 . 2009-01-04 17:23 ——– d—–w c:\documents and settings\Me\Application Data\Hamachi
2009-04-21 19:32 . 2008-01-13 23:48 ——– d—a-w c:\documents and settings\All Users\Application Data\TEMP
2009-04-19 21:48 . 2009-04-19 21:48 3231 —-a-w C:\Rooter.txt
2009-04-14 22:40 . 2007-07-26 19:38 ——– d—–w c:\program files\Spybot - Search & Destroy
2009-04-14 00:53 . 2007-07-26 19:38 ——– d—–w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-04-13 22:56 . 2007-07-26 19:45 ——– d—–w c:\documents and settings\Me\Application Data\AVG7
2009-04-12 19:22 . 2007-07-30 21:01 ——– d—–w c:\documents and settings\Me\Application Data\Xfire
2009-04-11 21:12 . 2008-12-29 19:08 ——– d—–w c:\program files\World of Warcraft
2009-04-09 02:04 . 2008-10-02 23:06 ——– d—–w c:\documents and settings\Me\Application Data\LimeWire
2009-04-05 19:25 . 2008-10-06 00:54 ——– d—–w c:\program files\FreeUndelete
2009-04-05 19:24 . 2009-04-01 23:58 ——– d—–w c:\program files\MindArk
2009-04-01 23:03 . 2007-07-30 20:58 ——– d—–w c:\documents and settings\Me\Application Data\Skype
2009-03-31 23:37 . 2009-03-01 20:59 ——– d—–w c:\program files\Celtx
2009-03-31 00:20 . 2008-08-16 04:04 ——– d—–w c:\program files\Audacity
2009-03-06 14:00 . 2004-08-04 10:00 284160 —-a-w c:\windows\system32\pdh.dll
2009-03-03 00:18 . 2006-03-04 03:33 826368 —-a-w c:\windows\system32\wininet.dll
2009-03-01 20:59 . 2009-03-01 20:59 ——– d—–w c:\documents and settings\Me\Application Data\Greyfirst
2009-02-22 20:07 . 2008-10-02 23:01 ——– d—–w c:\program files\LimeWire
2009-02-22 16:35 . 2009-02-08 22:11 ——– d—–w c:\documents and settings\Me\Application Data\Audacity
2009-02-20 18:09 . 2004-08-04 10:00 78336 —-a-w c:\windows\system32\ieencode.dll
2009-02-09 10:19 . 2004-08-04 10:00 1846272 —-a-w c:\windows\system32\win32k.sys
2009-02-09 10:01 . 2004-08-04 10:00 728576 —-a-w c:\windows\system32\lsasrv.dll
2009-02-09 10:01 . 2004-08-04 10:00 617984 —-a-w c:\windows\system32\advapi32.dll
2009-02-09 10:01 . 2004-08-04 10:00 401408 —-a-w c:\windows\system32\rpcss.dll
2009-02-09 10:01 . 2004-08-04 10:00 715264 —-a-w c:\windows\system32\ntdll.dll
2009-02-06 10:29 . 2005-03-30 01:21 2142720 —-a-w c:\windows\system32\ntoskrnl.exe
2009-02-06 10:22 . 2004-08-04 10:00 110592 —-a-w c:\windows\system32\services.exe
2009-02-06 09:54 . 2004-08-04 10:00 35328 —-a-w c:\windows\system32\sc.exe
2009-02-06 09:49 . 2005-03-30 01:01 2020864 —-a-w c:\windows\system32\ntkrnlpa.exe
2009-02-03 20:08 . 2004-08-04 10:00 55808 —-a-w c:\windows\system32\secur32.dll
2009-02-03 02:05 . 2009-02-03 02:05 410984 —-a-w c:\windows\system32\deploytk.dll
2009-01-23 01:18 . 2009-01-23 01:18 42320 —-a-w c:\windows\system32\xfcodec.dll
2008-09-23 23:00 . 2007-08-12 01:06 44184 —-a-w c:\documents and settings\Me\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2008-09-23 22:33 . 2008-09-23 22:33 109288 —-a-w c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2008-07-02 18:56 . 2008-07-02 03:19 22328 —-a-w c:\documents and settings\Me\Application Data\PnkBstrK.sys
2008-01-14 00:26 . 2008-01-14 00:26 125 —-a-w c:\documents and settings\Me\Local Settings\Application Data\fusioncache.dat
2002-07-26 21:02 . 2008-01-28 21:55 153088 —-a-w c:\program files\UNWISE.EXE
.

((((((((((((((((((((((((((((( SnapShot@2009-04-20_22.30.21 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-04-21 19:31 . 2009-04-21 19:31 16384 c:\windows\temp\Perflib_Perfdata_198.dat
+ 2004-08-04 10:00 . 2009-04-21 19:35 95404 c:\windows\system32\perfc009.dat
- 2004-08-04 10:00 . 2009-04-19 22:10 95404 c:\windows\system32\perfc009.dat
+ 2004-08-04 10:00 . 2009-04-21 19:35 505996 c:\windows\system32\perfh009.dat
- 2004-08-04 10:00 . 2009-04-19 22:10 505996 c:\windows\system32\perfh009.dat
.
((((((((((((((((((((((((((((((((((((((((((((( AWF ))))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AIM"="c:\program files\AIM\aim.exe" [2006-08-01 67112]
"Steam"="c:\program files\steam\steam.exe" [2008-10-08 1410296]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"RegistryMechanic"="c:\program files\Registry Mechanic\RegMech.exe" [2008-07-08 2828184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVG7_CC"="c:\progra~1\Grisoft\AVG7\avgcc.exe" [2008-04-16 579584]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-09-17 13574144]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-01-14 98304]
"PinnacleDriverCheck"="c:\windows\system32\PSDrvCheck.exe" [2004-03-11 406016]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd.exe" [2003-08-04 49152]
"HP Component Manager"="c:\program files\HP\hpcoretech\hpcmpmgr.exe" [2003-12-22 241664]
"Ulead AutoDetector v2"="c:\program files\Common Files\Ulead Systems\AutoDetector\monitor.exe" [2004-11-26 90112]
"USB2Check"="c:\windows\system32\PCLECoInst.dll" [2005-12-21 73728]
"USBToolTip"="c:\program files\Pinnacle\Shared Files\\Programs\USBTip\USBTip.exe" [2006-01-23 196608]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-12 39792]
"Zune Launcher"="c:\program files\Zune\ZuneLauncher.exe" [2008-09-12 160160]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-09-17 86016]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-02-03 136600]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2008-09-17 1657376]
"DXDllRegExe"="dxdllreg.exe" [N/A]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.EXE [2005-09-22 14854144]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="c:\progra~1\Grisoft\AVG7\avgw.exe" [2007-10-30 219136]

c:\documents and settings\Me\Start Menu\Programs\Startup\
hamachi.lnk - c:\program files\Hamachi\hamachi.exe [2009-1-4 625952]
Xfire.lnk - c:\documents and settings\Me\Desktop\Xfire\xfire.exe [2009-1-22 2993488]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2003-9-16 237568]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Grisoft\\AVG7\\avginet.exe"=
"c:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"=
"c:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"=
"c:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"=
"c:\\Program Files\\THQ\\Dawn of War - Dark Crusade\\DarkCrusade.exe"=
"c:\\Program Files\\EA GAMES\\Battlefield 2\\BF2.exe"=
"c:\\Program Files\\AIM\\aim.exe"=
"c:\\Program Files\\Steam\\Steam.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Steam\\steamapps\\01468\\counter-strike source\\hl2.exe"=
"c:\\Program Files\\Pinnacle\\Studio 10\\programs\\RM.exe"=
"c:\\Program Files\\Pinnacle\\Studio 10\\programs\\Studio.exe"=
"c:\\Program Files\\Pinnacle\\Studio 10\\programs\\PMSRegisterFile.exe"=
"c:\\Program Files\\Pinnacle\\Shared Files\\Programs\\MediaManager\\PMSManager.exe"=
"c:\\Program Files\\Pinnacle\\Studio 10\\programs\\umi.exe"=
"c:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Documents and Settings\\Me\\Desktop\\Xfire\\xfire.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Steam\\steamapps\\01468\\source sdk base\\hl2.exe"=
"c:\\Program Files\\THQ\\Titan Quest Immortal Throne\\Tqit.exe"=
"c:\\Program Files\\THQ\\Titan Quest\\Titan Quest.exe"=
"c:\\Documents and Settings\\Me\\Desktop\\Phone\\Skype.exe"=
"%windir%\\system32\\drivers\\svchost.exe"=
"c:\\Documents and Settings\\Me\\Desktop\\Skype.exe"=
"c:\\Program Files\\Common Files\\Ulead Systems\\AutoDetector\\Monitor.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\jucheck.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724

R3 icsak;icsak;c:\windows\system32\drivers\icsak.sys [2009-03-25 20472]
R4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\Microsoft SQL Server\100\Shared\SQLADHLP.EXE [2008-07-11 47128]
R4 RsFx0102;RsFx0102 Driver;c:\windows\system32\DRIVERS\RsFx0102.sys [2008-07-10 242712]
R4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);c:\program files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [2008-07-11 369688]

.
Contents of the 'Scheduled Tasks' folder
.
.
——- Supplementary Scan ——-
.
uStart Page = www.google.com/
uInternet Settings,ProxyServer = http=localhost:7171
uInternet Settings,ProxyOverride = *.local;
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-21 15:41
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-776561741-606747145-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{2B508D48-0306-9B9A-2351-4EAA4AB67FDD}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"cd042efbbd7f7af1647644e76e06692b"=hex:c8,28,51,af,b0,29,a3,98,df,e8,30,a1,4d,
75,fa,4a,c8,28,51,af,b0,29,a3,98,ca,0b,94,17,0d,b0,21,26,e2,63,26,f1,3f,c8,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"bca643cdc5c2726b20d2ecedcc62c59b"=hex:6a,9c,d6,61,af,45,84,18,7b,0e,43,34,7f,
1d,33,ce,71,3b,04,66,8b,46,0d,96,94,c5,6c,a0,b0,5f,62,f8,6a,9c,d6,61,af,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"2c81e34222e8052573023a60d06dd016"=hex:ff,7c,85,e0,43,d4,0e,fe,10,74,bf,e4,a6,
95,33,3a,25,da,ec,7e,55,20,c9,26,55,20,47,a5,24,61,63,7a,ff,7c,85,e0,43,d4,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"2582ae41fb52324423be06337561aa48"=hex:6b,65,49,6a,7e,99,74,f7,28,19,65,99,0e,
e1,65,8f,3e,1e,9e,e0,57,5a,93,61,03,0b,09,f6,cf,69,af,31,86,8c,21,01,be,91,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"caaeda5fd7a9ed7697d9686d4b818472"=hex:f5,1d,4d,73,a8,13,5c,05,d7,b7,df,18,6e,
64,94,54,cd,44,cd,b9,a6,33,6c,cd,85,1a,42,b6,86,09,ba,84,f5,1d,4d,73,a8,13,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"a4a1bcf2cc2b8bc3716b74b2b4522f5d"=hex:b0,18,ed,a7,3f,8d,37,a4,72,2a,ce,98,d9,
87,b4,29,b0,18,ed,a7,3f,8d,37,a4,f2,6b,ba,80,9b,ee,64,cb,df,20,58,62,78,6b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"4d370831d2c43cd13623e232fed27b7b"=hex:fb,a7,78,e6,12,2f,9a,ea,e0,17,e6,26,23,
f4,82,e8,31,77,e1,ba,b1,f8,68,02,b6,3a,39,98,9f,40,68,c6,fb,a7,78,e6,12,2f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"1d68fe701cdea33e477eb204b76f993d"=hex:83,6c,56,8b,a0,85,96,ab,fc,13,9c,69,2f,
5a,db,ac,83,6c,56,8b,a0,85,96,ab,6f,f6,a6,68,bc,cf,87,d4,01,3a,48,fc,e8,04,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"1fac81b91d8e3c5aa4b0a51804d844a3"=hex:51,fa,6e,91,28,9e,14,cc,11,60,a3,17,71,
1c,4b,76,51,fa,6e,91,28,9e,14,cc,83,56,8d,47,18,07,55,d1,f6,0f,4e,58,98,5b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"f5f62a6129303efb32fbe080bb27835b"=hex:b1,cd,45,5a,a8,c4,f8,b9,00,04,73,82,1a,
d3,96,00,b1,cd,45,5a,a8,c4,f8,b9,e3,99,e5,9e,42,3b,07,86,3d,ce,ea,26,2d,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"fd4e2e1a3940b94dceb5a6a021f2e3c6"=hex:2a,b7,cc,b5,b9,7f,41,e7,75,d1,8d,40,2c,
11,aa,d1,e3,0e,66,d5,eb,bc,2f,6b,9e,87,25,e3,50,1e,0a,1e,2a,b7,cc,b5,b9,7f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"8a8aec57dd6508a385616fbc86791ec2"=hex:fa,ea,66,7f,d4,3b,6b,70,50,7d,a4,cc,33,
ca,57,84,fa,ea,66,7f,d4,3b,6b,70,50,76,1e,a9,d2,03,5f,51,6c,43,2d,1e,aa,22,\
.
Completion time: 2009-04-21 15:43
ComboFix-quarantined-files.txt 2009-04-21 19:43
ComboFix2.txt 2009-04-20 22:32
ComboFix3.txt 2008-12-29 16:48

Pre-Run: 75,445,264,384 bytes free
Post-Run: 75,429,134,336 bytes free

254 — E O F — 2009-04-15 22:55
Post #6 last edited
Hi,

While I am analysing the log there are a couple of things to do to try and get your connection back with IE:

Try these things one by one see if you can reconnect after each one.

Let me know how you get on and which one (hopefully) did the trick.


First:

Make sure your firewall is not blocking the connection

Next:

Click Start> Run> type in CMD tap enter key
Copy/Paste: ipconfig /flushdns
Tap Enter
If you are typing this in, note the space between the g /f
It needs to be there.

Next type in: ipconfig /release
Tap Enter

Next type in: ipconfig /renew
Tap Enter

Now lets check some settings on your system.
Enter your Control Panel and double-click on Network Connections

Then right click on your Default Connection
Usually Local Area Connection for Cable and DSL
Left click on Properties
Double-Click on the Internet Protocol (TCP/IP) item
Select the radio dial that says Obtain DNS Servers Automatically
Note: Do this for all Network Connections
Press OK twice to get out of the properties screen and reboot if it asks

NEXT::

For these commands press Start, > Run, type CMD, press OK to open a command prompt.

To reset WINSOCK entries to installation defaults: type: netsh winsock reset catalog at the command prompt > enter

then to reset TCP/IP stack to installation defaults. type netsh int ip reset reset.log at the command prompt > exit

Reboot the machine.


NEXT

1. Open IE7>> Tools>> Internet Options
2. Click the Connections tab
3. Click to highlight the first entry under Dialup and Virtual Private Networks settings, then click the Settings button.
4. Place a checkmark in the Automatically detect settings checkbox, then click OK.
5. Repeat steps 3 and 4 for all listed Dialup and Virtual Private Networks
6. With the Connections tab still selected, click the LAN Settings button.
7. Place a checkmark in the Automatically detect settings checkbox, then click OK.
8. Close IE7 and restart the browser.


Hopefully now you will be able to access the internet.

if you are still unable, as a temporary fix from another computer download firefox to a USB and transfer it over and install

hopefully the problem is with IE. and we can work on fixing the problem once the malware is totally cleaned.
Post #7 last edited
Alright so I tried all the things listed above. Unfortunately none of them work. Even firefox gave me a message saying that im connected to a proxy server but the proxy server wont let me through. Another thing I found strange was for your step "1. Open IE7>> Tools>> Internet Options 2. Click the Connections tab 3. Click to highlight the first entry under Dialup and Virtual Private Networks settings, then click the Settings button." I have no entries underneath there, its blank so I have no settings to change. Do you have any other recommendations or scans I could preform? I mean like I said before I can use different online applications but my computer blocks me from surfing of browsing the internet.
Post #8 last edited
  • Open HiJackThis
  • Click on Do a system scan only
  • Check the boxes next to ONLY the entries listed below (if still present):

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=localhost:7171


  • Close all windows except Hijackthis and click Fix Checked
  • Click Yes when prompted
  • Close HijackThis.


NEXT

In I.E.

Check internet options settings.

Tools > Internet Options > Connections

LAN settings

Choose "automatically detect settings"

uncheck both proxy settings boxes
Post #9
yes! :yeah:
the first step did it, you had to get rid of the local host and I actually got my internet back xD.
Thank you so much, my next option was to go get it reformatted or buy a new windows in order to start fresh.
You said something about malware in another post? did you need me to run antimalware or anything?
here is the new HJT log in case you think I should do anything else.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:16, on 2009-04-23
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe
c:\WINDOWS\system32\ZuneBusEnum.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\HP\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Common Files\Ulead Systems\AutoDetector\monitor.exe
C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Zune\ZuneLauncher.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\AIM\aim.exe
C:\program files\steam\steam.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Registry Mechanic\RegMech.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Hamachi\hamachi.exe
C:\Documents and Settings\Me\Desktop\Xfire\xfire.exe
C:\Program Files\HP\hpcoretech\comp\hptskmgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local;
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [DXDllRegExe] dxdllreg.exe
O4 - HKLM\..\Run: [Ulead AutoDetector v2] C:\Program Files\Common Files\Ulead Systems\AutoDetector\monitor.exe
O4 - HKLM\..\Run: [USB2Check] RUNDLL32.EXE "C:\WINDOWS\system32\PCLECoInst.dll",CheckUSBController
O4 - HKLM\..\Run: [USBToolTip] "C:\Program Files\Pinnacle\Shared Files\\Programs\USBTip\USBTip.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Zune Launcher] "c:\Program Files\Zune\ZuneLauncher.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [RegistryMechanic] C:\Program Files\Registry Mechanic\RegMech.exe /H
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - Startup: hamachi.lnk = C:\Program Files\Hamachi\hamachi.exe
O4 - Startup: Xfire.lnk = C:\Documents and Settings\Me\Desktop\Xfire\xfire.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.srtest.com/srl_bin/sysreqlab3.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) -
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1192098404078
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownlo…/sysreqlab2.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1192098236312
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - http://www.nvidia.com/content/DriverDownlo…iaSmartScan.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe (file missing)

–
End of file - 7937 bytes
Post #10
:thumbup:

I knew something would work eventually:

There may be some leftovers remaining so please do the following:


Please download Malwarebytes' Anti-Malware
  • Double Click mbam-setup.exe to install the application.
  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish, so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected. <– very important
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.

Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.


>>>NEXT<<<


Go to Kaspersky website and perform an online antivirus scan.
  • Read through the requirements and privacy statement and click on Accept button.
  • It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
  • When the downloads have finished, click on Settings.
  • Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
    • Spyware, Adware, Dialers, and other potentially dangerous programs
      Archives
      Mail databases
  • Click on My Computer under Scan.
  • Once the scan is complete, it will display the results. Click on View Scan Report.
  • You will see a list of infected items there. Click on Save Report As….
  • Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button. Then post it here.

In your next reply I need

  • MBAM Log
  • Kaspersky report
  • FreshHJT Log

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI