[Resolved] HTL - Fun Trojan

I re-ran combofix with the same script i used last time.

ComboFix 09-05-20.09 - Dan 05/23/2009 14:45.4 - NTFSx86
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Dan\Desktop\CFScript.txt

FILE ::
c:\docume~1\Dan\LOCALS~1\Temp\krdpdre.sys
c:\windows\system32\542365619.dat
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
—- Previous Run ——-
.
c:\documents and settings\All Users\Application Data\10236254
c:\documents and settings\All Users\Application Data\10236254\10236254.glu
c:\documents and settings\All Users\Application Data\10236254\pc10236254cnf
c:\documents and settings\All Users\Application Data\10236254\pc10236254ins
c:\documents and settings\All Users\Application Data\60256249
c:\documents and settings\All Users\Application Data\90246246
c:\windows\system32\542365619.dat

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_KRDPDRE
——-\Service_krdpdre


((((((((((((((((((((((((( Files Created from 2009-04-23 to 2009-05-23 )))))))))))))))))))))))))))))))
.

2009-05-20 01:58 . 2009-05-20 02:02 ——– d—–w C:\Rooter$
2009-05-19 03:55 . 2009-04-06 20:32 15504 —-a-w c:\windows\system32\drivers\mbam.sys
2009-05-19 03:55 . 2009-04-06 20:32 38496 —-a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-05-19 03:55 . 2009-05-19 03:58 ——– d—–w C:\Malwarebytes' Anti-Malware
2009-05-19 03:38 . 2009-05-19 03:38 ——– d—–w c:\documents and settings\All Users\Application Data\Malwarebytes
2009-05-19 03:19 . 2009-05-19 03:19 ——– d—–w c:\program files\ERUNT
2009-05-17 00:39 . 2009-05-17 17:52 ——– d—–w c:\program files\SpywareBlaster
2009-05-12 22:05 . 2009-05-12 22:08 ——– d—–w c:\documents and settings\Angelina\Application Data\COMCASTTOOLBAR
2009-05-12 22:00 . 2009-05-12 22:00 ——– d—–w c:\documents and settings\Angelina\Local Settings\Application Data\SupportSoft
2009-05-09 13:22 . 2009-05-09 13:22 ——– d—–w c:\program files\ComcastToolbar
2009-05-09 13:21 . 2009-05-09 13:21 ——– d—–w c:\documents and settings\All Users\Application Data\SupportSoft
2009-05-09 13:20 . 2009-05-09 13:20 ——– d—–w c:\program files\Comcast
2009-04-25 00:22 . 2008-04-14 00:11 21504 —-a-w c:\windows\system32\drivers\hidserv.dll
2009-04-25 00:22 . 2008-04-13 18:39 14592 -c–a-w c:\windows\system32\dllcache\kbdhid.sys
2009-04-25 00:22 . 2008-04-13 18:39 14592 —-a-w c:\windows\system32\drivers\kbdhid.sys
2009-04-25 00:16 . 2008-06-10 20:04 31048 —-a-w c:\windows\system32\drivers\point32.sys
2009-04-25 00:16 . 2009-04-25 00:16 ——– d—–w c:\program files\Microsoft IntelliPoint
2009-04-25 00:15 . 2008-06-09 20:12 18504 —-a-w c:\windows\system32\drivers\nuidfltr.sys
2009-04-25 00:15 . 2008-06-09 20:12 1421384 —-a-w c:\windows\system32\wdfcoinstaller01005.dll
2009-04-25 00:15 . 2009-04-25 00:15 ——– d—–w c:\program files\Microsoft IntelliType Pro

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-12 22:24 . 2008-04-29 23:53 72280 —-a-w c:\documents and settings\Dan\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-05-09 13:22 . 2006-01-05 16:50 ——– d—–w c:\program files\Common Files\Scanner
2009-05-09 13:20 . 2008-09-28 20:04 ——– d—–w c:\program files\Common Files\SupportSoft
2009-05-09 13:19 . 2008-09-28 20:04 ——– d—–w c:\program files\support.com
2009-04-25 00:24 . 2009-04-25 00:24 0 —ha-w c:\windows\system32\drivers\Msft_Kernel_NuidFltr_01005.Wdf
2009-04-25 00:24 . 2009-04-25 00:24 0 —ha-w c:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2009-04-23 13:15 . 2008-04-29 12:14 11952 —-a-w c:\windows\system32\avgrsstx.dll
2009-04-23 13:15 . 2008-04-29 12:14 325896 —-a-w c:\windows\system32\drivers\avgldx86.sys
2009-04-23 13:15 . 2008-04-29 12:11 29208 —-a-w c:\windows\system32\drivers\avgfwdx.sys
2009-04-23 13:15 . 2008-04-29 12:11 50968 —-a-w c:\windows\system32\avgfwdx.dll
2009-04-23 13:15 . 2008-04-29 12:14 12552 —-a-w c:\windows\system32\drivers\avgrkx86.sys
2009-04-23 13:14 . 2008-04-29 12:14 108552 —-a-w c:\windows\system32\drivers\avgtdix.sys
2009-04-12 00:58 . 2009-04-12 00:57 ——– d—–w c:\program files\iTunes
2009-04-12 00:57 . 2009-04-12 00:57 ——– d—–w c:\program files\iPod
2009-04-12 00:57 . 2008-01-02 03:36 ——– d—–w c:\program files\Common Files\Apple
2009-04-11 15:14 . 2007-10-15 23:41 ——– d—–w c:\program files\Spybot - Search & Destroy
2009-03-28 23:48 . 2008-07-24 01:19 ——– d—–w c:\program files\RegCure
2009-03-19 21:32 . 2008-01-29 17:01 23400 —-a-w c:\windows\system32\drivers\GEARAspiWDM.sys
2009-03-06 14:22 . 2003-07-16 20:41 284160 —-a-w c:\windows\system32\pdh.dll
2009-03-06 04:59 . 2009-03-15 12:01 1900544 —-a-w c:\windows\system32\usbaaplrc.dll
2009-03-06 04:59 . 2008-01-02 03:36 36864 —-a-w c:\windows\system32\drivers\usbaapl.sys
2009-03-03 00:18 . 2005-10-21 18:51 826368 —-a-w c:\windows\system32\wininet.dll
.

——- Sigcheck ——-

[-] 2005-05-25 19:04 359808 88763A98A4C26C409741B4AA162720C9 c:\windows\$hf_mig$\KB893066\SP2GDR\tcpip.sys
[-] 2005-05-25 19:07 359936 63FDFEA54EB53DE2D863EE454937CE1E c:\windows\$hf_mig$\KB893066\SP2QFE\tcpip.sys
[-] 2006-01-13 17:07 360448 5562CC0A47B2AEF06D3417B733F3C195 c:\windows\$hf_mig$\KB913446\SP2QFE\tcpip.sys
[-] 2006-04-20 12:18 360576 B2220C618B42A2212A59D91EBD6FC4B4 c:\windows\$hf_mig$\KB917953\SP2QFE\tcpip.sys
[-] 2007-10-30 16:53 360832 64798ECFA43D78C7178375FCDD16D8C8 c:\windows\$hf_mig$\KB941644\SP2QFE\tcpip.sys
[7] 2008-06-20 10:44 360960 744E57C99232201AE98C49168B918F48 c:\windows\$hf_mig$\KB951748\SP2QFE\tcpip.sys
[7] 2008-06-20 11:51 361600 9AEFA14BD6B182D61E3119FA5F436D3D c:\windows\$hf_mig$\KB951748\SP3GDR\tcpip.sys
[7] 2008-06-20 11:59 361600 AD978A1B783B5719720CFF204B666C8E c:\windows\$hf_mig$\KB951748\SP3QFE\tcpip.sys
[7] 2008-06-20 10:45 360320 2A5554FC5B1E04E131230E3CE035C3F9 c:\windows\$NtServicePackUninstall$\tcpip.sys
[7] 2004-08-04 06:14 359040 9F4B36614A0FC234525BA224957DE55C c:\windows\$NtUninstallKB893066$\tcpip.sys
[-] 2003-07-16 20:47 332928 244A2F9816BC9B593957281EF577D976 c:\windows\$NtUninstallKB893066_0$\tcpip.sys
[-] 2005-05-25 19:04 359808 88763A98A4C26C409741B4AA162720C9 c:\windows\$NtUninstallKB913446$\tcpip.sys
[-] 2006-01-13 02:28 359808 583E063FDC888CA30D05C2724B0D7EF4 c:\windows\$NtUninstallKB917953$\tcpip.sys
[-] 2006-04-20 11:51 359808 1DBF125862891817F374F407626967F4 c:\windows\$NtUninstallKB941644$\tcpip.sys
[7] 2008-04-13 19:20 361344 93EA8D04EC73A85DB02EB8805988F733 c:\windows\$NtUninstallKB951748$\tcpip.sys
[-] 2007-10-30 17:20 360064 90CAFF4B094573449A0872A0F919B178 c:\windows\$NtUninstallKB951748_0$\tcpip.sys
[-] 2008-04-13 19:20 361344 ACCF5A9A1FFAA490F33DBA1C632B95E1 c:\windows\ServicePackFiles\i386\tcpip.sys
[-] 2008-06-20 11:51 361600 9425B72F40257B45D45D24773273DAD0 c:\windows\system32\dllcache\tcpip.sys
[-] 2008-06-20 11:51 361600 9425B72F40257B45D45D24773273DAD0 c:\windows\system32\drivers\tcpip.sys
.
((((((((((((((((((((((((((((( SnapShot@2009-05-21_01.42.42 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-05-22 03:06 . 2009-05-22 03:06 16384 c:\windows\Temp\Perflib_Perfdata_100.dat
+ 2009-05-23 19:48 . 2009-05-23 19:48 53248 c:\windows\Temp\catchme.dll
- 2009-05-21 01:42 . 2009-05-21 01:42 53248 c:\windows\Temp\catchme.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Dell AIO Printer A940"="c:\program files\Dell AIO Printer A940\dlbabmgr.exe" [2003-06-25 294998]
"Microsoft Works Update Detection"="c:\program files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" [2003-06-07 50688]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-04-23 1947928]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-02-06 177472]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-04-02 342312]
"itype"="c:\program files\Microsoft IntelliType Pro\itype.exe" [2008-06-10 1442888]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2008-06-10 1406024]
"ddoctorv2"="c:\program files\Comcast\Desktop Doctor\bin\sprtcmd.exe" [2007-04-19 198184]
"LogitechCommunicationsManager"="c:\program files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2007-10-25 563984]
"LogitechQuickCamRibbon"="c:\program files\Logitech\QuickCam\Quickcam.exe" [2007-10-25 2178832]
"MSConfig"="c:\windows\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2008-04-14 169984]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSimpleStartMenu"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-04-23 13:15 11952 —-a-w c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AVG Anti-Spyware Driver]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AVG Anti-Spyware Guard]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"UleadBurningHelper"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"YOP"=c:\progra~1\Yahoo!\YOP\yop.exe /autostart
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" -atboottime
"LogitechQuickCamRibbon"="c:\program files\Logitech\QuickCam\Quickcam.exe" /hide
"diagent"="c:\program files\Creative\SBLive\Diagnostics\diagent.exe" startup

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Yahoo!\\Messenger\\yserver.exe"= c:\\Program Files\\Yahoo!\\Messenger\\yserver.exe
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\LEXPPS.EXE"=
"c:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Civilization4.exe"=
"c:\\Program Files\\Activision\\Star Trek Armada II\\Armada2.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Beyond the Sword\\Civ4BeyondSword.exe"=
"c:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Beyond the Sword\\Civ4BeyondSword_PitBoss.exe"=
"c:\\Program Files\\Raven\\Star Trek Voyager Elite Force\\stvoyHM.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

R1 bcbus;BestCrypt bus driver;c:\windows\system32\DRIVERS\bcbus.sys [x]
R3 Avgfwfd;AVG network filter service;c:\windows\system32\DRIVERS\avgfwdx.sys [2009-04-23 29208]
S0 AvgRkx86;avgrkx86.sys;c:\windows\System32\Drivers\avgrkx86.sys [2009-04-23 12552]
S1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\System32\Drivers\avgldx86.sys [2009-04-23 325896]
S1 AvgTdiX;AVG8 Network Redirector;c:\windows\System32\Drivers\avgtdix.sys [2009-04-23 108552]
S2 avg8emc;AVG8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2009-04-23 908568]
S2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-04-23 298776]
S2 avgfws8;AVG8 Firewall;c:\progra~1\AVG\AVG8\avgfws8.exe [2009-04-23 1366904]
S2 NkPtpEnumP2;NkPtpEnumP2;c:\program files\Nikon\Wireless Camera Setup Utility\NkPtpEnum.exe [2005-06-17 24064]
S3 Avgfwdx;Avgfwdx;c:\windows\system32\DRIVERS\avgfwdx.sys [2009-04-23 29208]
S3 VBus;Virtual Bus;c:\windows\system32\DRIVERS\NkVBus.sys [2005-06-17 17664]


— Other Services/Drivers In Memory —

*Deregistered* - AFD
*Deregistered* - ALG
*Deregistered* - Apple Mobile Device
*Deregistered* - Ati HotKey Poller
*Deregistered* - ATI Smart
*Deregistered* - AudioSrv
*Deregistered* - avg8emc
*Deregistered* - avg8wd
*Deregistered* - Avgfwdx
*Deregistered* - avgfws8
*Deregistered* - AvgLdx86
*Deregistered* - AvgMfx86
*Deregistered* - AvgRkx86
*Deregistered* - AvgTdiX
*Deregistered* - Beep
*Deregistered* - BITS
*Deregistered* - Bonjour Service
*Deregistered* - Browser
*Deregistered* - Cdfs
*Deregistered* - Creative Service for CDROM Access
*Deregistered* - CryptSvc
*Deregistered* - ctsfm2k
*Deregistered* - DcomLaunch
*Deregistered* - Dhcp
*Deregistered* - Dnscache
*Deregistered* - drvnddm
*Deregistered* - ERSvc
*Deregistered* - EventSystem
*Deregistered* - Fastfat
*Deregistered* - FastUserSwitchingCompatibility
*Deregistered* - Fips
*Deregistered* - FltMgr
*Deregistered* - Ftdisk
*Deregistered* - Gpc
*Deregistered* - helpsvc
*Deregistered* - HidServ
*Deregistered* - HTTP
*Deregistered* - HTTPFilter
*Deregistered* - ImapiService
*Deregistered* - InterBaseGuardian
*Deregistered* - InterBaseServer
*Deregistered* - IpNat
*Deregistered* - IPSec
*Deregistered* - IPVNMon
*Deregistered* - JavaQuickStarterService
*Deregistered* - Kbdclass
*Deregistered* - KSecDD
*Deregistered* - lanmanserver
*Deregistered* - lanmanworkstation
*Deregistered* - LexBceS
*Deregistered* - LmHosts
*Deregistered* - LVCOMSer
*Deregistered* - LVPr2Mon
*Deregistered* - LVPrcSrv
*Deregistered* - LVSrvLauncher
*Deregistered* - LVUSBSta
*Deregistered* - MDC8021X
*Deregistered* - mdmxsdk
*Deregistered* - mnmdd
*Deregistered* - Mouclass
*Deregistered* - MountMgr
*Deregistered* - MRxDAV
*Deregistered* - MRxSmb
*Deregistered* - Msfs
*Deregistered* - mssmbios
*Deregistered* - Mup
*Deregistered* - NDIS
*Deregistered* - NdisTapi
*Deregistered* - NdisWan
*Deregistered* - NDProxy
*Deregistered* - NetBIOS
*Deregistered* - NetBT
*Deregistered* - Netman
*Deregistered* - NkPtpEnumP2
*Deregistered* - Nla
*Deregistered* - Npfs
*Deregistered* - Ntfs
*Deregistered* - Null
*Deregistered* - OMCI
*Deregistered* - ossrv
*Deregistered* - PartMgr
*Deregistered* - ParVdm
*Deregistered* - PfModNT
*Deregistered* - PolicyAgent
*Deregistered* - PptpMiniport
*Deregistered* - ProtectedStorage
*Deregistered* - PSched
*Deregistered* - RasAcd
*Deregistered* - Rasl2tp
*Deregistered* - RasMan
*Deregistered* - RasPppoe
*Deregistered* - Raspti
*Deregistered* - Rdbss
*Deregistered* - RDPCDD
*Deregistered* - RetroLauncher
*Deregistered* - RetroWDSvc
*Deregistered* - RpcSs
*Deregistered* - SamSs
*Deregistered* - Schedule
*Deregistered* - Secdrv
*Deregistered* - seclogon
*Deregistered* - SENS
*Deregistered* - SharedAccess
*Deregistered* - ShellHWDetection
*Deregistered* - Spooler
*Deregistered* - sprtsvc_ddoctorv2
*Deregistered* - sr
*Deregistered* - srservice
*Deregistered* - Srv
*Deregistered* - SSDPSRV
*Deregistered* - ssrtln
*Deregistered* - stisvc
*Deregistered* - swenum
*Deregistered* - TapiSrv
*Deregistered* - Tcpip
*Deregistered* - TermService
*Deregistered* - tfsnboio
*Deregistered* - tfsncofs
*Deregistered* - tfsndrct
*Deregistered* - tfsndres
*Deregistered* - tfsnifs
*Deregistered* - tfsnopio
*Deregistered* - tfsnpool
*Deregistered* - tfsnudf
*Deregistered* - tfsnudfa
*Deregistered* - Themes
*Deregistered* - TrkWks
*Deregistered* - Update
*Deregistered* - upnphost
*Deregistered* - VBus
*Deregistered* - VET-FILT
*Deregistered* - VET-REC
*Deregistered* - VETEBOOT
*Deregistered* - VETEFILE
*Deregistered* - VETMONNT
*Deregistered* - VgaSave
*Deregistered* - VolSnap
*Deregistered* - W32Time
*Deregistered* - Wanarp
*Deregistered* - Wdf01000
*Deregistered* - WebClient
*Deregistered* - WinDriver6
*Deregistered* - winmgmt
*Deregistered* - WMDM PMSP Service
*Deregistered* - WMPNetworkSvc
*Deregistered* - wscsvc
*Deregistered* - wuauserv
.
Contents of the 'Scheduled Tasks' folder

2009-05-17 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]

2009-05-22 c:\windows\Tasks\RegCure Program Check.job
- c:\program files\RegCure\RegCure.exe [2008-04-21 21:21]

2009-05-22 c:\windows\Tasks\RegCure.job
- c:\program files\RegCure\RegCure.exe [2008-04-21 21:21]
.
.
——- Supplementary Scan ——-
.
mWindow Title = Windows Internet Explorer provided by Comcast
LSP: c:\windows\System32\VetRedir.dll
FF - ProfilePath - c:\docume~1\Dan\APPLIC~1\Mozilla\Firefox\Profiles\75p2ovg1.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.chicagobears.com
FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
FF - component: c:\program files\AVG\AVG8\ToolbarFF\components\vmAVGConnector.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-23 14:48
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(928)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'lsass.exe'(984)
c:\windows\System32\VetRedir.dll
c:\windows\system32\ISafeIf.dll

- - - - - - - > 'explorer.exe'(10340)
c:\windows\system32\WPDShServiceObj.dll
c:\windows\System32\VetRedir.dll
c:\windows\system32\ISafeIf.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2009-05-23 14:52
ComboFix-quarantined-files.txt 2009-05-23 19:51
ComboFix2.txt 2009-05-21 01:46

Pre-Run: 45,187,112,960 bytes free
Post-Run: 45,175,087,104 bytes free

359 — E O F — 2009-05-14 01:50


And other Hijackthis log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:58:37 PM, on 5/23/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\PROGRA~1\AVG\AVG8\avgfws8.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Borland\Interbase\Bin\IBGuard.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\PROGRA~1\AVG\AVG8\avgam.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\Program Files\Nikon\Wireless Camera Setup Utility\NkPtpEnum.exe
C:\PROGRA~1\Dantz\RETROS~1\retrorun.exe
C:\PROGRA~1\Dantz\RETROS~1\wdsvc.exe
C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\Program Files\Borland\Interbase\Bin\IBServer.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\AVG\AVG8\avgui.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Comcast Toolbar - {4E7BD74F-2B8D-469E-93BE-BE2DF4D9AE29} - C:\PROGRA~1\COMCAS~2\COMCAS~1.DLL
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: AVGTOOLBAR - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: (no name) - {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D} - (no file)
O3 - Toolbar: AVGTOOLBAR - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O3 - Toolbar: Comcast Toolbar - {4E7BD74F-2B8D-469E-93BE-BE2DF4D9AE29} - C:\PROGRA~1\COMCAS~2\COMCAS~1.DLL
O4 - HKLM\..\Run: [Dell AIO Printer A940] "C:\Program Files\Dell AIO Printer A940\dlbabmgr.exe"
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [itype] "C:\Program Files\Microsoft IntelliType Pro\itype.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [ddoctorv2] "C:\Program Files\Comcast\Desktop Doctor\bin\sprtcmd.exe" /P ddoctorv2
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - Global Startup: Adobe Reader Speed Launch.lnk.disabled
O4 - Global Startup: Digital Line Detect.lnk.disabled
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: AVG8 Firewall (avgfws8) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgfws8.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InterBase Guardian (InterBaseGuardian) - Inprise Corporation - C:\Program Files\Borland\Interbase\Bin\IBGuard.exe
O23 - Service: InterBase Server (InterBaseServer) - Inprise Corporation - C:\Program Files\Borland\Interbase\Bin\IBServer.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: NkPtpEnumP2 - Nikon Corporation - C:\Program Files\Nikon\Wireless Camera Setup Utility\NkPtpEnum.exe
O23 - Service: Retrospect Launcher (RetroLauncher) - Dantz Development Corporation - C:\PROGRA~1\Dantz\RETROS~1\retrorun.exe
O23 - Service: Retrospect WD Service (RetroWDSvc) - Dantz Development Corporation - C:\PROGRA~1\Dantz\RETROS~1\wdsvc.exe
O23 - Service: SupportSoft Sprocket Service (ddoctorv2) (sprtsvc_ddoctorv2) - SupportSoft, Inc. - C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe
O23 - Service: VET Message Service (VETMSGNT) - Unknown owner - C:\Program Files\Yahoo!\Antivirus\VetMsg.exe (file missing)
O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\system32\YPCSER~1.EXE

–
End of file - 8484 bytes


Thanks for your time!

Hi Indi,

I am curious what the impact on MBAM the registry install error would have, if any. Does that mean MBAM will not work properly?

The two scans didn't pick up anything. Completely clear. So I was wondering if the bug has been killed a while ago but something in the virus delete process deleted something in the registry which is causing these issues.

My AVG virus scaner is not picking anything up anymore. However, the registry file cleaner, 'registry cure' picks up issues in the empty registry values every time, and they are the same issues each time. But the program does not create a log which is frustrating. Soem of the entries are related to a 'media audio controller' which I thought was related to the original virus.

Thanks for your time!

Here's the three logs>

Malwarebytes' Anti-Malware 1.36
Database version: 1945
Windows 5.1.2600 Service Pack 3

5/26/2009 7:08:53 PM
mbam-log-2009-05-26 (19-08-53).txt

Scan type: Quick Scan
Objects scanned: 99098
Time elapsed: 7 minute(s), 31 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)


——————————————————————————–
KASPERSKY ONLINE SCANNER 7.0 REPORT
Wednesday, May 27, 2009
Operating System: Microsoft Windows XP Home Edition Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Program database last update: Wednesday, May 27, 2009 00:45:56
Records in database: 2254690
——————————————————————————–

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
A:\
C:\
D:\

Scan statistics:
Files scanned: 120168
Threat name: 0
Infected objects: 0
Suspicious objects: 0
Duration of the scan: 03:12:01

No malware has been detected. The scan area is clean.

The selected area was scanned.



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:41:52 AM, on 5/27/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\PROGRA~1\AVG\AVG8\avgfws8.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Borland\Interbase\Bin\IBGuard.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\PROGRA~1\AVG\AVG8\avgam.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\Dantz\RETROS~1\retrorun.exe
C:\PROGRA~1\Dantz\RETROS~1\wdsvc.exe
C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\Program Files\Borland\Interbase\Bin\IBServer.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\dllhost.exe
C:\Program Files\AVG\AVG8\avgui.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\ssstars.scr
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Comcast Toolbar - {4E7BD74F-2B8D-469E-93BE-BE2DF4D9AE29} - C:\PROGRA~1\COMCAS~2\COMCAS~1.DLL
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: AVGTOOLBAR - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: (no name) - {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D} - (no file)
O3 - Toolbar: AVGTOOLBAR - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O3 - Toolbar: Comcast Toolbar - {4E7BD74F-2B8D-469E-93BE-BE2DF4D9AE29} - C:\PROGRA~1\COMCAS~2\COMCAS~1.DLL
O4 - HKLM\..\Run: [Dell AIO Printer A940] "C:\Program Files\Dell AIO Printer A940\dlbabmgr.exe"
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [itype] "C:\Program Files\Microsoft IntelliType Pro\itype.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [ddoctorv2] "C:\Program Files\Comcast\Desktop Doctor\bin\sprtcmd.exe" /P ddoctorv2
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - Global Startup: Adobe Reader Speed Launch.lnk.disabled
O4 - Global Startup: Digital Line Detect.lnk.disabled
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: AVG8 Firewall (avgfws8) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgfws8.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InterBase Guardian (InterBaseGuardian) - Inprise Corporation - C:\Program Files\Borland\Interbase\Bin\IBGuard.exe
O23 - Service: InterBase Server (InterBaseServer) - Inprise Corporation - C:\Program Files\Borland\Interbase\Bin\IBServer.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: NkPtpEnumP2 - Nikon Corporation - C:\Program Files\Nikon\Wireless Camera Setup Utility\NkPtpEnum.exe
O23 - Service: Retrospect Launcher (RetroLauncher) - Dantz Development Corporation - C:\PROGRA~1\Dantz\RETROS~1\retrorun.exe
O23 - Service: Retrospect WD Service (RetroWDSvc) - Dantz Development Corporation - C:\PROGRA~1\Dantz\RETROS~1\wdsvc.exe
O23 - Service: SupportSoft Sprocket Service (ddoctorv2) (sprtsvc_ddoctorv2) - SupportSoft, Inc. - C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe
O23 - Service: VET Message Service (VETMSGNT) - Unknown owner - C:\Program Files\Yahoo!\Antivirus\VetMsg.exe (file missing)
O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\system32\YPCSER~1.EXE

–
End of file - 8599 bytes

Hi Tomk,

Thanks for your help, tell Indi I hope all is well with him.

Okay- I was curious it seems with most of these programs they have a few lines where they try to access settings and it says access denied. Is that normal? The Smitfraud app did that this time.

I ran HJT and deleted the above marked items you listed. Since this Trojan or whatever it is, has a habit of changing things back the way they were, i ran the scan again and these three amigos were back.

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R3 - Default URLSearchHook is missing

I tried to 'fix' them again, and they came back yet again.

I thought this below value might be the same as the ones above so I tried to fix it too. Same result, it always comes back.
R0 - HKCU\Software\Microsoft\Internet Explorer\toolbar,linksFolderName=

Are these default registry values that always come back?



Dial-A-Fix had an issue with C\windows\system32\initpki.dll It listed a 'error 5, access is denied' and told me to email a log to dial-a-fix@DjLizard. Here's the log in case you want it;

Notes about this log:
1) "->" denotes an external command being executed, and "-> (number)" indicates
the return code from the previous command
2) Not all external command return codes are accurate, or useful
3) Sometimes commands return 0 (no error) even when they fail or crash
4) If an error occurs while registering an object, please send an email to:
[removed] and include a copy of this log

DAF version: v0.60.0.24

— System info —
OS: Microsoft Windows XP Service Pack 3
IE version: 7.0.5730.13
MPC: 55277-OEM
CPU: Intel® Pentium® 4 CPU 3.00GHz (~2920MHz)
BIOS: 2/23/2004
Memory (approx): 1022MB
Uptime: 130 hour(s)
Current directory: C:\Documents and Settings\Dan\Desktop\Dial-a-fix-v0.60.0.24\Dial-a-fix-v0.60.0.24
—

6/2/2009 6:49:04 PM – Dial-a-fix : [v0.60.0.24] – started
6:49:04 PM | Policy scan started
6:49:04 PM | Policy scan ended - no restrictive policies were found
— MSI —
6:49:56 PM | Registered: C:\WINDOWS\system32\msi.dll
— Windows Update —
— Registration: Windows Update/Automatic Update DLLs —
6:50:10 PM | Unregistered: C:\WINDOWS\system32\msxml.dll
6:50:10 PM | Registered: C:\WINDOWS\system32\msxml.dll
6:50:13 PM | Unregistered: C:\WINDOWS\system32\msxml2.dll
6:50:14 PM | Registered: C:\WINDOWS\system32\msxml2.dll
6:50:24 PM | Unregistered: C:\WINDOWS\system32\msxml3.dll
6:50:25 PM | Registered: C:\WINDOWS\system32\msxml3.dll
6:50:26 PM | Unregistered: C:\WINDOWS\system32\msxml4.dll
6:50:26 PM | Registered: C:\WINDOWS\system32\msxml4.dll
6:50:27 PM | Unregistered: C:\WINDOWS\system32\qmgr.dll
6:50:27 PM | Registered: C:\WINDOWS\system32\qmgr.dll
6:50:27 PM | Unregistered: C:\WINDOWS\system32\qmgrprxy.dll
6:50:27 PM | Registered: C:\WINDOWS\system32\qmgrprxy.dll
6:50:27 PM | Unregistered: C:\WINDOWS\system32\winhttp.dll
6:50:27 PM | Registered: C:\WINDOWS\system32\winhttp.dll
6:50:28 PM | Registered: C:\WINDOWS\system32\wuapi.dll
6:50:28 PM | Unregistered: C:\WINDOWS\system32\wuaueng.dll
6:50:30 PM | Registered: C:\WINDOWS\system32\wuaueng.dll
6:50:30 PM | Unregistered: C:\WINDOWS\system32\wuaueng1.dll
6:50:30 PM | Registered: C:\WINDOWS\system32\wuaueng1.dll
6:50:30 PM | Unregistered: C:\WINDOWS\system32\wucltui.dll
6:50:30 PM | Registered: C:\WINDOWS\system32\wucltui.dll
6:50:30 PM | Unregistered: C:\WINDOWS\system32\wups.dll
6:50:30 PM | Registered: C:\WINDOWS\system32\wups.dll
6:50:30 PM | Unregistered: C:\WINDOWS\system32\wups2.dll
6:50:30 PM | Registered: C:\WINDOWS\system32\wups2.dll
6:50:31 PM | Unregistered: C:\WINDOWS\system32\wuweb.dll
6:50:31 PM | Registered: C:\WINDOWS\system32\wuweb.dll
6:50:31 PM | Registered: C:\WINDOWS\system32\ole32.dll
— SSL/HTTPS/Cryptography —
6:50:45 PM | Executed 'cmd.exe /c rmdir /q /s C:\WINDOWS\system32\Catroot2'
— Registration: SSL/HTTPS/Cryptography —
6:50:50 PM | Unregistered: C:\WINDOWS\system32\cryptdlg.dll
6:50:50 PM | Registered: C:\WINDOWS\system32\cryptdlg.dll
6:50:50 PM | Unregistered: C:\WINDOWS\system32\cryptui.dll
6:50:50 PM | Registered: C:\WINDOWS\system32\cryptui.dll
6:50:51 PM | Unregistered: C:\WINDOWS\system32\cryptext.dll
6:50:51 PM | Registered: C:\WINDOWS\system32\cryptext.dll
6:50:51 PM | Unregistered: C:\WINDOWS\system32\dssenh.dll
6:50:51 PM | Registered: C:\WINDOWS\system32\dssenh.dll
6:50:52 PM | Unregistered: C:\WINDOWS\system32\gpkcsp.dll
6:50:52 PM | Registered: C:\WINDOWS\system32\gpkcsp.dll
6:50:52 PM | Unregistered: C:\WINDOWS\system32\initpki.dll
6:53:53 PM | Error during registration of C:\WINDOWS\system32\initpki.dll - version: 5.131.2600.5512. The error returned is: Access is denied.
(5)
6:53:54 PM | Unregistered: C:\WINDOWS\system32\licdll.dll
6:53:54 PM | Registered: C:\WINDOWS\system32\licdll.dll
6:53:54 PM | Unregistered: C:\WINDOWS\system32\mssign32.dll
6:53:54 PM | Registered: C:\WINDOWS\system32\mssign32.dll
6:53:54 PM | Unregistered: C:\WINDOWS\system32\mssip32.dll
6:53:54 PM | Registered: C:\WINDOWS\system32\mssip32.dll
6:53:55 PM | Unregistered: C:\WINDOWS\system32\scardssp.dll
6:53:55 PM | Registered: C:\WINDOWS\system32\scardssp.dll
6:53:55 PM | Unregistered: C:\WINDOWS\system32\sccbase.dll
6:53:55 PM | Registered: C:\WINDOWS\system32\sccbase.dll
6:53:55 PM | Unregistered: C:\WINDOWS\system32\scecli.dll
6:53:55 PM | Registered: C:\WINDOWS\system32\scecli.dll
6:53:55 PM | Unregistered: C:\WINDOWS\system32\softpub.dll
6:53:56 PM | Registered: C:\WINDOWS\system32\softpub.dll
6:53:56 PM | Unregistered: C:\WINDOWS\system32\slbcsp.dll
6:53:56 PM | Registered: C:\WINDOWS\system32\slbcsp.dll
6:53:57 PM | Unregistered: C:\WINDOWS\system32\regwizc.dll
6:53:57 PM | Registered: C:\WINDOWS\system32\regwizc.dll
6:53:57 PM | Unregistered: C:\WINDOWS\system32\rsaenh.dll
6:53:57 PM | Registered: C:\WINDOWS\system32\rsaenh.dll
6:53:57 PM | Unregistered: C:\WINDOWS\system32\winhttp.dll
6:53:57 PM | Registered: C:\WINDOWS\system32\winhttp.dll
6:53:57 PM | Unregistered: C:\WINDOWS\system32\wintrust.dll
6:53:57 PM | Registered: C:\WINDOWS\system32\wintrust.dll
— Registration: ActiveX controls/codecs —
6:53:57 PM | Registered: C:\WINDOWS\system32\acelpdec.ax
6:53:58 PM | Registered: C:\WINDOWS\system32\actxprxy.dll
6:53:58 PM | Registered: C:\WINDOWS\system32\asctrls.ocx
6:53:58 PM | Registered: C:\WINDOWS\system32\daxctle.ocx
6:53:59 PM | Registered: C:\WINDOWS\system32\hhctrl.ocx
6:53:59 PM | Registered: C:\WINDOWS\system32\l3codecx.ax
6:53:59 PM | Registered: C:\WINDOWS\system32\licmgr10.dll
6:53:59 PM | Registered: C:\WINDOWS\system32\mpg4ds32.ax
6:54:04 PM | Registered: C:\WINDOWS\system32\msdxm.ocx
6:54:04 PM | Registered: C:\WINDOWS\system32\proctexe.ocx
6:54:04 PM | Registered: C:\WINDOWS\system32\tdc.ocx
6:54:05 PM | Registered: C:\WINDOWS\system32\wshom.ocx
— Registration: Control Panel applets —
6:54:07 PM | DllInstalled: C:\WINDOWS\system32\inetcpl.cpl
6:54:07 PM | DllInstalled: C:\WINDOWS\system32\nusrmgr.cpl
6:54:07 PM | Registered: C:\WINDOWS\system32\nusrmgr.cpl
— Registration: Direct[X|Draw|Show|Media] —
6:54:07 PM | Registered: C:\WINDOWS\system32\quartz.dll
6:54:09 PM | Registered: C:\WINDOWS\system32\danim.dll
6:54:09 PM | Registered: C:\WINDOWS\system32\dmscript.dll
6:54:09 PM | Registered: C:\WINDOWS\system32\dmstyle.dll
6:54:09 PM | Registered: C:\WINDOWS\system32\dxmasf.dll
6:54:09 PM | Registered: C:\WINDOWS\system32\dxtmsft.dll
6:54:09 PM | Registered: C:\WINDOWS\system32\dxtrans.dll
6:54:10 PM | Registered: C:\WINDOWS\system32\sbe.dll
— Registration: Programming cores/runtimes —
6:54:10 PM | Registered: C:\WINDOWS\system32\atl.dll
6:54:10 PM | Registered: C:\WINDOWS\system32\corpol.dll
6:54:10 PM | Registered: C:\WINDOWS\system32\jscript.dll
6:54:10 PM | Registered: C:\WINDOWS\system32\dispex.dll
6:54:10 PM | Registered: C:\WINDOWS\system32\scrrun.dll
6:54:10 PM | Registered: C:\WINDOWS\system32\scrobj.dll
6:54:10 PM | Registered: C:\WINDOWS\system32\vbscript.dll
6:54:10 PM | Registered: C:\WINDOWS\system32\wshext.dll
— Registration: Explorer/IE/OE/shell/WMP —
6:54:11 PM | Registered: C:\WINDOWS\system32\activeds.dll
6:54:11 PM | Registered: C:\WINDOWS\system32\audiodev.dll
6:54:11 PM | Registered: C:\WINDOWS\system32\browsewm.dll
6:54:12 PM | Registered: C:\WINDOWS\system32\cabview.dll
6:54:12 PM | Registered: C:\WINDOWS\system32\cdfview.dll
6:54:12 PM | Registered: C:\WINDOWS\system32\clbcatex.dll
6:54:12 PM | Registered: C:\WINDOWS\system32\clbcatq.dll
6:54:12 PM | Registered: C:\WINDOWS\system32\comcat.dll
6:54:12 PM | Registered: C:\WINDOWS\system32\cscui.dll
6:54:12 PM | Registered: C:\WINDOWS\system32\credui.dll
6:54:12 PM | Registered: C:\WINDOWS\system32\datime.dll
6:54:13 PM | Registered: C:\WINDOWS\system32\devmgr.dll
6:54:13 PM | Registered: C:\WINDOWS\system32\dfsshlex.dll
6:54:14 PM | Registered: C:\WINDOWS\system32\dmdlgs.dll
6:54:14 PM | Registered: C:\WINDOWS\system32\dmdskmgr.dll
6:54:14 PM | Registered: C:\WINDOWS\system32\dmloader.dll
6:54:14 PM | Registered: C:\WINDOWS\system32\dmocx.dll
6:54:14 PM | Registered: C:\WINDOWS\system32\dmview.ocx
6:54:14 PM | DllInstalled: C:\WINDOWS\system32\dsuiext.dll
6:54:14 PM | Registered: C:\WINDOWS\system32\dsuiext.dll
6:54:14 PM | DllInstalled: C:\WINDOWS\system32\dsquery.dll
6:54:14 PM | Registered: C:\WINDOWS\system32\dsquery.dll
6:54:14 PM | Registered: C:\WINDOWS\system32\dskquoui.dll
6:54:15 PM | Registered: C:\WINDOWS\system32\els.dll
6:54:15 PM | Registered: C:\WINDOWS\system32\es.dll
6:54:15 PM | Registered: C:\WINDOWS\system32\fontext.dll
6:54:16 PM | Registered: C:\WINDOWS\system32\hlink.dll
6:54:16 PM | Registered: C:\WINDOWS\system32\hnetcfg.dll
6:54:16 PM | Registered: C:\WINDOWS\system32\iedkcs32.dll
6:54:16 PM | Registered: C:\WINDOWS\system32\iepeers.dll
6:54:16 PM | Registered: C:\WINDOWS\system32\ils.dll
6:54:16 PM | Registered: C:\WINDOWS\system32\inetcfg.dll
6:54:17 PM | Registered: C:\WINDOWS\system32\inetcomm.dll
6:54:17 PM | Registered: C:\WINDOWS\system32\laprxy.dll
6:54:18 PM | Registered: C:\WINDOWS\system32\lmrt.dll
6:54:18 PM | Registered: C:\WINDOWS\system32\mlang.dll
6:54:19 PM | Registered: C:\WINDOWS\system32\mmcndmgr.dll
6:54:19 PM | Registered: C:\WINDOWS\system32\mmcshext.dll
6:54:22 PM | Registered: C:\WINDOWS\system32\mscoree.dll
6:54:22 PM | Registered: C:\WINDOWS\system32\mshtmled.dll
6:54:22 PM | Registered: C:\WINDOWS\system32\msoeacct.dll
6:54:22 PM | Registered: C:\WINDOWS\system32\msr2c.dll
6:54:22 PM | DllInstalled: C:\WINDOWS\system32\mydocs.dll
6:54:22 PM | Registered: C:\WINDOWS\system32\mydocs.dll
6:54:22 PM | Registered: C:\WINDOWS\system32\mstime.dll
6:54:23 PM | Registered: C:\WINDOWS\system32\netcfgx.dll
6:54:23 PM | DllInstalled: C:\WINDOWS\system32\netplwiz.dll
6:54:23 PM | Registered: C:\WINDOWS\system32\netplwiz.dll
6:54:24 PM | Registered: C:\WINDOWS\system32\netman.dll
6:54:24 PM | Registered: C:\WINDOWS\system32\netshell.dll
6:54:24 PM | Registered: C:\WINDOWS\system32\ntmsevt.dll
6:54:24 PM | Registered: C:\WINDOWS\system32\ntmsmgr.dll
6:54:25 PM | DllInstalled: C:\WINDOWS\system32\ntmssvc.dll
6:54:25 PM | Registered: C:\WINDOWS\system32\ntmssvc.dll
6:54:25 PM | DllInstalled: C:\WINDOWS\system32\occache.dll
6:54:25 PM | Registered: C:\WINDOWS\system32\occache.dll
6:54:25 PM | Registered: C:\WINDOWS\system32\ole32.dll
6:54:25 PM | Registered: C:\WINDOWS\system32\oleaut32.dll
6:54:25 PM | Registered: C:\WINDOWS\system32\oleacc.dll
6:54:25 PM | Registered: C:\WINDOWS\system32\olepro32.dll
6:54:25 PM | DllInstalled: C:\WINDOWS\system32\photowiz.dll
6:54:25 PM | Registered: C:\WINDOWS\system32\photowiz.dll
6:54:26 PM | Registered: C:\WINDOWS\system32\remotepg.dll
6:54:26 PM | Registered: C:\WINDOWS\system32\rpcrt4.dll
6:54:26 PM | Registered: C:\WINDOWS\system32\rshx32.dll
6:54:26 PM | Registered: C:\WINDOWS\system32\sendmail.dll
6:54:26 PM | Registered: C:\WINDOWS\system32\slayerxp.dll
6:54:26 PM | Registered: C:\WINDOWS\system32\shell32.dll
6:54:36 PM | DllInstalled: C:\WINDOWS\system32\shell32.dll
6:54:37 PM | Registered: C:\WINDOWS\system32\shmedia.dll
6:54:37 PM | DllInstalled: C:\WINDOWS\system32\shimgvw.dll
6:54:37 PM | Registered: C:\WINDOWS\system32\shimgvw.dll
6:54:38 PM | DllInstalled: C:\WINDOWS\system32\shsvcs.dll
6:54:38 PM | Registered: C:\WINDOWS\system32\shsvcs.dll
6:54:38 PM | Registered: C:\WINDOWS\system32\srclient.dll
6:54:38 PM | Unregistered: C:\WINDOWS\system32\stobject.dll
6:54:38 PM | Registered: C:\WINDOWS\system32\stobject.dll
6:54:39 PM | Registered: C:\WINDOWS\system32\twext.dll
6:54:39 PM | DllInstalled: C:\WINDOWS\system32\urlmon.dll
6:54:39 PM | Registered: C:\WINDOWS\system32\urlmon.dll
6:54:39 PM | Registered: C:\WINDOWS\system32\userenv.dll
6:54:39 PM | Registered: C:\WINDOWS\system32\winhttp.dll
6:54:39 PM | DllInstalled: C:\WINDOWS\system32\wininet.dll
6:54:40 PM | Registered: C:\WINDOWS\system32\zipfldr.dll
6:54:40 PM | Registered: C:\Program Files\Common Files\system\Ole DB\msdadc.dll
6:54:40 PM | Registered: C:\Program Files\Common Files\system\Ole DB\msdaenum.dll
6:54:40 PM | Registered: C:\Program Files\Common Files\system\Ole DB\msdaer.dll
6:54:41 PM | Registered: C:\Program Files\Common Files\system\Ole DB\msdaipp.dll
6:54:41 PM | Registered: C:\Program Files\Common Files\system\Ole DB\msdaora.dll
6:54:42 PM | Registered: C:\Program Files\Common Files\system\Ole DB\msdaosp.dll
6:54:42 PM | Registered: C:\Program Files\Common Files\system\Ole DB\msdaps.dll
6:54:42 PM | Registered: C:\Program Files\Common Files\system\Ole DB\msdasc.dll
6:54:42 PM | Registered: C:\Program Files\Common Files\system\Ole DB\msdasql.dll
6:54:42 PM | Registered: C:\Program Files\Common Files\system\Ole DB\msdatt.dll
6:54:42 PM | Registered: C:\Program Files\Common Files\system\Ole DB\msdaurl.dll
6:54:42 PM | Registered: C:\Program Files\Common Files\system\Ole DB\msxactps.dll
6:54:43 PM | Registered: C:\Program Files\Common Files\system\Ole DB\oledb32.dll
6:54:43 PM | Registered: C:\Program Files\Common Files\system\Ole DB\oledb32r.dll
6:54:43 PM | Registered: C:\Program Files\Common Files\system\Ole DB\sqloledb.dll
6:54:43 PM | Registered: C:\Program Files\Common Files\system\Ole DB\sqlxmlx.dll





SmitFraudFix v2.418

Scan done at 18:59:13.18, Tue 06/02/2009
Run from C:\Documents and Settings\Dan\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» Process


»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Dan


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\TEMP


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Dan\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Start Menu


»»»»»»»»»»»»»»»»»»»»»»»»


»»»»»»»»»»»»»»»»»»»»»»»» Desktop


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files


»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys


»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components



»»»»»»»»»»»»»»»»»»»»»»»» o4Patch
!!!Attention, following keys are not inevitably infected!!!

o4Patch
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, following keys are not inevitably infected!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» Agent.OMZ.Fix
!!!Attention, following keys are not inevitably infected!!!

Agent.OMZ.Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, following keys are not inevitably infected!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, following keys are not inevitably infected!!!

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"

»»»»»»»»»»»»»»»»»»»»»»»» RK

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""




»»»»»»»»»»»»»»»»»»»»»»»» DNS



»»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection


»»»»»»»»»»»»»»»»»»»»»»»» End



~~~~~~~~~~~
What's the next step friend?

Tomk,

Here's the gmer scan log.

That did not transfer well at all from notes. I guess you'll just copy/paste in notes to read it better.

How do you track down and eliminate the hidden processes the scan found?

Thanks.

GMER 1.0.15.14972 - http://www.gmer.net
Rootkit scan 2009-06-03 21:40:56
Windows 5.1.2600 Service Pack 3


—- System - GMER 1.0.15 —-

SSDT IPVNMon.sys (IPVNMon/Visual Networks) ZwDeviceIoControlFile [0xF72C9803]

—- Kernel IAT/EAT - GMER 1.0.15 —-

IAT \SystemRoot\System32\DRIVERS\rasl2tp.sys[NDIS.SYS!NdisMSetAttributesEx] [F72C9744] IPVNMon.sys (IPVNMon/Visual Networks)
IAT \SystemRoot\System32\DRIVERS\rasl2tp.sys[NDIS.SYS!NdisMRegisterMiniport] [F72C951E] IPVNMon.sys (IPVNMon/Visual Networks)
IAT \SystemRoot\System32\DRIVERS\ndiswan.sys[NDIS.SYS!NdisCloseAdapter] [F72C971A] IPVNMon.sys (IPVNMon/Visual Networks)
IAT \SystemRoot\System32\DRIVERS\ndiswan.sys[NDIS.SYS!NdisOpenAdapter] [F72C96A7] IPVNMon.sys (IPVNMon/Visual Networks)
IAT \SystemRoot\System32\DRIVERS\ndiswan.sys[NDIS.SYS!NdisMSetAttributesEx] [F72C9744] IPVNMon.sys (IPVNMon/Visual Networks)
IAT \SystemRoot\System32\DRIVERS\ndiswan.sys[NDIS.SYS!NdisRegisterProtocol] [F72C9380] IPVNMon.sys (IPVNMon/Visual Networks)
IAT \SystemRoot\System32\DRIVERS\ndiswan.sys[NDIS.SYS!NdisMRegisterMiniport] [F72C951E] IPVNMon.sys (IPVNMon/Visual Networks)
IAT \SystemRoot\System32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisRegisterProtocol] [F72C9380] IPVNMon.sys (IPVNMon/Visual Networks)
IAT \SystemRoot\System32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisOpenAdapter] [F72C96A7] IPVNMon.sys (IPVNMon/Visual Networks)
IAT \SystemRoot\System32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisCloseAdapter] [F72C971A] IPVNMon.sys (IPVNMon/Visual Networks)
IAT \SystemRoot\System32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisMSetAttributesEx] [F72C9744] IPVNMon.sys (IPVNMon/Visual Networks)
IAT \SystemRoot\System32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisMRegisterMiniport] [F72C951E] IPVNMon.sys (IPVNMon/Visual Networks)
IAT \SystemRoot\System32\DRIVERS\raspptp.sys[NDIS.SYS!NdisMSetAttributesEx] [F72C9744] IPVNMon.sys (IPVNMon/Visual Networks)
IAT \SystemRoot\System32\DRIVERS\raspptp.sys[NDIS.SYS!NdisMRegisterMiniport] [F72C951E] IPVNMon.sys (IPVNMon/Visual Networks)
IAT \SystemRoot\System32\DRIVERS\psched.sys[NDIS.SYS!NdisIMRegisterLayeredMiniport] [F72C948B] IPVNMon.sys (IPVNMon/Visual Networks)
IAT \SystemRoot\System32\DRIVERS\psched.sys[NDIS.SYS!NdisRegisterProtocol] [F72C9380] IPVNMon.sys (IPVNMon/Visual Networks)
IAT \SystemRoot\System32\DRIVERS\psched.sys[NDIS.SYS!NdisOpenAdapter] [F72C96A7] IPVNMon.sys (IPVNMon/Visual Networks)
IAT \SystemRoot\System32\DRIVERS\psched.sys[NDIS.SYS!NdisMSetAttributesEx] [F72C9744] IPVNMon.sys (IPVNMon/Visual Networks)
IAT \SystemRoot\System32\DRIVERS\psched.sys[NDIS.SYS!NdisCloseAdapter] [F72C971A] IPVNMon.sys (IPVNMon/Visual Networks)
IAT \SystemRoot\System32\DRIVERS\raspti.sys[NDIS.SYS!NdisMSetAttributesEx] [F72C9744] IPVNMon.sys (IPVNMon/Visual Networks)
IAT \SystemRoot\System32\DRIVERS\raspti.sys[NDIS.SYS!NdisMRegisterMiniport] [F72C951E] IPVNMon.sys (IPVNMon/Visual Networks)
IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisRegisterProtocol] [F72C9380] IPVNMon.sys (IPVNMon/Visual Networks)
IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisCloseAdapter] [F72C971A] IPVNMon.sys (IPVNMon/Visual Networks)
IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisOpenAdapter] [F72C96A7] IPVNMon.sys (IPVNMon/Visual Networks)
IAT \SystemRoot\System32\DRIVERS\tcpip.sys[NDIS.SYS!NdisCloseAdapter] [F72C971A] IPVNMon.sys (IPVNMon/Visual Networks)
IAT \SystemRoot\System32\DRIVERS\tcpip.sys[NDIS.SYS!NdisOpenAdapter] [F72C96A7] IPVNMon.sys (IPVNMon/Visual Networks)
IAT \SystemRoot\System32\DRIVERS\tcpip.sys[NDIS.SYS!NdisRegisterProtocol] [F72C9380] IPVNMon.sys (IPVNMon/Visual Networks)
IAT \SystemRoot\System32\DRIVERS\wanarp.sys[NDIS.SYS!NdisRegisterProtocol] [F72C9380] IPVNMon.sys (IPVNMon/Visual Networks)
IAT \SystemRoot\System32\DRIVERS\wanarp.sys[NDIS.SYS!NdisOpenAdapter] [F72C96A7] IPVNMon.sys (IPVNMon/Visual Networks)
IAT \SystemRoot\System32\DRIVERS\wanarp.sys[NDIS.SYS!NdisCloseAdapter] [F72C971A] IPVNMon.sys (IPVNMon/Visual Networks)

—- User IAT/EAT - GMER 1.0.15 —-

IAT C:\WINDOWS\Explorer.EXE[2644] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [00C32F30] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\WINDOWS\Explorer.EXE[2644] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [00C32CA0] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\WINDOWS\Explorer.EXE[2644] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [00C32D00] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\WINDOWS\Explorer.EXE[2644] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [00C32CD0] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Borland\Interbase\Bin\IBServer.exe[2724] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [003D2F30] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Borland\Interbase\Bin\IBServer.exe[2724] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [003D2CA0] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Borland\Interbase\Bin\IBServer.exe[2724] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [003D2D00] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Borland\Interbase\Bin\IBServer.exe[2724] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [003D2CD0] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\WINDOWS\system32\ctfmon.exe[6544] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [00512F30] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\WINDOWS\system32\ctfmon.exe[6544] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [00512CA0] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\WINDOWS\system32\ctfmon.exe[6544] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [00512D00] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\WINDOWS\system32\ctfmon.exe[6544] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [00512CD0] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Documents and Settings\Dan\Desktop\gmer.exe[67448] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [003B2F30] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Documents and Settings\Dan\Desktop\gmer.exe[67448] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [003B2CA0] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Documents and Settings\Dan\Desktop\gmer.exe[67448] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [003B2D00] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Documents and Settings\Dan\Desktop\gmer.exe[67448] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [003B2CD0] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)

—- Devices - GMER 1.0.15 —-

AttachedDevice \FileSystem\Ntfs \Ntfs VET-FILT.SYS (CA Antivirus File Protection Driver/Computer Associates International, Inc.)
AttachedDevice \FileSystem\Ntfs \Ntfs VET-REC.SYS (CA Antivirus File Protection Driver/Computer Associates International, Inc.)
AttachedDevice \Driver\Tcpip \Device\Ip avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \FileSystem\Fastfat \Fat VET-FILT.SYS (CA Antivirus File Protection Driver/Computer Associates International, Inc.)
AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

Device \FileSystem\Fs_Rec \FileSystem\UdfsCdRomRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Fs_Rec \FileSystem\CdfsRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Fs_Rec \FileSystem\FatCdRomRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Fs_Rec \FileSystem\FatDiskRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Fs_Rec \FileSystem\UdfsDiskRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Cdfs \Cdfs tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)

—- Processes - GMER 1.0.15 —-

Process hidden process (*** hidden *** ) 1296
Process hidden process (*** hidden *** ) 1912

—- EOF - GMER 1.0.15 —-

Hi TomK,

After all these steps I am starting to think the Trojan is winning / has won. Is my comp fixable? I am trying to hold on to hope that it can be.

I ran avenger but I do not know if it ran correctly (or user error). I did these steps;

[*]Download The Avenger by Swandog46 from here.

[*]Unzip/extract it to a folder on your desktop.

[*]Double click on avenger.exe to run The Avenger.

[*]Click OK.

[*]Make sure that both the box next to Scan for rootkits and the box next to Automatically disable any rootkits found both have ticks in them.

[*]Click the Execute button.

[*]You will be asked No script has been entered. Do you want to execute a rootkit scan only?.

[*]Click Yes.

[*]You will now be asked First step completed — The Avenger has been successfully set up to run on next boot. Reboot now?.

[*]Click Yes.

[*]Your PC will now be rebooted.

When the comp rebooted I clicked on my profile, windows started, and that 'new hardware found' windows pops up every time i reboot, even though there is no new hardware.

It didn't look like anything ran, i expected some type of window to launch, i waited a couple mins and then closed the 'new hardware' window and found the avenger's log on the C drive. It did not ask to reboot. Log said there was no problems.

When I was in the C drive folder I noted a few new program icons. I scanned one with MBAM and it came back as malware. I closed MBAM and scanned all three and it said there were two malware strings, so i deleted them. It asked to reboot, i did, looked at C drive, two of the three program icons were still there.

One shared the same name as the one that was deleted, cleanup.exe, so i deleted it, and the other just named .zip'.

For giggles I looked at the avenger log again and it had more data in it saying it was looking for cleanup.exe to delete but couldn't find it.

Why did it avenger not reboot a second time by itself or say there were problems and ask for a reboot before MBAM found them, cleaned them, and asked for a reboot?

Well, here are all the logs.

Here's the MBAM log, this is the first where i just did the scan, I must not have saved the log when I fixed the problems, but it's the same bug.

Malwarebytes' Anti-Malware 1.36
Database version: 1945
Windows 5.1.2600 Service Pack 3

6/4/2009 6:51:05 PM
mbam-log-2009-06-04 (18-50-48).txt

Scan type: Quick Scan
Objects scanned: 1
Time elapsed: 4 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\cleanup (Adware.Cinmus) -> No action taken.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
c:\cleanup.exe (Adware.Cinmus) -> No action taken.



Logfile of The Avenger Version 2.0, © by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!


Completed script processing.

*******************

Finished! Terminate.





Logfile of The Avenger Version 2.0, © by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:


Error: file "c:\cleanup.exe" not found!
Deletion of file "c:\cleanup.exe" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
–> the object does not exist


Error: file "c:\cleanup.exe" not found!
Deletion of file "c:\cleanup.exe" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
–> the object does not exist


Completed script processing.

*******************

Finished! Terminate.





Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:49:07 PM, on 6/4/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\PROGRA~1\AVG\AVG8\avgfws8.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Borland\Interbase\Bin\IBGuard.exe
C:\PROGRA~1\AVG\AVG8\avgam.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\Program Files\Nikon\Wireless Camera Setup Utility\NkPtpEnum.exe
C:\PROGRA~1\Dantz\RETROS~1\retrorun.exe
C:\PROGRA~1\Dantz\RETROS~1\wdsvc.exe
C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\AVG\AVG8\avgui.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\Program Files\Borland\Interbase\Bin\IBServer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Comcast Toolbar - {4E7BD74F-2B8D-469E-93BE-BE2DF4D9AE29} - C:\PROGRA~1\COMCAS~2\COMCAS~1.DLL
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: AVGTOOLBAR - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: AVGTOOLBAR - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O3 - Toolbar: Comcast Toolbar - {4E7BD74F-2B8D-469E-93BE-BE2DF4D9AE29} - C:\PROGRA~1\COMCAS~2\COMCAS~1.DLL
O4 - HKLM\..\Run: [Dell AIO Printer A940] "C:\Program Files\Dell AIO Printer A940\dlbabmgr.exe"
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [itype] "C:\Program Files\Microsoft IntelliType Pro\itype.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [ddoctorv2] "C:\Program Files\Comcast\Desktop Doctor\bin\sprtcmd.exe" /P ddoctorv2
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKLM\..\RunOnce: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - Global Startup: Digital Line Detect.lnk.disabled
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: AVG8 Firewall (avgfws8) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgfws8.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InterBase Guardian (InterBaseGuardian) - Inprise Corporation - C:\Program Files\Borland\Interbase\Bin\IBGuard.exe
O23 - Service: InterBase Server (InterBaseServer) - Inprise Corporation - C:\Program Files\Borland\Interbase\Bin\IBServer.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: NkPtpEnumP2 - Nikon Corporation - C:\Program Files\Nikon\Wireless Camera Setup Utility\NkPtpEnum.exe
O23 - Service: Retrospect Launcher (RetroLauncher) - Dantz Development Corporation - C:\PROGRA~1\Dantz\RETROS~1\retrorun.exe
O23 - Service: Retrospect WD Service (RetroWDSvc) - Dantz Development Corporation - C:\PROGRA~1\Dantz\RETROS~1\wdsvc.exe
O23 - Service: SupportSoft Sprocket Service (ddoctorv2) (sprtsvc_ddoctorv2) - SupportSoft, Inc. - C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe
O23 - Service: VET Message Service (VETMSGNT) - Unknown owner - C:\Program Files\Yahoo!\Antivirus\VetMsg.exe (file missing)
O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\system32\YPCSER~1.EXE

–
End of file - 8540 bytes

Cheers!

Hi TomK


I decided to run a regular comboFix scan and post the log to see if that helps. It does have the section at the start where it lists the previous run's deletions. I bolded one entry b/c I was curious if it was part of the problem since it has to do with the favorites menu. ANother thing I thought I should mention is IE is almost worthless, I can't download any programs and now it won't load the WTT website. I use FireFox for everything b/c it works fine.

Thanks~


ComboFix 09-06-05.07 - Dan 06/05/2009 21:55.6 - NTFSx86
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
.
The following files were disabled during the run:
c:\program files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
—- Previous Run ——-
.
c:\windows\system32\drivers\Msft_Kernel_NuidFltr_01005.Wdf
c:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
c:\windows\system32\tmp.reg

.
((((((((((((((((((((((((( Files Created from 2009-05-06 to 2009-06-06 )))))))))))))))))))))))))))))))
.

2009-06-02 23:51 . 2009-06-06 02:54 ——– d—–w- c:\windows\system32\CatRoot2
2009-05-27 10:46 . 2009-05-27 10:46 ——– d—–w- c:\documents and settings\All Users\Application Data\Comcast
2009-05-24 20:29 . 2009-04-06 20:32 15504 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-05-24 20:29 . 2009-04-06 20:32 38496 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-05-24 20:29 . 2009-05-24 20:31 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2009-05-20 01:58 . 2009-05-20 02:02 ——– d—–w- C:\Rooter$
2009-05-19 03:38 . 2009-05-19 03:38 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-05-19 03:19 . 2009-05-19 03:19 ——– d—–w- c:\program files\ERUNT
2009-05-17 00:39 . 2009-05-17 17:52 ——– d—–w- c:\program files\SpywareBlaster
2009-05-12 22:05 . 2009-05-12 22:08 ——– d—–w- c:\documents and settings\Angelina\Application Data\COMCASTTOOLBAR
2009-05-12 22:00 . 2009-05-12 22:00 ——– d—–w- c:\documents and settings\Angelina\Local Settings\Application Data\SupportSoft
2009-05-12 21:35 . 2009-05-12 21:33 2051864 —-a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgcorex.dll
2009-05-09 13:22 . 2009-05-09 13:22 ——– d—–w- c:\program files\ComcastToolbar
2009-05-09 13:21 . 2009-05-09 13:21 ——– d—–w- c:\documents and settings\All Users\Application Data\SupportSoft
2009-05-09 13:20 . 2009-05-09 13:20 ——– d—–w- c:\program files\Comcast

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-12 22:24 . 2008-04-29 23:53 72280 —-a-w- c:\documents and settings\Dan\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-05-09 13:22 . 2006-01-05 16:50 ——– d—–w- c:\program files\Common Files\Scanner
2009-05-09 13:20 . 2008-09-28 20:04 ——– d—–w- c:\program files\Common Files\SupportSoft
2009-05-09 13:19 . 2008-09-28 20:04 ——– d—–w- c:\program files\support.com
2009-05-05 14:02 . 2008-10-08 15:26 ——– d—–w- c:\documents and settings\Angelina\Application Data\AVGTOOLBAR
2009-04-25 00:16 . 2009-04-25 00:16 ——– d—–w- c:\program files\Microsoft IntelliPoint
2009-04-25 00:15 . 2009-04-25 00:15 ——– d—–w- c:\program files\Microsoft IntelliType Pro
2009-04-23 13:15 . 2008-04-29 12:14 11952 —-a-w- c:\windows\system32\avgrsstx.dll
2009-04-23 13:15 . 2007-10-15 23:16 27784 —-a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-04-23 13:15 . 2008-04-29 12:14 325896 —-a-w- c:\windows\system32\drivers\avgldx86.sys
2009-04-23 13:15 . 2008-04-29 12:11 29208 —-a-w- c:\windows\system32\drivers\avgfwdx.sys
2009-04-23 13:15 . 2008-04-29 12:11 50968 —-a-w- c:\windows\system32\avgfwdx.dll
2009-04-23 13:15 . 2008-04-29 12:14 12552 —-a-w- c:\windows\system32\drivers\avgrkx86.sys
2009-04-23 13:14 . 2008-04-29 12:14 108552 —-a-w- c:\windows\system32\drivers\avgtdix.sys
2009-04-12 00:58 . 2009-04-12 00:57 ——– d—–w- c:\program files\iTunes
2009-04-12 00:58 . 2009-04-12 00:57 ——– d—–w- c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-04-12 00:57 . 2009-04-12 00:57 ——– d—–w- c:\program files\iPod
2009-04-12 00:57 . 2008-01-02 03:36 ——– d—–w- c:\program files\Common Files\Apple
2009-04-12 00:49 . 2009-04-12 00:49 75048 —-a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 8.1.1.10\SetupAdmin.exe
2009-04-11 15:14 . 2007-10-15 23:41 ——– d—–w- c:\program files\Spybot - Search & Destroy
2009-03-19 21:32 . 2009-03-19 21:32 23400 —-a-w- c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}\x86\x86\GEARAspiWDM.sys
2009-03-19 21:32 . 2008-01-29 17:01 23400 —-a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
.

——- Sigcheck ——-

[-] 2005-05-25 19:04 359808 88763A98A4C26C409741B4AA162720C9 c:\windows\$hf_mig$\KB893066\SP2GDR\tcpip.sys
[-] 2005-05-25 19:07 359936 63FDFEA54EB53DE2D863EE454937CE1E c:\windows\$hf_mig$\KB893066\SP2QFE\tcpip.sys
[-] 2006-01-13 17:07 360448 5562CC0A47B2AEF06D3417B733F3C195 c:\windows\$hf_mig$\KB913446\SP2QFE\tcpip.sys
[-] 2006-04-20 12:18 360576 B2220C618B42A2212A59D91EBD6FC4B4 c:\windows\$hf_mig$\KB917953\SP2QFE\tcpip.sys
[-] 2007-10-30 16:53 360832 64798ECFA43D78C7178375FCDD16D8C8 c:\windows\$hf_mig$\KB941644\SP2QFE\tcpip.sys
[7] 2008-06-20 10:44 360960 744E57C99232201AE98C49168B918F48 c:\windows\$hf_mig$\KB951748\SP2QFE\tcpip.sys
[7] 2008-06-20 11:51 361600 9AEFA14BD6B182D61E3119FA5F436D3D c:\windows\$hf_mig$\KB951748\SP3GDR\tcpip.sys
[7] 2008-06-20 11:59 361600 AD978A1B783B5719720CFF204B666C8E c:\windows\$hf_mig$\KB951748\SP3QFE\tcpip.sys
[7] 2008-06-20 10:45 360320 2A5554FC5B1E04E131230E3CE035C3F9 c:\windows\$NtServicePackUninstall$\tcpip.sys
[7] 2004-08-04 06:14 359040 9F4B36614A0FC234525BA224957DE55C c:\windows\$NtUninstallKB893066$\tcpip.sys
[-] 2003-07-16 20:47 332928 244A2F9816BC9B593957281EF577D976 c:\windows\$NtUninstallKB893066_0$\tcpip.sys
[-] 2005-05-25 19:04 359808 88763A98A4C26C409741B4AA162720C9 c:\windows\$NtUninstallKB913446$\tcpip.sys
[-] 2006-01-13 02:28 359808 583E063FDC888CA30D05C2724B0D7EF4 c:\windows\$NtUninstallKB917953$\tcpip.sys
[-] 2006-04-20 11:51 359808 1DBF125862891817F374F407626967F4 c:\windows\$NtUninstallKB941644$\tcpip.sys
[7] 2008-04-13 19:20 361344 93EA8D04EC73A85DB02EB8805988F733 c:\windows\$NtUninstallKB951748$\tcpip.sys
[-] 2007-10-30 17:20 360064 90CAFF4B094573449A0872A0F919B178 c:\windows\$NtUninstallKB951748_0$\tcpip.sys
[-] 2008-04-13 19:20 361344 ACCF5A9A1FFAA490F33DBA1C632B95E1 c:\windows\ServicePackFiles\i386\tcpip.sys
[-] 2008-06-20 11:51 361600 9425B72F40257B45D45D24773273DAD0 c:\windows\system32\dllcache\tcpip.sys
[-] 2008-06-20 11:51 361600 9425B72F40257B45D45D24773273DAD0 c:\windows\system32\drivers\tcpip.sys
.
((((((((((((((((((((((((((((( SnapShot@2009-05-21_01.42.42 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-06-06 02:08 . 2009-06-06 02:08 16384 c:\windows\Temp\Perflib_Perfdata_21c.dat
+ 2009-06-06 03:02 . 2009-06-06 03:02 53248 c:\windows\Temp\catchme.dll
- 2009-05-21 01:42 . 2009-05-21 01:42 53248 c:\windows\Temp\catchme.dll
+ 2009-06-02 23:54 . 2009-06-02 23:54 102412 c:\windows\system32\config\systemprofile\Application Data\Microsoft\MSDAIPP\Offline\HashFile.dat
+ 2004-08-04 07:56 . 2004-08-04 04:07 286208 c:\windows\ServicePackFiles\i386\blackbox.dll
- 2004-08-04 07:56 . 2004-08-04 07:56 286208 c:\windows\ServicePackFiles\i386\blackbox.dll
+ 2007-04-19 19:21 . 2007-04-19 19:21 202280 c:\windows\Installer\$PatchCache$\Managed\3B94178DD1A78454C9FB30B297E19580\2.5.2\sprtsvc.exe
+ 2007-04-20 14:11 . 2007-04-20 14:11 992808 c:\windows\Installer\$PatchCache$\Managed\3B94178DD1A78454C9FB30B297E19580\2.5.2\bcont.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Dell AIO Printer A940"="c:\program files\Dell AIO Printer A940\dlbabmgr.exe" [2003-06-25 294998]
"Microsoft Works Update Detection"="c:\program files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" [2003-06-07 50688]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-04-23 1947928]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-02-06 177472]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-04-02 342312]
"itype"="c:\program files\Microsoft IntelliType Pro\itype.exe" [2008-06-10 1442888]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2008-06-10 1406024]
"ddoctorv2"="c:\program files\Comcast\Desktop Doctor\bin\sprtcmd.exe" [2008-04-24 202560]
"LogitechCommunicationsManager"="c:\program files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2007-10-25 563984]
"LogitechQuickCamRibbon"="c:\program files\Logitech\QuickCam\Quickcam.exe" [2007-10-25 2178832]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"GrpConv"="grpconv -o" [X]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSimpleStartMenu"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-04-23 13:15 11952 —-a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AVG Anti-Spyware Driver]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AVG Anti-Spyware Guard]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys]
@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"UleadBurningHelper"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"YOP"=c:\progra~1\Yahoo!\YOP\yop.exe /autostart
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" -atboottime
"LogitechQuickCamRibbon"="c:\program files\Logitech\QuickCam\Quickcam.exe" /hide
"diagent"="c:\program files\Creative\SBLive\Diagnostics\diagent.exe" startup

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Yahoo!\\Messenger\\yserver.exe"= c:\\Program Files\\Yahoo!\\Messenger\\yserver.exe
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\LEXPPS.EXE"=
"c:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Civilization4.exe"=
"c:\\Program Files\\Activision\\Star Trek Armada II\\Armada2.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Beyond the Sword\\Civ4BeyondSword.exe"=
"c:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Beyond the Sword\\Civ4BeyondSword_PitBoss.exe"=
"c:\\Program Files\\Raven\\Star Trek Voyager Elite Force\\stvoyHM.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

R1 bcbus;BestCrypt bus driver;c:\windows\system32\DRIVERS\bcbus.sys [x]
R3 Avgfwfd;AVG network filter service;c:\windows\system32\DRIVERS\avgfwdx.sys [2009-04-23 29208]
S0 AvgRkx86;avgrkx86.sys;c:\windows\System32\Drivers\avgrkx86.sys [2009-04-23 12552]
S1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\System32\Drivers\avgldx86.sys [2009-04-23 325896]
S1 AvgTdiX;AVG8 Network Redirector;c:\windows\System32\Drivers\avgtdix.sys [2009-04-23 108552]
S2 avg8emc;AVG8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2009-04-23 908568]
S2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-04-23 298776]
S2 avgfws8;AVG8 Firewall;c:\progra~1\AVG\AVG8\avgfws8.exe [2009-04-23 1366904]
S2 NkPtpEnumP2;NkPtpEnumP2;c:\program files\Nikon\Wireless Camera Setup Utility\NkPtpEnum.exe [2005-06-17 24064]
S3 Avgfwdx;Avgfwdx;c:\windows\system32\DRIVERS\avgfwdx.sys [2009-04-23 29208]
S3 VBus;Virtual Bus;c:\windows\system32\DRIVERS\NkVBus.sys [2005-06-17 17664]


— Other Services/Drivers In Memory —

*Deregistered* - AFD
*Deregistered* - ALG
*Deregistered* - Apple Mobile Device
*Deregistered* - Ati HotKey Poller
*Deregistered* - ATI Smart
*Deregistered* - AudioSrv
*Deregistered* - avg8emc
*Deregistered* - avg8wd
*Deregistered* - Avgfwdx
*Deregistered* - avgfws8
*Deregistered* - AvgLdx86
*Deregistered* - AvgMfx86
*Deregistered* - AvgRkx86
*Deregistered* - AvgTdiX
*Deregistered* - Beep
*Deregistered* - BITS
*Deregistered* - Bonjour Service
*Deregistered* - Browser
*Deregistered* - Cdfs
*Deregistered* - Creative Service for CDROM Access
*Deregistered* - CryptSvc
*Deregistered* - ctsfm2k
*Deregistered* - DcomLaunch
*Deregistered* - Dhcp
*Deregistered* - Dnscache
*Deregistered* - drvnddm
*Deregistered* - ERSvc
*Deregistered* - EventSystem
*Deregistered* - FastUserSwitchingCompatibility
*Deregistered* - Fips
*Deregistered* - FltMgr
*Deregistered* - Ftdisk
*Deregistered* - Gpc
*Deregistered* - helpsvc
*Deregistered* - HidServ
*Deregistered* - HTTP
*Deregistered* - HTTPFilter
*Deregistered* - ImapiService
*Deregistered* - InterBaseGuardian
*Deregistered* - InterBaseServer
*Deregistered* - IpNat
*Deregistered* - IPSec
*Deregistered* - IPVNMon
*Deregistered* - JavaQuickStarterService
*Deregistered* - Kbdclass
*Deregistered* - KSecDD
*Deregistered* - lanmanserver
*Deregistered* - lanmanworkstation
*Deregistered* - LexBceS
*Deregistered* - LmHosts
*Deregistered* - LVCOMSer
*Deregistered* - LVPr2Mon
*Deregistered* - LVPrcSrv
*Deregistered* - LVSrvLauncher
*Deregistered* - LVUSBSta
*Deregistered* - MDC8021X
*Deregistered* - mdmxsdk
*Deregistered* - mnmdd
*Deregistered* - Mouclass
*Deregistered* - MountMgr
*Deregistered* - MRxDAV
*Deregistered* - MRxSmb
*Deregistered* - Msfs
*Deregistered* - mssmbios
*Deregistered* - Mup
*Deregistered* - NDIS
*Deregistered* - NdisTapi
*Deregistered* - NdisWan
*Deregistered* - NDProxy
*Deregistered* - NetBIOS
*Deregistered* - NetBT
*Deregistered* - Netman
*Deregistered* - NkPtpEnumP2
*Deregistered* - Nla
*Deregistered* - Npfs
*Deregistered* - Ntfs
*Deregistered* - Null
*Deregistered* - OMCI
*Deregistered* - ossrv
*Deregistered* - PartMgr
*Deregistered* - ParVdm
*Deregistered* - PfModNT
*Deregistered* - PolicyAgent
*Deregistered* - PptpMiniport
*Deregistered* - ProtectedStorage
*Deregistered* - PSched
*Deregistered* - RasAcd
*Deregistered* - Rasl2tp
*Deregistered* - RasMan
*Deregistered* - RasPppoe
*Deregistered* - Raspti
*Deregistered* - Rdbss
*Deregistered* - RDPCDD
*Deregistered* - RetroLauncher
*Deregistered* - RetroWDSvc
*Deregistered* - RpcSs
*Deregistered* - SamSs
*Deregistered* - Schedule
*Deregistered* - Secdrv
*Deregistered* - seclogon
*Deregistered* - SENS
*Deregistered* - SharedAccess
*Deregistered* - ShellHWDetection
*Deregistered* - Spooler
*Deregistered* - sprtsvc_ddoctorv2
*Deregistered* - sr
*Deregistered* - srservice
*Deregistered* - Srv
*Deregistered* - SSDPSRV
*Deregistered* - ssrtln
*Deregistered* - stisvc
*Deregistered* - swenum
*Deregistered* - TapiSrv
*Deregistered* - Tcpip
*Deregistered* - TermService
*Deregistered* - tfsnboio
*Deregistered* - tfsncofs
*Deregistered* - tfsndrct
*Deregistered* - tfsndres
*Deregistered* - tfsnifs
*Deregistered* - tfsnopio
*Deregistered* - tfsnpool
*Deregistered* - tfsnudf
*Deregistered* - tfsnudfa
*Deregistered* - Themes
*Deregistered* - TrkWks
*Deregistered* - Update
*Deregistered* - upnphost
*Deregistered* - VBus
*Deregistered* - VET-FILT
*Deregistered* - VET-REC
*Deregistered* - VETEBOOT
*Deregistered* - VETEFILE
*Deregistered* - VETMONNT
*Deregistered* - VgaSave
*Deregistered* - VolSnap
*Deregistered* - W32Time
*Deregistered* - Wanarp
*Deregistered* - Wdf01000
*Deregistered* - WebClient
*Deregistered* - WinDriver6
*Deregistered* - winmgmt
*Deregistered* - WMDM PMSP Service
*Deregistered* - WMPNetworkSvc
*Deregistered* - wscsvc
*Deregistered* - wuauserv
.
Contents of the 'Scheduled Tasks' folder

2009-05-31 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]

2009-06-06 c:\windows\Tasks\RegCure Program Check.job
- c:\program files\RegCure\RegCure.exe [2008-04-21 21:21]

2009-06-05 c:\windows\Tasks\RegCure.job
- c:\program files\RegCure\RegCure.exe [2008-04-21 21:21]
.
- - - - ORPHANS REMOVED - - - -

HKLM-RunOnce- - (no file)


.
——- Supplementary Scan ——-
.
mWindow Title = Windows Internet Explorer provided by Comcast
LSP: c:\windows\System32\VetRedir.dll
FF - ProfilePath - c:\docume~1\Dan\APPLIC~1\Mozilla\Firefox\Profiles\75p2ovg1.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie;=UTF-8&oe;=UTF-8&q;=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.chicagobears.com
FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
FF - component: c:\program files\AVG\AVG8\ToolbarFF\components\vmAVGConnector.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-05 22:02
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(928)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'lsass.exe'(984)
c:\windows\System32\VetRedir.dll
c:\windows\system32\ISafeIf.dll

- - - - - - - > 'explorer.exe'(7808)
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\System32\VetRedir.dll
c:\windows\system32\ISafeIf.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2009-06-06 22:06
ComboFix-quarantined-files.txt 2009-06-06 03:05
ComboFix2.txt 2009-05-23 19:52
ComboFix3.txt 2009-05-21 01:46

Pre-Run: 44,631,019,520 bytes free
Post-Run: 44,619,116,544 bytes free

354 — E O F — 2009-05-14 01:50

Hey TomK,

I noticed my AVG scanner picked up a few new things I had not seen before. I feel like my computer is the local 2 dollar hooker on the corner, she picks up everything.

It said they were rootkits, deleted them, and needed a restart to kill them. The next day it picked them up again. The were;
c\windows\sys32\drivers\skynet\jsprhhid.sys
" chufykqk.dll
" tesssrwee.dll
" lfvwedm.dax

After the second time it tried to kill them the third scan still picked them up so I decided to run conbofix to see what it would do with them. Combo picked them up right away, and said it neeeded to reboot to kill them. I rebooted and started combo again. It looked like it was goning to do a full scan this time so I went and did other things. When I came back it was in the process of rebooting the comp again. For whatever reason it never produces a log when it reboots. So i tried running it again and it started to create a log from the last scan. It said;

Preparing log report
C\Combofic\create.cmd
The Batch file cannot be found

Then it closed. So ran it again tring to get it to produce the log file. INstead it did a full scan, did not reboot, and produced this log.

ComboFix 09-06-05.07 - Dan 06/07/2009 12:09.8 - NTFSx86
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
.
The following files were disabled during the run:
c:\program files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
—- Previous Run ——-
.
c:\windows\system32\drivers\SKYNETjsprhhid.sys
c:\windows\system32\SKYNETchufykqk.dll
c:\windows\system32\SKYNETesssrwee.dll
c:\windows\system32\SKYNETlfvwxedm.dat

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Service_SKYNETxiyyoiqq


((((((((((((((((((((((((( Files Created from 2009-05-07 to 2009-06-07 )))))))))))))))))))))))))))))))
.

2009-06-02 23:51 . 2009-06-07 17:08 ——– d—–w- c:\windows\system32\CatRoot2
2009-05-27 10:46 . 2009-05-27 10:46 ——– d—–w- c:\documents and settings\All Users\Application Data\Comcast
2009-05-24 20:29 . 2009-04-06 20:32 15504 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-05-24 20:29 . 2009-04-06 20:32 38496 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-05-24 20:29 . 2009-05-24 20:31 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2009-05-20 01:58 . 2009-05-20 02:02 ——– d—–w- C:\Rooter$
2009-05-19 03:38 . 2009-05-19 03:38 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-05-19 03:19 . 2009-05-19 03:19 ——– d—–w- c:\program files\ERUNT
2009-05-17 00:39 . 2009-05-17 17:52 ——– d—–w- c:\program files\SpywareBlaster
2009-05-12 22:05 . 2009-05-12 22:08 ——– d—–w- c:\documents and settings\Angelina\Application Data\COMCASTTOOLBAR
2009-05-12 22:00 . 2009-05-12 22:00 ——– d—–w- c:\documents and settings\Angelina\Local Settings\Application Data\SupportSoft
2009-05-12 21:35 . 2009-05-12 21:33 2051864 —-a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgcorex.dll
2009-05-09 13:22 . 2009-05-09 13:22 ——– d—–w- c:\program files\ComcastToolbar
2009-05-09 13:21 . 2009-05-09 13:21 ——– d—–w- c:\documents and settings\All Users\Application Data\SupportSoft
2009-05-09 13:20 . 2009-05-09 13:20 ——– d—–w- c:\program files\Comcast

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-07 16:28 . 2008-04-29 12:11 ——– d—–w- c:\documents and settings\All Users\Application Data\avg8
2009-05-12 22:24 . 2008-04-29 23:53 72280 —-a-w- c:\documents and settings\Dan\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-05-09 13:22 . 2006-01-05 16:50 ——– d—–w- c:\program files\Common Files\Scanner
2009-05-09 13:20 . 2008-09-28 20:04 ——– d—–w- c:\program files\Common Files\SupportSoft
2009-05-09 13:19 . 2008-09-28 20:04 ——– d—–w- c:\program files\support.com
2009-05-05 14:02 . 2008-10-08 15:26 ——– d—–w- c:\documents and settings\Angelina\Application Data\AVGTOOLBAR
2009-04-25 00:16 . 2009-04-25 00:16 ——– d—–w- c:\program files\Microsoft IntelliPoint
2009-04-25 00:15 . 2009-04-25 00:15 ——– d—–w- c:\program files\Microsoft IntelliType Pro
2009-04-23 13:15 . 2008-04-29 12:14 11952 —-a-w- c:\windows\system32\avgrsstx.dll
2009-04-23 13:15 . 2007-10-15 23:16 27784 —-a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-04-23 13:15 . 2008-04-29 12:14 325896 —-a-w- c:\windows\system32\drivers\avgldx86.sys
2009-04-23 13:15 . 2008-04-29 12:11 29208 —-a-w- c:\windows\system32\drivers\avgfwdx.sys
2009-04-23 13:15 . 2008-04-29 12:11 50968 —-a-w- c:\windows\system32\avgfwdx.dll
2009-04-23 13:15 . 2008-04-29 12:14 12552 —-a-w- c:\windows\system32\drivers\avgrkx86.sys
2009-04-23 13:14 . 2008-04-29 12:14 108552 —-a-w- c:\windows\system32\drivers\avgtdix.sys
2009-04-12 00:58 . 2009-04-12 00:57 ——– d—–w- c:\program files\iTunes
2009-04-12 00:58 . 2009-04-12 00:57 ——– d—–w- c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-04-12 00:57 . 2009-04-12 00:57 ——– d—–w- c:\program files\iPod
2009-04-12 00:57 . 2008-01-02 03:36 ——– d—–w- c:\program files\Common Files\Apple
2009-04-12 00:49 . 2009-04-12 00:49 75048 —-a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 8.1.1.10\SetupAdmin.exe
2009-04-11 15:14 . 2007-10-15 23:41 ——– d—–w- c:\program files\Spybot - Search & Destroy
2009-03-19 21:32 . 2009-03-19 21:32 23400 —-a-w- c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}\x86\x86\GEARAspiWDM.sys
2009-03-19 21:32 . 2008-01-29 17:01 23400 —-a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
.

——- Sigcheck ——-

[-] 2005-05-25 19:04 359808 88763A98A4C26C409741B4AA162720C9 c:\windows\$hf_mig$\KB893066\SP2GDR\tcpip.sys
[-] 2005-05-25 19:07 359936 63FDFEA54EB53DE2D863EE454937CE1E c:\windows\$hf_mig$\KB893066\SP2QFE\tcpip.sys
[-] 2006-01-13 17:07 360448 5562CC0A47B2AEF06D3417B733F3C195 c:\windows\$hf_mig$\KB913446\SP2QFE\tcpip.sys
[-] 2006-04-20 12:18 360576 B2220C618B42A2212A59D91EBD6FC4B4 c:\windows\$hf_mig$\KB917953\SP2QFE\tcpip.sys
[-] 2007-10-30 16:53 360832 64798ECFA43D78C7178375FCDD16D8C8 c:\windows\$hf_mig$\KB941644\SP2QFE\tcpip.sys
[7] 2008-06-20 10:44 360960 744E57C99232201AE98C49168B918F48 c:\windows\$hf_mig$\KB951748\SP2QFE\tcpip.sys
[7] 2008-06-20 11:51 361600 9AEFA14BD6B182D61E3119FA5F436D3D c:\windows\$hf_mig$\KB951748\SP3GDR\tcpip.sys
[7] 2008-06-20 11:59 361600 AD978A1B783B5719720CFF204B666C8E c:\windows\$hf_mig$\KB951748\SP3QFE\tcpip.sys
[7] 2008-06-20 10:45 360320 2A5554FC5B1E04E131230E3CE035C3F9 c:\windows\$NtServicePackUninstall$\tcpip.sys
[7] 2004-08-04 06:14 359040 9F4B36614A0FC234525BA224957DE55C c:\windows\$NtUninstallKB893066$\tcpip.sys
[-] 2003-07-16 20:47 332928 244A2F9816BC9B593957281EF577D976 c:\windows\$NtUninstallKB893066_0$\tcpip.sys
[-] 2005-05-25 19:04 359808 88763A98A4C26C409741B4AA162720C9 c:\windows\$NtUninstallKB913446$\tcpip.sys
[-] 2006-01-13 02:28 359808 583E063FDC888CA30D05C2724B0D7EF4 c:\windows\$NtUninstallKB917953$\tcpip.sys
[-] 2006-04-20 11:51 359808 1DBF125862891817F374F407626967F4 c:\windows\$NtUninstallKB941644$\tcpip.sys
[7] 2008-04-13 19:20 361344 93EA8D04EC73A85DB02EB8805988F733 c:\windows\$NtUninstallKB951748$\tcpip.sys
[-] 2007-10-30 17:20 360064 90CAFF4B094573449A0872A0F919B178 c:\windows\$NtUninstallKB951748_0$\tcpip.sys
[-] 2008-04-13 19:20 361344 ACCF5A9A1FFAA490F33DBA1C632B95E1 c:\windows\ServicePackFiles\i386\tcpip.sys
[-] 2008-06-20 11:51 361600 9425B72F40257B45D45D24773273DAD0 c:\windows\system32\dllcache\tcpip.sys
[-] 2008-06-20 11:51 361600 9425B72F40257B45D45D24773273DAD0 c:\windows\system32\drivers\tcpip.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Dell AIO Printer A940"="c:\program files\Dell AIO Printer A940\dlbabmgr.exe" [2003-06-25 294998]
"Microsoft Works Update Detection"="c:\program files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" [2003-06-07 50688]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-04-23 1947928]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-02-06 177472]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-04-02 342312]
"itype"="c:\program files\Microsoft IntelliType Pro\itype.exe" [2008-06-10 1442888]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2008-06-10 1406024]
"ddoctorv2"="c:\program files\Comcast\Desktop Doctor\bin\sprtcmd.exe" [2008-04-24 202560]
"LogitechCommunicationsManager"="c:\program files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2007-10-25 563984]
"LogitechQuickCamRibbon"="c:\program files\Logitech\QuickCam\Quickcam.exe" [2007-10-25 2178832]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSimpleStartMenu"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-04-23 13:15 11952 —-a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AVG Anti-Spyware Driver]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AVG Anti-Spyware Guard]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys]
@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"UleadBurningHelper"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"YOP"=c:\progra~1\Yahoo!\YOP\yop.exe /autostart
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" -atboottime
"LogitechQuickCamRibbon"="c:\program files\Logitech\QuickCam\Quickcam.exe" /hide
"diagent"="c:\program files\Creative\SBLive\Diagnostics\diagent.exe" startup

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Yahoo!\\Messenger\\yserver.exe"= c:\\Program Files\\Yahoo!\\Messenger\\yserver.exe
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\LEXPPS.EXE"=
"c:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Civilization4.exe"=
"c:\\Program Files\\Activision\\Star Trek Armada II\\Armada2.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Beyond the Sword\\Civ4BeyondSword.exe"=
"c:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Beyond the Sword\\Civ4BeyondSword_PitBoss.exe"=
"c:\\Program Files\\Raven\\Star Trek Voyager Elite Force\\stvoyHM.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

R1 bcbus;BestCrypt bus driver;c:\windows\system32\DRIVERS\bcbus.sys [x]
R2 NkPtpEnumP2;NkPtpEnumP2;c:\program files\Nikon\Wireless Camera Setup Utility\NkPtpEnum.exe [2005-06-17 24064]
R3 Avgfwfd;AVG network filter service;c:\windows\system32\DRIVERS\avgfwdx.sys [2009-04-23 29208]
S0 AvgRkx86;avgrkx86.sys;c:\windows\System32\Drivers\avgrkx86.sys [2009-04-23 12552]
S1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\System32\Drivers\avgldx86.sys [2009-04-23 325896]
S1 AvgTdiX;AVG8 Network Redirector;c:\windows\System32\Drivers\avgtdix.sys [2009-04-23 108552]
S2 avg8emc;AVG8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2009-04-23 908568]
S2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-04-23 298776]
S2 avgfws8;AVG8 Firewall;c:\progra~1\AVG\AVG8\avgfws8.exe [2009-04-23 1366904]
S3 Avgfwdx;Avgfwdx;c:\windows\system32\DRIVERS\avgfwdx.sys [2009-04-23 29208]
S3 VBus;Virtual Bus;c:\windows\system32\DRIVERS\NkVBus.sys [2005-06-17 17664]


— Other Services/Drivers In Memory —

*Deregistered* - AFD
*Deregistered* - ALG
*Deregistered* - Apple Mobile Device
*Deregistered* - Ati HotKey Poller
*Deregistered* - ATI Smart
*Deregistered* - AudioSrv
*Deregistered* - avg8emc
*Deregistered* - avg8wd
*Deregistered* - Avgfwdx
*Deregistered* - avgfws8
*Deregistered* - AvgLdx86
*Deregistered* - AvgMfx86
*Deregistered* - AvgRkx86
*Deregistered* - AvgTdiX
*Deregistered* - Beep
*Deregistered* - BITS
*Deregistered* - Bonjour Service
*Deregistered* - Browser
*Deregistered* - Cdfs
*Deregistered* - Creative Service for CDROM Access
*Deregistered* - CryptSvc
*Deregistered* - ctsfm2k
*Deregistered* - DcomLaunch
*Deregistered* - Dhcp
*Deregistered* - Dnscache
*Deregistered* - drvnddm
*Deregistered* - ERSvc
*Deregistered* - EventSystem
*Deregistered* - FastUserSwitchingCompatibility
*Deregistered* - Fips
*Deregistered* - FltMgr
*Deregistered* - Ftdisk
*Deregistered* - Gpc
*Deregistered* - helpsvc
*Deregistered* - HidServ
*Deregistered* - HTTP
*Deregistered* - HTTPFilter
*Deregistered* - ImapiService
*Deregistered* - InterBaseGuardian
*Deregistered* - InterBaseServer
*Deregistered* - IpNat
*Deregistered* - IPSec
*Deregistered* - IPVNMon
*Deregistered* - JavaQuickStarterService
*Deregistered* - Kbdclass
*Deregistered* - KSecDD
*Deregistered* - lanmanserver
*Deregistered* - lanmanworkstation
*Deregistered* - LexBceS
*Deregistered* - LmHosts
*Deregistered* - LVCOMSer
*Deregistered* - LVPr2Mon
*Deregistered* - LVPrcSrv
*Deregistered* - LVSrvLauncher
*Deregistered* - LVUSBSta
*Deregistered* - MDC8021X
*Deregistered* - mdmxsdk
*Deregistered* - mnmdd
*Deregistered* - Mouclass
*Deregistered* - MountMgr
*Deregistered* - MRxDAV
*Deregistered* - MRxSmb
*Deregistered* - Msfs
*Deregistered* - MSIServer
*Deregistered* - mssmbios
*Deregistered* - Mup
*Deregistered* - NDIS
*Deregistered* - NdisTapi
*Deregistered* - NdisWan
*Deregistered* - NDProxy
*Deregistered* - NetBIOS
*Deregistered* - NetBT
*Deregistered* - Netman
*Deregistered* - NkPtpEnumP2
*Deregistered* - Nla
*Deregistered* - Npfs
*Deregistered* - Ntfs
*Deregistered* - Null
*Deregistered* - OMCI
*Deregistered* - ossrv
*Deregistered* - PartMgr
*Deregistered* - ParVdm
*Deregistered* - PfModNT
*Deregistered* - PolicyAgent
*Deregistered* - PptpMiniport
*Deregistered* - ProtectedStorage
*Deregistered* - PSched
*Deregistered* - RasAcd
*Deregistered* - Rasl2tp
*Deregistered* - RasMan
*Deregistered* - RasPppoe
*Deregistered* - Raspti
*Deregistered* - Rdbss
*Deregistered* - RDPCDD
*Deregistered* - RetroLauncher
*Deregistered* - RetroWDSvc
*Deregistered* - RpcSs
*Deregistered* - SamSs
*Deregistered* - Schedule
*Deregistered* - Secdrv
*Deregistered* - seclogon
*Deregistered* - SENS
*Deregistered* - SharedAccess
*Deregistered* - ShellHWDetection
*Deregistered* - Spooler
*Deregistered* - sprtsvc_ddoctorv2
*Deregistered* - sr
*Deregistered* - srservice
*Deregistered* - Srv
*Deregistered* - SSDPSRV
*Deregistered* - ssrtln
*Deregistered* - stisvc
*Deregistered* - swenum
*Deregistered* - TapiSrv
*Deregistered* - Tcpip
*Deregistered* - TermService
*Deregistered* - tfsnboio
*Deregistered* - tfsncofs
*Deregistered* - tfsndrct
*Deregistered* - tfsndres
*Deregistered* - tfsnifs
*Deregistered* - tfsnopio
*Deregistered* - tfsnpool
*Deregistered* - tfsnudf
*Deregistered* - tfsnudfa
*Deregistered* - Themes
*Deregistered* - TrkWks
*Deregistered* - Update
*Deregistered* - upnphost
*Deregistered* - VBus
*Deregistered* - VET-FILT
*Deregistered* - VET-REC
*Deregistered* - VETEBOOT
*Deregistered* - VETEFILE
*Deregistered* - VETMONNT
*Deregistered* - VgaSave
*Deregistered* - VolSnap
*Deregistered* - W32Time
*Deregistered* - Wanarp
*Deregistered* - Wdf01000
*Deregistered* - WebClient
*Deregistered* - WinDriver6
*Deregistered* - winmgmt
*Deregistered* - WMDM PMSP Service
*Deregistered* - WMPNetworkSvc
*Deregistered* - wscsvc
*Deregistered* - wuauserv
.
Contents of the 'Scheduled Tasks' folder

2009-06-07 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]

2009-06-07 c:\windows\Tasks\RegCure Program Check.job
- c:\program files\RegCure\RegCure.exe [2008-04-21 21:21]

2009-06-07 c:\windows\Tasks\RegCure.job
- c:\program files\RegCure\RegCure.exe [2008-04-21 21:21]
.
.
——- Supplementary Scan ——-
.
mWindow Title = Windows Internet Explorer provided by Comcast
LSP: c:\windows\System32\VetRedir.dll
FF - ProfilePath - c:\docume~1\Dan\APPLIC~1\Mozilla\Firefox\Profiles\75p2ovg1.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.chicagobears.com
FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
FF - component: c:\program files\AVG\AVG8\ToolbarFF\components\vmAVGConnector.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-07 12:16
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(948)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'lsass.exe'(1004)
c:\windows\System32\VetRedir.dll
c:\windows\system32\ISafeIf.dll

- - - - - - - > 'explorer.exe'(4064)
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\System32\VetRedir.dll
c:\windows\system32\ISafeIf.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2009-06-07 12:20
ComboFix-quarantined-files.txt 2009-06-07 17:19
ComboFix2.txt 2009-06-06 03:06
ComboFix3.txt 2009-05-23 19:52
ComboFix4.txt 2009-05-21 01:46

Pre-Run: 45,176,238,080 bytes free
Post-Run: 45,164,548,096 bytes free

346 — E O F — 2009-05-14 01:50


I don't know if this log helps show any of the issues it fixed on previous scans, but i thought i'd post it anyway. So what is going on with the logs not being produced after a reboot scan? IS the virus doing that?