Spyware / Malware / Virus Removal

[Resolved] Maax HJT log-laptop

11 min read

Looking for the outcome? Ask AI

maax Topic Starter

Post #1July 17, 2009, 4:31 PM UTC last edited July 17, 2009, 6:04 PM UTC

I have 2 instances of iexplorer.exe but only 1 iexplorer open

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:27:37 PM, on 7/17/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Dantz\Retrospect\retrorun.exe
C:\PROGRA~1\Dantz\RETROS~1\wdsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\mqsvc.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\system32\mqtgsvc.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe
C:\WINDOWS\system32\WDBtnMgr.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\iCall\iCall.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\dvd43\dvd43_tray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\HP\Digital Imaging\bin\hposol08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_clipbook.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\Hewlett-Packard\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [WD Button Manager] WDBtnMgr.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [MaxMenuMgr] "C:\Program Files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe"
O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [mumservice] C:\Program Files\Motorola\Software Update\mumservice.exe
O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [iCall Internet Phone] "C:\Program Files\iCall\iCall.exe" /startup
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /nodetect
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [dvd43] C:\Program Files\dvd43\dvd43_tray.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [Vbuzzer Messenger] C:\Program Files\vbuzzer\VBuzzer.exe
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - .DEFAULT User Startup: Vongo Tray.lnk = C:\Program Files\Vongo\Tray.exe (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: officejet 6100.lnk = ?
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: Add to Vbuzzer RSS list - C:\Program Files\vbuzzer\addurl.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Send to &Bluetooth Device… - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: HP Smart Select - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=64&bd=pavilion&pf=laptop
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/200612…ex/qtplugin.cab
O16 - DPF: {1851174C-97BD-4217-A0CC-E908F60D5B7A} (Hewlett-Packard Online Support Services) - http://h50203.www5.hp.com/HPISWeb/Customer…DataManager.CAB
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photos.walmart.com/WalmartActivia.cab
O16 - DPF: {49232000-16E4-426C-A231-62846947304B} (SysData Class) - https://wimpro.cce.hp.com/ChatEntry/downloads/sysinfo.cab
O16 - DPF: {5E936384-B736-4A9E-AA93-832CA59FDCEC} (InstallShield Setup Player V11) - http://www.respondus2.com/LDB/setup.exe
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} (GMNRev Class) - http://h20270.www2.hp.com/ediags/gmn2/inst…ctDetection.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AddFiltr - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Seagate Service (FreeAgentGoNext Service) - Seagate Technology LLC - C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\HP Game Console\GameConsoleService.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Retrospect Launcher (RetroLauncher) - Dantz Development Corporation - C:\Program Files\Dantz\Retrospect\retrorun.exe
O23 - Service: Retrospect WD Service (RetroWDSvc) - Dantz Development Corporation - C:\PROGRA~1\Dantz\RETROS~1\wdsvc.exe
O24 - Desktop Component 0: (no name) - http://www.gamecockcentral.com/images/wall…k3/1024x768.jpg

–
End of file - 14982 bytes

Malwarebytes' Anti-Malware 1.39
Database version: 2421
Windows 5.1.2600 Service Pack 3

7/17/2009 12:17:13 PM
mbam-log-2009-07-17 (12-17-13).txt

Scan type: Quick Scan
Objects scanned: 107894
Time elapsed: 7 minute(s), 43 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 0
Registry Data Items Infected: 2
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\install.exe (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
C:\install.exe (Trojan.Agent) -> Quarantined and deleted successfully.

Tomk

Post #2July 21, 2009, 2:47 PM UTC

Hi maax,

My name is Tomk. I would be glad to take a look at your log and help you with solving any malware problems. HijackThis logs can take a while to research, so please be patient and I'd be grateful if you would note the following:

I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
The fixes are specific to your problem and should only be used for the issues on this machine.
Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
It's often worth reading through these instructions and printing them for ease of reference.
If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
Please reply to this thread. Do not start a new topic.

Please download gmer.zip from Gmer and save it to your desktop.

Right click on gmer.zip and select Extract All….
Click Next on seeing the Welcome to the Compressed (zipped) Folders Extraction Wizard.
Click on the Browse button. Click on Desktop. Then click OK.
Click Next. It will start extracting.
Once done, check (tick) the Show extracted files box and click Finish.
Double click on gmer.exe to run it.
Select the Rootkit tab.
On the right hand side, check all the items to be scanned, but leave Show All box unchecked.
Select all drives that are connected to your system to be scanned.
Click on the Scan button.
When the scan is finished, click Copy to save the scan log to the Windows clipboard.
Open Notepad or a similar text editor.
Paste the clipboard contents into the text editor.
Save the Gmer scan log and post it in your next reply.

Note: Do not run any programs while Gmer is running.

Please download DDS by sUBs from one of the following links and save it to your desktop.

- DDS.scr
- DDS.pif
Disable any script blocking protection (How to Disable your Security Programs)
Double click DDS icon to run the tool (may take up to 3 minutes to run)
When done, DDS.txt will open.
After a few moments, attach.txt will open in a second window.
Save both reports to your desktop.

—————————————————

Post the contents of the DDS.txt report in your next reply
Attach the Attach.txt report to your post by scroling down to the Attachments area and then clicking Browse. Browse to where you saved the file, and click Open and the click UPLOAD.

maax

Post #3July 22, 2009, 3:22 PM UTC

GMER 1.0.15.14972 - http://www.gmer.net
Rootkit scan 2009-07-22 01:09:22
Windows 5.1.2600 Service Pack 3

—- System - GMER 1.0.15 —-

SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)

ZwClose [0xEC91C6B8]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)

ZwCreateKey [0xEC91C574]
SSDT \SystemRoot\System32\DRIVERS\klif.sys (spuper-ptor/Kaspersky Lab)

ZwCreateProcess [0xED47F730]
SSDT \SystemRoot\System32\DRIVERS\klif.sys (spuper-ptor/Kaspersky Lab)

ZwCreateProcessEx [0xED47F8A0]
SSDT \SystemRoot\System32\DRIVERS\klif.sys (spuper-ptor/Kaspersky Lab)

ZwCreateSection [0xED480340]
SSDT \SystemRoot\System32\DRIVERS\klif.sys (spuper-ptor/Kaspersky Lab)

ZwCreateSymbolicLinkObject [0xED47FF90]
SSDT \SystemRoot\System32\DRIVERS\klif.sys (spuper-ptor/Kaspersky Lab)

ZwCreateThread [0xED480C60]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)

ZwDeleteValueKey [0xEC91CA52]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)

ZwDuplicateObject [0xEC91C14C]
SSDT \SystemRoot\System32\DRIVERS\klif.sys (spuper-ptor/Kaspersky Lab)

ZwLoadDriver [0xED47DF80]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)

ZwOpenKey [0xEC91C64E]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)

ZwOpenProcess [0xEC91C08C]
SSDT \SystemRoot\System32\DRIVERS\klif.sys (spuper-ptor/Kaspersky Lab)

ZwOpenSection [0xED480170]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)

ZwOpenThread [0xEC91C0F0]
SSDT \SystemRoot\System32\DRIVERS\klif.sys (spuper-ptor/Kaspersky Lab)

ZwQuerySystemInformation [0xED480910]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)

ZwQueryValueKey [0xEC91C76E]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)

ZwRestoreKey [0xEC91C72E]
SSDT \SystemRoot\System32\DRIVERS\klif.sys (spuper-ptor/Kaspersky Lab)

ZwResumeThread [0xED480C10]
SSDT \SystemRoot\System32\DRIVERS\klif.sys (spuper-ptor/Kaspersky Lab)

ZwSetContextThread [0xED480F90]
SSDT \SystemRoot\System32\DRIVERS\klif.sys (spuper-ptor/Kaspersky Lab)

ZwSetInformationFile [0xED481560]
SSDT \SystemRoot\System32\DRIVERS\klif.sys (spuper-ptor/Kaspersky Lab)

ZwSetSecurityObject [0xED47CC40]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)

ZwSetValueKey [0xEC91C8AE]
SSDT \SystemRoot\System32\DRIVERS\klif.sys (spuper-ptor/Kaspersky Lab)

ZwSuspendThread [0xED480BC0]
SSDT \SystemRoot\System32\DRIVERS\klif.sys (spuper-ptor/Kaspersky Lab)

ZwSystemDebugControl [0xED47E2F0]
SSDT \SystemRoot\System32\DRIVERS\klif.sys (spuper-ptor/Kaspersky Lab)

ZwTerminateProcess [0xED480760]
SSDT \SystemRoot\System32\DRIVERS\klif.sys (spuper-ptor/Kaspersky Lab)

ZwWriteVirtualMemory [0xED47FA20]
SSDT \SystemRoot\System32\DRIVERS\klif.sys (spuper-ptor/Kaspersky Lab)

SSDT[284] [0xED47BD40]
SSDT \SystemRoot\System32\DRIVERS\klif.sys (spuper-ptor/Kaspersky Lab)

SSDT[285] [0xED47BD50]
SSDT \SystemRoot\System32\DRIVERS\klif.sys (spuper-ptor/Kaspersky Lab)

SSDT[286] [0xED47BD60]
SSDT \SystemRoot\System32\DRIVERS\klif.sys (spuper-ptor/Kaspersky Lab)

SSDT[287] [0xED47BD80]
SSDT \SystemRoot\System32\DRIVERS\klif.sys (spuper-ptor/Kaspersky Lab)

SSDT[288] [0xED47BDA0]
SSDT \SystemRoot\System32\DRIVERS\klif.sys (spuper-ptor/Kaspersky Lab)

SSDT[289] [0xED47BDD0]
SSDT \SystemRoot\System32\DRIVERS\klif.sys (spuper-ptor/Kaspersky Lab)

SSDT[290] [0xED47BDE0]
SSDT \SystemRoot\System32\DRIVERS\klif.sys (spuper-ptor/Kaspersky Lab)

SSDT[291] [0xED47BE00]
SSDT \SystemRoot\System32\DRIVERS\klif.sys (spuper-ptor/Kaspersky Lab)

SSDT[292] [0xED47BE10]
SSDT \SystemRoot\System32\DRIVERS\klif.sys (spuper-ptor/Kaspersky Lab)

SSDT[293] [0xED47BED0]
SSDT \SystemRoot\System32\DRIVERS\klif.sys (spuper-ptor/Kaspersky Lab)

SSDT[294] [0xED47BFA0]
SSDT \SystemRoot\System32\DRIVERS\klif.sys (spuper-ptor/Kaspersky Lab)

SSDT[295] [0xED47BFE0]
SSDT \SystemRoot\System32\DRIVERS\klif.sys (spuper-ptor/Kaspersky Lab)

SSDT[296] [0xED47C020]

Code \SystemRoot\System32\DRIVERS\klif.sys (spuper-ptor/Kaspersky Lab)

FsRtlCheckLockForReadAccess
Code \SystemRoot\System32\DRIVERS\klif.sys (spuper-ptor/Kaspersky Lab)

IoIsOperationSynchronous

—- Kernel code sections - GMER 1.0.15 —-

.text ntkrnlpa.exe!FsRtlCheckLockForReadAccess

804EAF84 5 Bytes JMP ED481980 \SystemRoot\System32\DRIVERS\klif.sys (spuper-

ptor/Kaspersky Lab)
.text ntkrnlpa.exe!IoIsOperationSynchronous

804EF912 5 Bytes JMP ED481E80 \SystemRoot\System32\DRIVERS\klif.sys (spuper-

ptor/Kaspersky Lab)

—- User code sections - GMER 1.0.15 —-

.text C:\Program Files\Internet Explorer\iexplore.exe[536] USER32.dll!DialogBoxParamW

7E4247AB 5 Bytes JMP 3E2151D5 C:\WINDOWS\system32\IEFRAME.dll (Internet

Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[536] USER32.dll!CreateWindowExW

7E42D0A3 5 Bytes JMP 3E2ED2C4 C:\WINDOWS\system32\IEFRAME.dll (Internet

Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[536] USER32.dll!DialogBoxIndirectParamW

7E432072 5 Bytes JMP 3E40B6CB C:\WINDOWS\system32\IEFRAME.dll (Internet

Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[536] USER32.dll!MessageBoxIndirectA

7E43A082 5 Bytes JMP 3E40B5FD C:\WINDOWS\system32\IEFRAME.dll (Internet

Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[536] USER32.dll!DialogBoxParamA

7E43B144 5 Bytes JMP 3E40B668 C:\WINDOWS\system32\IEFRAME.dll (Internet

Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[536] USER32.dll!MessageBoxExW

7E450838 5 Bytes JMP 3E40B4CE C:\WINDOWS\system32\IEFRAME.dll (Internet

Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[536] USER32.dll!MessageBoxExA

7E45085C 5 Bytes JMP 3E40B530 C:\WINDOWS\system32\IEFRAME.dll (Internet

Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[536] USER32.dll!DialogBoxIndirectParamA

7E456D7D 5 Bytes JMP 3E40B72E C:\WINDOWS\system32\IEFRAME.dll (Internet

Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[536] USER32.dll!MessageBoxIndirectW

7E4664D5 5 Bytes JMP 3E40B592 C:\WINDOWS\system32\IEFRAME.dll (Internet

Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5012] USER32.dll!DialogBoxParamW

7E4247AB 5 Bytes JMP 3E2151D5 C:\WINDOWS\system32\IEFRAME.dll (Internet

Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5012] USER32.dll!SetWindowsHookExW

7E42820F 5 Bytes JMP 3E2E9261 C:\WINDOWS\system32\IEFRAME.dll (Internet

Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5012] USER32.dll!CallNextHookEx

7E42B3C6 5 Bytes JMP 3E2DC8A9 C:\WINDOWS\system32\IEFRAME.dll (Internet

Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5012] USER32.dll!CreateWindowExW

7E42D0A3 5 Bytes JMP 3E2ED2C4 C:\WINDOWS\system32\IEFRAME.dll (Internet

Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5012] USER32.dll!UnhookWindowsHookEx

7E42D5F3 5 Bytes JMP 3E254254 C:\WINDOWS\system32\IEFRAME.dll (Internet

Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5012] USER32.dll!DialogBoxIndirectParamW

7E432072 5 Bytes JMP 3E40B6CB C:\WINDOWS\system32\IEFRAME.dll (Internet

Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5012] USER32.dll!MessageBoxIndirectA

7E43A082 5 Bytes JMP 3E40B5FD C:\WINDOWS\system32\IEFRAME.dll (Internet

Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5012] USER32.dll!DialogBoxParamA

7E43B144 5 Bytes JMP 3E40B668 C:\WINDOWS\system32\IEFRAME.dll (Internet

Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5012] USER32.dll!MessageBoxExW

7E450838 5 Bytes JMP 3E40B4CE C:\WINDOWS\system32\IEFRAME.dll (Internet

Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5012] USER32.dll!MessageBoxExA

7E45085C 5 Bytes JMP 3E40B530 C:\WINDOWS\system32\IEFRAME.dll (Internet

Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5012] USER32.dll!DialogBoxIndirectParamA

7E456D7D 5 Bytes JMP 3E40B72E C:\WINDOWS\system32\IEFRAME.dll (Internet

Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5012] USER32.dll!MessageBoxIndirectW

7E4664D5 5 Bytes JMP 3E40B592 C:\WINDOWS\system32\IEFRAME.dll (Internet

Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5012] ole32.dll!CoCreateInstance

7750057E 5 Bytes JMP 3E2ED320 C:\WINDOWS\system32\IEFRAME.dll (Internet

Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5264] USER32.dll!DialogBoxParamW

7E4247AB 5 Bytes JMP 3E2151D5 C:\WINDOWS\system32\IEFRAME.dll (Internet

Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5264] USER32.dll!SetWindowsHookExW

7E42820F 5 Bytes JMP 3E2E9261 C:\WINDOWS\system32\IEFRAME.dll (Internet

Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5264] USER32.dll!CallNextHookEx

7E42B3C6 5 Bytes JMP 3E2DC8A9 C:\WINDOWS\system32\IEFRAME.dll (Internet

Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5264] USER32.dll!CreateWindowExW

7E42D0A3 5 Bytes JMP 3E2ED2C4 C:\WINDOWS\system32\IEFRAME.dll (Internet

Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5264] USER32.dll!UnhookWindowsHookEx

7E42D5F3 5 Bytes JMP 3E254254 C:\WINDOWS\system32\IEFRAME.dll (Internet

Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5264] USER32.dll!DialogBoxIndirectParamW

7E432072 5 Bytes JMP 3E40B6CB C:\WINDOWS\system32\IEFRAME.dll (Internet

Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5264] USER32.dll!MessageBoxIndirectA

7E43A082 5 Bytes JMP 3E40B5FD C:\WINDOWS\system32\IEFRAME.dll (Internet

Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5264] USER32.dll!DialogBoxParamA

7E43B144 5 Bytes JMP 3E40B668 C:\WINDOWS\system32\IEFRAME.dll (Internet

Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5264] USER32.dll!MessageBoxExW

7E450838 5 Bytes JMP 3E40B4CE C:\WINDOWS\system32\IEFRAME.dll (Internet

Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5264] USER32.dll!MessageBoxExA

7E45085C 5 Bytes JMP 3E40B530 C:\WINDOWS\system32\IEFRAME.dll (Internet

Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5264] USER32.dll!DialogBoxIndirectParamA

7E456D7D 5 Bytes JMP 3E40B72E C:\WINDOWS\system32\IEFRAME.dll (Internet

Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5264] USER32.dll!MessageBoxIndirectW

7E4664D5 5 Bytes JMP 3E40B592 C:\WINDOWS\system32\IEFRAME.dll (Internet

Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5264] ole32.dll!CoCreateInstance

7750057E 5 Bytes JMP 3E2ED320 C:\WINDOWS\system32\IEFRAME.dll (Internet

Explorer/Microsoft Corporation)

—- User IAT/EAT - GMER 1.0.15 —-

IAT C:\WINDOWS\system32\services.exe[1020] @ C:\WINDOWS\system32\services.exe [ADVAPI32.dll!

CreateProcessAsUserW] 00390002
IAT C:\WINDOWS\system32\services.exe[1020] @ C:\WINDOWS\system32\services.exe [KERNEL32.dll!

CreateProcessW] 00390000
IAT C:\Program Files\Internet Explorer\iexplore.exe[5012] @ C:\WINDOWS\system32\ole32.dll

[KERNEL32.dll!LoadLibraryExW] [451F1A7B] C:\Program Files\Internet Explorer\xpshims.dll (Internet Explorer

Compatibility Shims for XP/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\WINDOWS\system32\ole32.dll

[KERNEL32.dll!LoadLibraryExW] [451F1A7B] C:\Program Files\Internet Explorer\xpshims.dll (Internet Explorer

Compatibility Shims for XP/Microsoft Corporation)

—- Devices - GMER 1.0.15 —-

AttachedDevice \FileSystem\Ntfs \Ntfs

klif.sys (spuper-ptor/Kaspersky Lab)
AttachedDevice \FileSystem\Ntfs \Ntfs

aswMon2.SYS (avast! File System Filter Driver for Windows XP/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\Ip

aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0

SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0

eabfiltr.sys (QLB PS/2 Keyboard filter driver/Hewlett-Packard Development Company,

L.P.)
AttachedDevice \Driver\Tcpip \Device\Tcp

aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\Udp

aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\RawIp

aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice \FileSystem\Fastfat \Fat

klif.sys (spuper-ptor/Kaspersky Lab)
AttachedDevice \FileSystem\Fastfat \Fat

fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice \FileSystem\Fastfat \Fat

aswMon2.SYS (avast! File System Filter Driver for Windows XP/ALWIL Software)

—- Registry - GMER 1.0.15 —-

Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\HP Photosmart C4500

series@ChangeID 38397250

—- EOF - GMER 1.0.15 —-

DDS (Ver_09-06-26.01) - NTFSx86
Run by [removed] at 11:06:59.63 on Wed 07/22/2009
Internet Explorer: 8.0.6001.18702
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.991.259 [GMT -4:00]

AV: avast! antivirus 4.8.1335 [VPS 090720-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: Norton Internet Worm Protection *disabled* {990F9400-4CEE-43EA-A83A-D013ADD8EA6E}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
svchost.exe
svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe
C:\WINDOWS\system32\svchost.exe -k hpdevmgmt
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Dantz\Retrospect\retrorun.exe
C:\PROGRA~1\Dantz\RETROS~1\wdsvc.exe
svchost.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\system32\mqsvc.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\system32\mqtgsvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe
C:\WINDOWS\system32\WDBtnMgr.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\iCall\iCall.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\HP\Digital Imaging\bin\hposol08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\WINDOWS\system32\svchost.exe -k HPService
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_clipbook.exe
C:\Documents and Settings\Gregg\Desktop\gmer\gmer.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Gregg\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/
uSearch Page = hxxp://us.rd.yahoo.com/customize/ie/defaults/sp/msgr9/*http://www.yahoo.com
uSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
uDefault_Search_URL = hxxp://www.google.com/ie
mDefault_Page_URL = hxxp://www.yahoo.com/
mDefault_Search_URL = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
mSearch Page = hxxp://us.rd.yahoo.com/customize/ie/defaults/sp/msgr9/*http://www.yahoo.com
mStart Page = hxxp://www.yahoo.com/
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
uInternet Connection Wizard,ShellNext = iexplore
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - c:\program files\hp\digital imaging\smart web printing\hpswp_printenhancer.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Skype add-on (mastermind): {22bf413b-c6d2-4d91-82a9-a0f997ba588c} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program

files\real\realplayer\rpbrowserrecordplugin.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.1.1309.3572\swg.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
TB: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No File
EB: {942EFF30-F610-413E-854B-DDDEA0E78A1E} - No File
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [Messenger (Yahoo!)] "c:\program files\yahoo!\messenger\YahooMessenger.exe" -quiet
uRun: [Vbuzzer Messenger] c:\program files\vbuzzer\VBuzzer.exe
uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
mRun: [hpWirelessAssistant] c:\program files\hpq\hp wireless assistant\HP Wireless Assistant.exe
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [MsmqIntCert] regsvr32 /s mqrt.dll
mRun: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [QPService] "c:\program files\hp\quickplay\QPService.exe"
mRun: [ISUSPM Startup] "c:\program files\common files\installshield\updateservice\isuspm.exe" -startup
mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start
mRun: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
mRun: [Cpqset] c:\program files\hewlett-packard\default settings\cpqset.exe
mRun: [WD Button Manager] WDBtnMgr.exe
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [MaxMenuMgr] "c:\program files\seagate\seagatemanager\freeagent status\StxMenuMgr.exe"
mRun: [hpqSRMon] c:\program files\hp\digital imaging\bin\hpqSRMon.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [mumservice] c:\program files\motorola\software update\mumservice.exe
mRun: [CloneCDTray] "c:\program files\slysoft\clonecd\CloneCDTray.exe" /s
mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
mRun: [iCall Internet Phone] "c:\program files\icall\iCall.exe" /startup
mRun: [avast!] c:\progra~1\alwils~1\avast4\ashDisp.exe
mRun: [RecGuard] c:\windows\sminst\RecGuard.exe
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [nwiz] nwiz.exe /installquiet /nodetect
mRun: [NeroFilterCheck] c:\windows\system32\NeroCheck.exe
mRun: [NeroCheck] c:\windows\system32\NeroCheck.exe
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [ehTray] c:\windows\ehome\ehtray.exe
mRun: [dvd43] c:\program files\dvd43\dvd43_tray.exe
dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t
dRun: [MySpaceIM] c:\program files\myspace\im\MySpaceIM.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\blueto~1.lnk - c:\program files\widcomm\bluetooth software\BTTray.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpphot~1.lnk - c:\program files\hp\digital imaging\bin\hpqthb08.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpoddt~1.lnk - c:\program files\hp\digital imaging\bin\hpotdd01.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office10\OSA.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\office~1.lnk - c:\program files\hp\digital imaging\bin\hposol08.exe
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Add to Vbuzzer RSS list - c:\program files\vbuzzer\addurl.htm
IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office10\EXCEL.EXE/3000
IE: Send to &Bluetooth Device… - c:\program files\widcomm\bluetooth software\btsendto_ie_ctx.htm
IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\program files\widcomm\bluetooth software\btsendto_ie.htm
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {5067A26B-1337-4436-8AFE-EE169C2DA79F} - {77BF5300-1474-4EC7-9980-D32B190E9B07} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll
IE: {77BF5300-1474-4EC7-9980-D32B190E9B07} - {77BF5300-1474-4EC7-9980-D32B190E9B07} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll
IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - hxxp://a1540.g.akamai.net/7/1540/52/20061205/qtinstall.info.apple.com/qtactivex/qtplugin.cab
DPF: {0DB074F0-617E-4EE9-912C-2965CF2AA5A4} - hxxp://download.microsoft.com/download/0/f/b/0fb0fab9-7f09-4bb6-86d8-8e791ba99ac5/VirtualEarth3D.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/3/9/8/398422c0-8d3e-40e1-a617-af65a72a0465/LegitCheckControl.cab
DPF: {1851174C-97BD-4217-A0CC-E908F60D5B7A} - hxxp://h50203.www5.hp.com/HPISWeb/Customer/cabs/HPISDataManager.CAB
DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} - hxxp://photos.walmart.com/WalmartActivia.cab
DPF: {49232000-16E4-426C-A231-62846947304B} - hxxps://wimpro.cce.hp.com/ChatEntry/downloads/sysinfo.cab
DPF: {5E936384-B736-4A9E-AA93-832CA59FDCEC} - hxxp://www.respondus2.com/LDB/setup.exe
DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - hxxp://download.divx.com/player/DivXBrowserPlugin.cab
DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} - hxxps://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} - hxxp://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {CAFEEFAC-0014-0002-0014-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_09-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_10-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

============= SERVICES / DRIVERS ===============

R0 ntcdrdrv;ntcdrdrv;c:\windows\system32\drivers\ntcdrdrv.sys [2007-8-30 13440]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2009-7-9 114768]
R1 KLIF;KLIF;c:\windows\system32\drivers\klif.sys [2009-6-14 186128]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009-7-9 20560]
R2 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast4\ashServ.exe [2009-7-9 138680]
R2 FreeAgentGoNext Service;Seagate Service;c:\program files\seagate\seagatemanager\sync\FreeAgentService.exe [2008-7-17 161064]
R2 McrdSvc;Media Center Extender Service;c:\windows\ehome\mcrdsvc.exe [2005-8-6 99328]
R2 SVKP;SVKP;c:\windows\system32\SVKP.sys [2007-1-5 2368]
R3 5U870CAP_VID_1262&PID_25FD;HP Pavilion Webcam ;c:\windows\system32\drivers\5U870CAP.sys [2006-6-6 61952]
S2 SSPORT;SSPORT;\??\c:\windows\system32\drivers\ssport.sys –> c:\windows\system32\drivers\SSPORT.sys [?]
S3 aawservice;Ad-Aware 2007 Service;c:\program files\lavasoft\ad-aware 2007\aawservice.exe [2008-1-4 607576]
S3 avast! Mail Scanner;avast! Mail Scanner;c:\program files\alwil software\avast4\ashMaiSv.exe [2009-7-9 254040]
S3 avast! Web Scanner;avast! Web Scanner;c:\program files\alwil software\avast4\ashWebSv.exe [2009-7-9 352920]
S3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\drivers\motccgp.sys –> c:\windows\system32\drivers\motccgp.sys [?]
S3 motccgpfl;MotCcgpFlService;c:\windows\system32\drivers\motccgpfl.sys –> c:\windows\system32\drivers\motccgpfl.sys [?]
S3 motport;Motorola USB Diagnostic Port;c:\windows\system32\drivers\motport.sys –> c:\windows\system32\drivers\motport.sys [?]
S3 SWNC8U56;Sierra Wireless MUX NDIS Driver (UMTS56);c:\windows\system32\drivers\swnc8u56.sys [2008-8-6 101248]
S3 SWUMX56;Sierra Wireless USB MUX Driver (UMTS56);c:\windows\system32\drivers\swumx56.sys [2008-8-6 73856]

=============== Created Last 30 ================

2009-07-17 09:43 –d—– c:\docume~1\alluse~1\applic~1\SecTaskMan
2009-07-17 09:43 –d—– c:\program files\Security Task Manager
2009-07-13 15:28 –d—– C:\ApolloOutput
2009-07-13 11:47 –d—– c:\windows\Performance
2009-07-13 11:45 –d—– c:\program files\Microsoft Windows 7 Upgrade Advisor
2009-07-10 11:15 –d—– C:\temp
2009-07-09 10:27 –d—– c:\program files\Polyphonic Wizard
2009-07-08 11:18 –d—– c:\program files\iCall
2009-07-08 11:03 –d—– c:\docume~1\gregg\applic~1\Vbuzzer Messenger
2009-07-08 11:02 245,760 a——- c:\windows\system32\FaxHelper.exe
2009-07-08 11:02 57,344 a——- c:\windows\system32\FaxMonitor.dll
2009-07-08 10:40 –d—– c:\docume~1\gregg\applic~1\Paltalk
2009-07-07 15:27 56 a—h— c:\windows\system32\ezsidmv.dat
2009-07-03 15:33 –d—– c:\program files\AMR to MP3 Converter
2009-07-03 15:30 54,156 a—h— c:\windows\QTFont.qfn
2009-07-03 15:30 1,409 a——- c:\windows\QTFont.for
2009-06-26 12:18 –d—– c:\program files\common files\xing shared

==================== Find3M ====================

2009-07-22 11:06 293,152 a–sh— c:\windows\system32\drivers\fidbox2.dat
2009-07-22 00:21 12,416,800 a–sh— c:\windows\system32\drivers\fidbox.dat
2009-07-20 23:27 169,568 a–sh— c:\windows\system32\drivers\fidbox.idx
2009-07-20 23:27 29,312 a–sh— c:\windows\system32\drivers\fidbox2.idx
2009-07-13 13:36 38,160 a——- c:\windows\system32\drivers\mbamswissarmy.sys
2009-07-13 13:36 19,096 a——- c:\windows\system32\drivers\mbam.sys
2009-06-16 10:36 119,808 a——- c:\windows\system32\t2embed.dll
2009-06-16 10:36 81,920 a——- c:\windows\system32\fontsub.dll
2009-06-16 10:36 119,808 ——– c:\windows\system32\dllcache\t2embed.dll
2009-06-16 10:36 81,920 ——– c:\windows\system32\dllcache\fontsub.dll
2009-06-10 13:35 1,490 a——- c:\windows\fonts\COLLEGE.TXT
2009-06-03 15:09 1,291,264 a——- c:\windows\system32\quartz.dll
2009-06-03 15:09 1,291,264 ——– c:\windows\system32\dllcache\quartz.dll
2009-05-21 14:46 268,288 ——– c:\windows\system32\dllcache\httpext.dll
2009-05-13 01:15 5,936,128 a——- c:\windows\system32\dllcache\mshtml.dll
2009-05-13 01:15 915,456 a——- c:\windows\system32\wininet.dll
2009-05-13 01:15 915,456 a——- c:\windows\system32\dllcache\wininet.dll
2009-05-10 20:53 86,016 a——- c:\windows\system32\BtMmHook.dll
2009-05-10 20:53 749,568 a——- c:\windows\system32\btrez.dll
2009-05-07 11:32 345,600 a——- c:\windows\system32\localspl.dll
2009-05-07 11:32 345,600 ——– c:\windows\system32\dllcache\localspl.dll
2009-05-01 17:02 90,112 a——- c:\windows\system32\dpl100.dll
2009-05-01 17:02 823,296 a——- c:\windows\system32\divx_xx0c.dll
2009-05-01 17:02 823,296 a——- c:\windows\system32\divx_xx07.dll
2009-05-01 17:02 815,104 a——- c:\windows\system32\divx_xx0a.dll
2009-05-01 17:02 811,008 a——- c:\windows\system32\divx_xx16.dll
2009-05-01 17:02 802,816 a——- c:\windows\system32\divx_xx11.dll
2009-05-01 17:02 685,056 a——- c:\windows\system32\DivX.dll
2009-05-01 14:30 3,366,912 a——- c:\windows\system32\GPhotos.scr
2009-04-30 17:22 12,800 ——– c:\windows\system32\dllcache\xpshims.dll
2009-04-30 17:22 1,985,024 a——- c:\windows\system32\dllcache\iertutil.dll
2009-04-30 17:22 11,064,832 a——- c:\windows\system32\dllcache\ieframe.dll
2009-04-30 17:22 1,207,808 a——- c:\windows\system32\dllcache\urlmon.dll
2009-04-30 17:22 25,600 a——- c:\windows\system32\dllcache\jsproxy.dll
2009-04-30 17:22 385,536 a——- c:\windows\system32\dllcache\iedkcs32.dll
2009-04-30 17:22 246,272 ——– c:\windows\system32\dllcache\ieproxy.dll
2009-04-30 07:21 173,056 a——- c:\windows\system32\dllcache\ie4uinit.exe
2009-04-25 01:30 102,400 ——– c:\windows\system32\dllcache\iecompat.dll
2009-02-17 11:14 72,392 ac—— c:\docume~1\gregg\applic~1\GDIPFONTCACHEV1.DAT
2007-10-09 09:18 92,064 ac—— c:\documents and settings\gregg\mqdmmdm.sys
2007-10-09 09:18 79,328 ac—— c:\documents and settings\gregg\mqdmserd.sys
2007-10-09 09:18 66,656 ac—— c:\documents and settings\gregg\mqdmbus.sys
2007-10-09 09:18 25,600 ac—— c:\documents and settings\gregg\usbsermptxp.sys
2007-10-09 09:18 22,768 ac—— c:\documents and settings\gregg\usbsermpt.sys
2007-10-09 09:18 9,232 ac—— c:\documents and settings\gregg\mqdmmdfl.sys
2007-10-09 09:18 6,208 ac—— c:\documents and settings\gregg\mqdmcmnt.sys
2007-10-09 09:18 5,936 ac—— c:\documents and settings\gregg\mqdmwhnt.sys
2007-10-09 09:18 4,048 ac—— c:\documents and settings\gregg\mqdmcr.sys
2007-04-13 13:42 79 ac—— c:\documents and settings\gregg\javasetup.bat
2006-12-05 11:33 251 ac—— c:\program files\wt3d.ini
2006-10-21 14:04 480 a–shr– c:\windows\dsrnthsove.dat
2006-12-15 21:05 22 ac-sh— c:\windows\sminst\HPCD.sys
2006-10-21 14:04 480 a–shr– c:\windows\system32\MSvonrsrvs.dll
2008-09-17 12:30 32,768 ac-sh— c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008091720080918

\index.dat

============= FINISH: 11:07:36.93 ===============

Attachments:

📎Attach.txt

Tomk

Post #4July 22, 2009, 3:45 PM UTC

maax,

Your computer appears to have been infected by a backdoor trojan. These programs have the ability to steal passwords and other information from your system. If you use your computer for sensitive purposes such as internet banking then I recommend you take the following steps immediately:

Use another, uninfected computer to change all your internet passwords, especially ones with financial implications such as banks, paypal, ebay, etc. You should also change the passwords for any other site you use.
Call your bank(s), credit card company or any other institution which may be affected and advise them that your login/password or credit card information may have been stolen and ask what steps to take with regard to your account.
Consider what other private information could possibly have been taken from your computer and take appropriate steps

This infection can almost certainly be cleaned, but as the malware could be configured to run any program a remote attacker requires, it will be impossible to be 100% sure that the machine is clean, if this is unacceptable to you then you should consider reformatting the system partition and reinstalling Windows as this is the only 100% sure answer.

If you wish to reformat then please let me know in your next response, I'll now continue with instructions for cleaning.

Download ComboFix from one of these locations:

Link 1
Link 2
Link 3

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link –> http://forums.whatthetech.com/How_Disable_…ams_t96260.html
Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Notes:

1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
4. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
5. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

maax

Post #5July 22, 2009, 4:44 PM UTC

ComboFix 09-07-21.05 - Gregg 07/22/2009 12:23.1.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.991.400 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: avast! antivirus 4.8.1335 [VPS 090720-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: Norton Internet Worm Protection *disabled* {990F9400-4CEE-43EA-A83A-D013ADD8EA6E}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\Installer\11085.msp
c:\windows\Installer\1115c.msp
c:\windows\Installer\152ed.msp
c:\windows\Installer\8fb67.msi
c:\windows\kb913800.exe
c:\windows\system32\Cache
D:\Autorun.inf

.
((((((((((((((((((((((((( Files Created from 2009-06-22 to 2009-07-22 )))))))))))))))))))))))))))))))
.

2009-07-17 15:59 . 2009-07-17 15:59 3775175 —-a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2009-07-17 13:43 . 2009-07-17 14:44 ——– d—–w- c:\documents and settings\All Users\Application Data\SecTaskMan
2009-07-17 13:43 . 2009-07-17 13:45 ——– d—–w- c:\program files\Security Task Manager
2009-07-13 19:28 . 2009-07-13 19:28 ——– d—–w- C:\ApolloOutput
2009-07-13 15:47 . 2009-07-13 15:47 ——– d—–w- c:\windows\Performance
2009-07-13 15:46 . 2009-07-13 15:46 ——– d—–w- c:\documents and settings\Gregg\Local Settings\Application Data\Microsoft Corporation
2009-07-13 15:45 . 2009-07-13 15:45 ——– d—–w- c:\program files\Microsoft Windows 7 Upgrade Advisor
2009-07-10 15:15 . 2009-07-10 15:15 ——– d—–w- C:\temp
2009-07-10 02:30 . 2009-02-05 20:06 51376 —-a-w- c:\windows\system32\drivers\aswTdi.sys
2009-07-10 02:30 . 2009-02-05 20:06 23152 —-a-w- c:\windows\system32\drivers\aswRdr.sys
2009-07-10 02:30 . 2009-02-05 20:05 26944 —-a-w- c:\windows\system32\drivers\aavmker4.sys
2009-07-10 02:30 . 2009-02-05 20:04 97480 —-a-w- c:\windows\system32\AvastSS.scr
2009-07-10 02:30 . 2009-02-05 20:08 93296 —-a-w- c:\windows\system32\drivers\aswmon.sys
2009-07-10 02:30 . 2009-02-05 20:08 94032 —-a-w- c:\windows\system32\drivers\aswmon2.sys
2009-07-10 02:30 . 2009-02-05 20:07 114768 —-a-w- c:\windows\system32\drivers\aswSP.sys
2009-07-10 02:30 . 2009-02-05 20:07 20560 —-a-w- c:\windows\system32\drivers\aswFsBlk.sys
2009-07-10 02:30 . 2009-02-05 20:11 1256296 —-a-w- c:\windows\system32\aswBoot.exe
2009-07-08 15:18 . 2009-07-21 04:18 ——– d—–w- c:\program files\iCall
2009-07-08 15:03 . 2009-07-08 15:05 ——– d—–w- c:\documents and settings\Gregg\Application Data\Vbuzzer Messenger
2009-07-08 15:02 . 2007-11-02 09:00 245760 —-a-w- c:\windows\system32\FaxHelper.exe
2009-07-08 15:02 . 2007-11-02 08:06 57344 —-a-w- c:\windows\system32\FaxMonitor.dll
2009-07-08 14:40 . 2009-07-08 14:52 ——– d—–w- c:\documents and settings\Gregg\Application Data\Paltalk
2009-07-07 19:27 . 2009-07-07 19:27 56 —ha-w- c:\windows\system32\ezsidmv.dat
2009-07-07 19:27 . 2009-07-08 13:52 ——– d—–w- c:\documents and settings\Gregg\Application Data\skypePM
2009-07-07 19:21 . 2009-07-07 19:21 ——– d—–w- c:\program files\Common Files\Skype
2009-07-03 19:33 . 2009-07-03 19:33 ——– d—–w- c:\program files\AMR to MP3 Converter
2009-06-26 16:18 . 2009-06-26 16:18 ——– d—–w- c:\program files\Common Files\xing shared

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-22 16:31 . 2009-06-14 16:01 12606752 –sha-w- c:\windows\system32\drivers\fidbox.dat
2009-07-22 16:30 . 2009-06-14 16:01 298016 –sha-w- c:\windows\system32\drivers\fidbox2.dat
2009-07-21 22:33 . 2008-07-20 21:45 ——– d—–w- c:\documents and settings\All Users\Application Data\Google Updater
2009-07-21 14:31 . 2009-01-05 21:56 ——– d—–w- c:\documents and settings\Gregg\Application Data\HPAppData
2009-07-21 03:27 . 2009-06-14 16:01 29312 –sha-w- c:\windows\system32\drivers\fidbox2.idx
2009-07-21 03:27 . 2009-06-14 16:01 169568 –sha-w- c:\windows\system32\drivers\fidbox.idx
2009-07-20 20:54 . 2006-12-09 16:27 664 —-a-w- c:\windows\system32\d3d9caps.dat
2009-07-18 20:22 . 2007-01-31 02:15 ——– d—–w- c:\documents and settings\Gregg\Application Data\U3
2009-07-17 15:59 . 2009-02-26 21:10 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2009-07-17 13:51 . 2007-05-03 13:23 ——– d—–w- c:\program files\mobile PhoneTools
2009-07-15 16:37 . 2007-08-18 14:59 ——– d—–w- c:\documents and settings\Gregg\Application Data\FrostWire
2009-07-14 20:06 . 2009-07-14 20:06 664 —-a-w- c:\documents and settings\Gregg\Local Settings\Application Data\d3d9caps.tmp
2009-07-14 20:04 . 2006-09-19 22:35 ——– d—–w- c:\documents and settings\All Users\Application Data\CyberLink
2009-07-14 18:45 . 2009-03-21 16:26 ——– d—–w- c:\program files\FrostWire
2009-07-13 17:36 . 2009-02-26 21:10 38160 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-07-13 17:36 . 2009-02-26 21:10 19096 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-07-10 15:02 . 2006-12-07 15:59 ——– d—–w- c:\documents and settings\All Users\Application Data\Retrospect
2009-07-09 14:28 . 2009-07-09 14:27 ——– d—–w- c:\program files\Polyphonic Wizard
2009-07-08 14:52 . 2006-09-19 22:46 ——– d—–w- c:\program files\Yahoo!
2009-07-08 13:55 . 2007-03-06 20:41 ——– d—–w- c:\documents and settings\Gregg\Application Data\Skype
2009-07-07 19:21 . 2007-03-06 20:40 ——– d—–r- c:\program files\Skype
2009-07-07 19:21 . 2007-03-06 20:41 ——– d—–w- c:\documents and settings\All Users\Application Data\Skype
2009-07-01 18:45 . 2008-02-12 04:07 ——– d—–w- c:\program files\YahELite
2009-06-26 16:19 . 2007-05-15 14:30 ——– d—–w- c:\program files\Common Files\Real
2009-06-26 16:18 . 2007-05-15 14:30 ——– d—–w- c:\program files\Real
2009-06-21 14:59 . 2009-06-14 15:51 ——– d—–w- c:\documents and settings\All Users\Application Data\ParetoLogic
2009-06-16 20:18 . 2007-08-27 05:21 ——– d—–w- c:\program files\NovaLogic
2009-06-16 20:18 . 2006-09-19 20:58 ——– d–h–w- c:\program files\InstallShield Installation Information
2009-06-16 14:36 . 2005-10-18 05:14 81920 —-a-w- c:\windows\system32\fontsub.dll
2009-06-16 14:36 . 2005-10-18 05:14 119808 —-a-w- c:\windows\system32\t2embed.dll
2009-06-15 06:33 . 2009-06-15 06:33 152576 —-a-w- c:\documents and settings\Gregg\Application Data\Sun\Java\jre1.6.0_14\lzma.dll
2009-06-14 15:52 . 2006-09-19 22:05 73632 -c–a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-06-14 15:51 . 2009-06-14 15:51 ——– d—–w- c:\documents and settings\All Users\Application Data\ParetoLogic Anti-Virus PLUS
2009-06-10 17:35 . 1999-04-14 00:24 11468 —-a-w- c:\windows\Fonts\COLLEGES.TTF
2009-06-10 17:35 . 1999-04-14 00:24 11192 —-a-w- c:\windows\Fonts\COLLEGEC.TTF
2009-06-10 17:35 . 1999-04-14 00:23 11476 —-a-w- c:\windows\Fonts\COLLEGEB.TTF
2009-06-10 17:35 . 1999-04-14 00:17 11336 —-a-w- c:\windows\Fonts\COLLEGE.TTF
2009-06-10 17:35 . 1998-05-25 17:32 1490 —-a-w- c:\windows\Fonts\COLLEGE.TXT
2009-06-08 14:49 . 2008-09-17 21:01 ——– d—–w- c:\program files\Thoosje Vista Sidebar
2009-06-08 14:48 . 2006-09-19 20:58 ——– d—–w- c:\program files\HP
2009-06-08 14:43 . 2009-06-08 14:43 ——– d—–w- c:\documents and settings\All Users\Application Data\AT&T
2009-06-08 14:30 . 2006-09-19 22:50 ——– d—–w- c:\program files\DivX
2009-06-08 14:28 . 2009-06-08 14:28 ——– d—–w- c:\program files\Common Files\DivX Shared
2009-06-06 17:14 . 2009-06-06 17:14 ——– d—–w- c:\program files\CamFrog
2009-06-03 19:09 . 2005-08-30 12:13 1291264 —-a-w- c:\windows\system32\quartz.dll
2009-05-28 19:43 . 2009-05-28 19:43 ——– d—–w- c:\documents and settings\Gregg\Application Data\Yahoo!
2009-05-28 19:42 . 2007-01-04 01:50 ——– d—–w- c:\documents and settings\All Users\Application Data\Yahoo!
2009-05-26 23:50 . 2009-06-15 06:05 607472 —-a-w- c:\documents and settings\All Users\Application Data\Yahoo!\YUpdater\yupdater.exe
2009-05-13 05:15 . 2006-03-16 04:00 915456 —-a-w- c:\windows\system32\wininet.dll
2009-05-11 00:53 . 2007-04-01 13:00 86016 —-a-w- c:\windows\system32\BtMmHook.dll
2009-05-11 00:53 . 2007-04-01 12:30 749568 —-a-w- c:\windows\system32\btrez.dll
2009-05-11 00:53 . 2009-05-11 00:55 876384 —-a-w- c:\windows\system32\drivers\btkrnl.sys
2009-05-11 00:53 . 2009-05-11 00:55 55352 —-a-w- c:\windows\system32\drivers\btwhid.sys
2009-05-11 00:53 . 2009-05-11 00:55 37424 —-a-w- c:\windows\system32\drivers\btport.sys
2009-05-11 00:53 . 2009-05-11 00:55 37280 —-a-w- c:\windows\system32\drivers\btwmodem.sys
2009-05-11 00:53 . 2009-05-11 00:55 149123 —-a-w- c:\windows\system32\drivers\btwdndis.sys
2009-05-11 00:53 . 2006-05-12 20:05 67960 —-a-w- c:\windows\system32\drivers\btwusb.sys
2009-05-11 00:53 . 2009-05-11 00:55 539072 —-a-w- c:\windows\system32\drivers\btaudio.sys
2009-05-07 15:32 . 2006-03-16 04:00 345600 —-a-w- c:\windows\system32\localspl.dll
2009-05-01 21:02 . 2009-05-01 21:02 90112 —-a-w- c:\windows\system32\dpl100.dll
2009-05-01 21:02 . 2009-05-01 21:02 823296 —-a-w- c:\windows\system32\divx_xx0c.dll
2009-05-01 21:02 . 2009-05-01 21:02 823296 —-a-w- c:\windows\system32\divx_xx07.dll
2009-05-01 21:02 . 2009-05-01 21:02 815104 —-a-w- c:\windows\system32\divx_xx0a.dll
2009-05-01 21:02 . 2009-05-01 21:02 811008 —-a-w- c:\windows\system32\divx_xx16.dll
2009-05-01 21:02 . 2009-05-01 21:02 802816 —-a-w- c:\windows\system32\divx_xx11.dll
2009-05-01 21:02 . 2009-05-01 21:02 685056 —-a-w- c:\windows\system32\DivX.dll
2009-05-01 18:30 . 2009-05-01 18:30 3366912 —-a-w- c:\windows\system32\GPhotos.scr
2006-12-05 15:33 . 2006-12-05 15:33 251 -c–a-w- c:\program files\wt3d.ini
2006-10-21 18:04 . 2006-10-21 18:04 480 –sha-r- c:\windows\dsrnthsove.dat
2006-12-16 01:05 . 2006-12-16 01:05 22 -csha-w- c:\windows\SMINST\HPCD.sys
2006-10-21 18:04 . 2006-10-21 18:04 480 –sha-r- c:\windows\system32\MSvonrsrvs.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"Messenger (Yahoo!)"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2009-05-27 4351216]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-10-19 204288]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpWirelessAssistant"="c:\program files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2006-05-04 458752]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-08-18 7585792]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-08-18 86016]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-04-01 761946]
"QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2006-07-12 102400]
"ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-08-11 249856]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-08-11 81920]
"QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2006-06-19 163840]
"Cpqset"="c:\program files\Hewlett-Packard\Default Settings\cpqset.exe" [2006-05-30 40960]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2008-03-26 49152]
"MaxMenuMgr"="c:\program files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe" [2008-07-17 177448]
"hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-03-13 81920]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"mumservice"="c:\program files\Motorola\Software Update\mumservice.exe" [2009-03-25 996608]
"CloneCDTray"="c:\program files\SlySoft\CloneCD\CloneCDTray.exe" [2003-10-26 57344]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-06-26 198160]
"iCall Internet Phone"="c:\program files\iCall\iCall.exe" [2008-12-18 1587576]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]
"RecGuard"="c:\windows\SMINST\RecGuard.exe" [2005-10-11 1187840]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-02-16 282624]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"NeroCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2007-03-02 257088]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-06 64512]
"dvd43"="c:\program files\dvd43\dvd43_tray.exe" [2008-11-17 827904]
"MsmqIntCert"="mqrt.dll" - c:\windows\system32\mqrt.dll [2008-04-14 177152]
"High Definition Audio Property Page Shortcut"="CHDAudPropShortcut.exe" - c:\windows\system32\CHDAudPropShortcut.exe [2006-06-02 61952]
"WD Button Manager"="WDBtnMgr.exe" - c:\windows\system32\WDBtnMgr.exe [2006-12-07 331776]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2006-08-18 1617920]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 39264]
"MySpaceIM"="c:\program files\MySpace\IM\MySpaceIM.exe" [2007-03-07 5181440]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-1-22 113664]
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2007-4-1 568176]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2008-3-25 214360]
HP Photosmart Premier Fast Start.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2005-9-24 73728]
hpoddt01.exe.lnk - c:\program files\HP\Digital Imaging\bin\hpotdd01.exe [2003-4-6 28672]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
officejet 6100.lnk - c:\program files\HP\Digital Imaging\bin\hposol08.exe [2003-4-6 147456]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\mqsvc.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Excursion9.5\\mIRC.ExCurSioN.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\FrostWire\\FrostWire.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\YahELite\\YahVox.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"=
"c:\\Program Files\\Common Files\\HP\\Digital Imaging\\Bin\\hpqPhotoCrm.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqpsapp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxs08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqpse.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqsudi.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgplgtupl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgpc01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"c:\\Program Files\\Motorola\\Software Update\\msu.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\iCall\\iCall.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
"1723:TCP"= 1723:TCP:@xpsp2res.dll,-22015
"1701:UDP"= 1701:UDP:@xpsp2res.dll,-22016
"500:UDP"= 500:UDP:@xpsp2res.dll,-22017
"427:UDP"= 427:UDP:SLP_Port(427)

R0 ntcdrdrv;ntcdrdrv;c:\windows\system32\drivers\ntcdrdrv.sys [8/30/2007 4:44 PM 13440]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [7/9/2009 10:30 PM 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [7/9/2009 10:30 PM 20560]
R2 FreeAgentGoNext Service;Seagate Service;c:\program files\Seagate\SeagateManager\Sync\FreeAgentService.exe [7/17/2008 6:12 PM 161064]
R2 SVKP;SVKP;c:\windows\system32\SVKP.sys [1/5/2007 9:25 AM 2368]
R3 5U870CAP_VID_1262&PID_25FD;HP Pavilion Webcam ;c:\windows\system32\drivers\5U870CAP.sys [6/6/2006 4:39 PM 61952]
S2 SSPORT;SSPORT;\??\c:\windows\system32\Drivers\SSPORT.sys –> c:\windows\system32\Drivers\SSPORT.sys [?]
S3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\DRIVERS\motccgp.sys –> c:\windows\system32\DRIVERS\motccgp.sys [?]
S3 motccgpfl;MotCcgpFlService;c:\windows\system32\DRIVERS\motccgpfl.sys –> c:\windows\system32\DRIVERS\motccgpfl.sys [?]
S3 motport;Motorola USB Diagnostic Port;c:\windows\system32\DRIVERS\motport.sys –> c:\windows\system32\DRIVERS\motport.sys [?]
S3 SWNC8U56;Sierra Wireless MUX NDIS Driver (UMTS56);c:\windows\system32\drivers\swnc8u56.sys [8/6/2008 12:33 PM 101248]
S3 SWUMX56;Sierra Wireless USB MUX Driver (UMTS56);c:\windows\system32\drivers\swumx56.sys [8/6/2008 12:33 PM 73856]

— Other Services/Drivers In Memory —

*NewlyCreated* - AUJASNKJ
*Deregistered* - aujasnkj

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
HPService REG_MULTI_SZ HPSLPSVC
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2009-07-20 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]

2009-07-21 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-07-20 19:06]

2009-07-22 c:\windows\Tasks\User_Feed_Synchronization-{5027FA4C-25FB-44B5-8605-6E98082C0E92}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 08:31]
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-Vbuzzer Messenger - c:\program files\vbuzzer\VBuzzer.exe

.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
uDefault_Search_URL = hxxp://www.google.com/ie
mStart Page = hxxp://www.yahoo.com/
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
uInternet Connection Wizard,ShellNext = iexplore
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Add to Vbuzzer RSS list - c:\program files\vbuzzer\addurl.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office10\EXCEL.EXE/3000
IE: Send to &Bluetooth Device… - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
DPF: {5E936384-B736-4A9E-AA93-832CA59FDCEC} - hxxp://www.respondus2.com/LDB/setup.exe
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-22 12:30
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = c:\program files\Hewlett-Packard\Default Settings\cpqset.exe????????????
scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2009-07-22 12:33
ComboFix-quarantined-files.txt 2009-07-22 16:33

Pre-Run: 15,320,535,040 bytes free
Post-Run: 16,461,352,960 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect

289 — E O F — 2009-07-16 07:04

Tomk

Post #6July 22, 2009, 5:35 PM UTC

maax,

COMBOFIX-Script

Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

File::
c:\program files\wt3d.ini
c:\windows\dsrnthsove.dat
c:\windows\system32\MSvonrsrvs.dll
c:\windows\SMINST\HPCD.sys

DDS::
DPF: {5E936384-B736-4A9E-AA93-832CA59FDCEC} - hxxp://www.respondus2.com/LDB/setup.exe

Driver::
SVKP
SSPORT

Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

[external image: Posted Image]
Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

maax

Post #7July 22, 2009, 6:43 PM UTC

ComboFix 09-07-22.01 - Gregg 07/22/2009 13:54.2.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.991.386 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Gregg\Desktop\CFScript.txt
AV: avast! antivirus 4.8.1335 [VPS 090720-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: Norton Internet Worm Protection *disabled* {990F9400-4CEE-43EA-A83A-D013ADD8EA6E}

FILE ::
"c:\program files\wt3d.ini"
"c:\windows\dsrnthsove.dat"
"c:\windows\SMINST\HPCD.sys"
"c:\windows\system32\MSvonrsrvs.dll"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\wt3d.ini
c:\windows\dsrnthsove.dat
c:\windows\SMINST\HPCD.sys
c:\windows\system32\MSvonrsrvs.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_SVKP
——-\Service_SSPORT
——-\Service_SVKP

((((((((((((((((((((((((( Files Created from 2009-06-22 to 2009-07-22 )))))))))))))))))))))))))))))))
.

2009-07-17 15:59 . 2009-07-17 15:59 3775175 —-a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2009-07-17 13:43 . 2009-07-17 14:44 ——– d—–w- c:\documents and settings\All Users\Application Data\SecTaskMan
2009-07-17 13:43 . 2009-07-17 13:45 ——– d—–w- c:\program files\Security Task Manager
2009-07-13 19:28 . 2009-07-13 19:28 ——– d—–w- C:\ApolloOutput
2009-07-13 15:47 . 2009-07-13 15:47 ——– d—–w- c:\windows\Performance
2009-07-13 15:46 . 2009-07-13 15:46 ——– d—–w- c:\documents and settings\Gregg\Local Settings\Application Data\Microsoft Corporation
2009-07-13 15:45 . 2009-07-13 15:45 ——– d—–w- c:\program files\Microsoft Windows 7 Upgrade Advisor
2009-07-10 15:15 . 2009-07-10 15:15 ——– d—–w- C:\temp
2009-07-10 02:30 . 2009-02-05 20:06 51376 —-a-w- c:\windows\system32\drivers\aswTdi.sys
2009-07-10 02:30 . 2009-02-05 20:06 23152 —-a-w- c:\windows\system32\drivers\aswRdr.sys
2009-07-10 02:30 . 2009-02-05 20:05 26944 —-a-w- c:\windows\system32\drivers\aavmker4.sys
2009-07-10 02:30 . 2009-02-05 20:04 97480 —-a-w- c:\windows\system32\AvastSS.scr
2009-07-10 02:30 . 2009-02-05 20:08 93296 —-a-w- c:\windows\system32\drivers\aswmon.sys
2009-07-10 02:30 . 2009-02-05 20:08 94032 —-a-w- c:\windows\system32\drivers\aswmon2.sys
2009-07-10 02:30 . 2009-02-05 20:07 114768 —-a-w- c:\windows\system32\drivers\aswSP.sys
2009-07-10 02:30 . 2009-02-05 20:07 20560 —-a-w- c:\windows\system32\drivers\aswFsBlk.sys
2009-07-10 02:30 . 2009-02-05 20:11 1256296 —-a-w- c:\windows\system32\aswBoot.exe
2009-07-08 15:18 . 2009-07-22 18:05 ——– d—–w- c:\program files\iCall
2009-07-08 15:03 . 2009-07-08 15:05 ——– d—–w- c:\documents and settings\Gregg\Application Data\Vbuzzer Messenger
2009-07-08 15:02 . 2007-11-02 09:00 245760 —-a-w- c:\windows\system32\FaxHelper.exe
2009-07-08 15:02 . 2007-11-02 08:06 57344 —-a-w- c:\windows\system32\FaxMonitor.dll
2009-07-08 14:40 . 2009-07-08 14:52 ——– d—–w- c:\documents and settings\Gregg\Application Data\Paltalk
2009-07-07 19:27 . 2009-07-07 19:27 56 —ha-w- c:\windows\system32\ezsidmv.dat
2009-07-07 19:27 . 2009-07-08 13:52 ——– d—–w- c:\documents and settings\Gregg\Application Data\skypePM
2009-07-07 19:21 . 2009-07-07 19:21 ——– d—–w- c:\program files\Common Files\Skype
2009-07-03 19:33 . 2009-07-03 19:33 ——– d—–w- c:\program files\AMR to MP3 Converter
2009-06-26 16:18 . 2009-06-26 16:18 ——– d—–w- c:\program files\Common Files\xing shared

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-22 18:09 . 2009-06-14 16:01 305440 –sha-w- c:\windows\system32\drivers\fidbox2.dat
2009-07-22 18:08 . 2009-06-14 16:01 12741152 –sha-w- c:\windows\system32\drivers\fidbox.dat
2009-07-22 18:02 . 2009-06-14 16:01 30608 –sha-w- c:\windows\system32\drivers\fidbox2.idx
2009-07-22 18:02 . 2009-06-14 16:01 175772 –sha-w- c:\windows\system32\drivers\fidbox.idx
2009-07-22 16:42 . 2009-01-05 21:56 ——– d—–w- c:\documents and settings\Gregg\Application Data\HPAppData
2009-07-21 22:33 . 2008-07-20 21:45 ——– d—–w- c:\documents and settings\All Users\Application Data\Google Updater
2009-07-20 20:54 . 2006-12-09 16:27 664 —-a-w- c:\windows\system32\d3d9caps.dat
2009-07-18 20:22 . 2007-01-31 02:15 ——– d—–w- c:\documents and settings\Gregg\Application Data\U3
2009-07-17 15:59 . 2009-02-26 21:10 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2009-07-17 13:51 . 2007-05-03 13:23 ——– d—–w- c:\program files\mobile PhoneTools
2009-07-15 16:37 . 2007-08-18 14:59 ——– d—–w- c:\documents and settings\Gregg\Application Data\FrostWire
2009-07-14 20:06 . 2009-07-14 20:06 664 —-a-w- c:\documents and settings\Gregg\Local Settings\Application Data\d3d9caps.tmp
2009-07-14 20:04 . 2006-09-19 22:35 ——– d—–w- c:\documents and settings\All Users\Application Data\CyberLink
2009-07-14 18:45 . 2009-03-21 16:26 ——– d—–w- c:\program files\FrostWire
2009-07-13 17:36 . 2009-02-26 21:10 38160 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-07-13 17:36 . 2009-02-26 21:10 19096 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-07-10 15:02 . 2006-12-07 15:59 ——– d—–w- c:\documents and settings\All Users\Application Data\Retrospect
2009-07-09 14:28 . 2009-07-09 14:27 ——– d—–w- c:\program files\Polyphonic Wizard
2009-07-08 14:52 . 2006-09-19 22:46 ——– d—–w- c:\program files\Yahoo!
2009-07-08 13:55 . 2007-03-06 20:41 ——– d—–w- c:\documents and settings\Gregg\Application Data\Skype
2009-07-07 19:21 . 2007-03-06 20:40 ——– d—–r- c:\program files\Skype
2009-07-07 19:21 . 2007-03-06 20:41 ——– d—–w- c:\documents and settings\All Users\Application Data\Skype
2009-07-01 18:45 . 2008-02-12 04:07 ——– d—–w- c:\program files\YahELite
2009-06-26 16:19 . 2007-05-15 14:30 ——– d—–w- c:\program files\Common Files\Real
2009-06-26 16:18 . 2007-05-15 14:30 ——– d—–w- c:\program files\Real
2009-06-21 14:59 . 2009-06-14 15:51 ——– d—–w- c:\documents and settings\All Users\Application Data\ParetoLogic
2009-06-16 20:18 . 2007-08-27 05:21 ——– d—–w- c:\program files\NovaLogic
2009-06-16 20:18 . 2006-09-19 20:58 ——– d–h–w- c:\program files\InstallShield Installation Information
2009-06-16 14:36 . 2005-10-18 05:14 81920 —-a-w- c:\windows\system32\fontsub.dll
2009-06-16 14:36 . 2005-10-18 05:14 119808 —-a-w- c:\windows\system32\t2embed.dll
2009-06-15 06:33 . 2009-06-15 06:33 152576 —-a-w- c:\documents and settings\Gregg\Application Data\Sun\Java\jre1.6.0_14\lzma.dll
2009-06-14 15:52 . 2006-09-19 22:05 73632 -c–a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-06-14 15:51 . 2009-06-14 15:51 ——– d—–w- c:\documents and settings\All Users\Application Data\ParetoLogic Anti-Virus PLUS
2009-06-10 17:35 . 1999-04-14 00:24 11468 —-a-w- c:\windows\Fonts\COLLEGES.TTF
2009-06-10 17:35 . 1999-04-14 00:24 11192 —-a-w- c:\windows\Fonts\COLLEGEC.TTF
2009-06-10 17:35 . 1999-04-14 00:23 11476 —-a-w- c:\windows\Fonts\COLLEGEB.TTF
2009-06-10 17:35 . 1999-04-14 00:17 11336 —-a-w- c:\windows\Fonts\COLLEGE.TTF
2009-06-10 17:35 . 1998-05-25 17:32 1490 —-a-w- c:\windows\Fonts\COLLEGE.TXT
2009-06-08 14:49 . 2008-09-17 21:01 ——– d—–w- c:\program files\Thoosje Vista Sidebar
2009-06-08 14:48 . 2006-09-19 20:58 ——– d—–w- c:\program files\HP
2009-06-08 14:43 . 2009-06-08 14:43 ——– d—–w- c:\documents and settings\All Users\Application Data\AT&T
2009-06-08 14:30 . 2006-09-19 22:50 ——– d—–w- c:\program files\DivX
2009-06-08 14:28 . 2009-06-08 14:28 ——– d—–w- c:\program files\Common Files\DivX Shared
2009-06-06 17:14 . 2009-06-06 17:14 ——– d—–w- c:\program files\CamFrog
2009-06-03 19:09 . 2005-08-30 12:13 1291264 —-a-w- c:\windows\system32\quartz.dll
2009-05-28 19:43 . 2009-05-28 19:43 ——– d—–w- c:\documents and settings\Gregg\Application Data\Yahoo!
2009-05-28 19:42 . 2007-01-04 01:50 ——– d—–w- c:\documents and settings\All Users\Application Data\Yahoo!
2009-05-26 23:50 . 2009-06-15 06:05 607472 —-a-w- c:\documents and settings\All Users\Application Data\Yahoo!\YUpdater\yupdater.exe
2009-05-13 05:15 . 2006-03-16 04:00 915456 —-a-w- c:\windows\system32\wininet.dll
2009-05-11 00:53 . 2007-04-01 13:00 86016 —-a-w- c:\windows\system32\BtMmHook.dll
2009-05-11 00:53 . 2007-04-01 12:30 749568 —-a-w- c:\windows\system32\btrez.dll
2009-05-11 00:53 . 2009-05-11 00:55 876384 —-a-w- c:\windows\system32\drivers\btkrnl.sys
2009-05-11 00:53 . 2009-05-11 00:55 55352 —-a-w- c:\windows\system32\drivers\btwhid.sys
2009-05-11 00:53 . 2009-05-11 00:55 37424 —-a-w- c:\windows\system32\drivers\btport.sys
2009-05-11 00:53 . 2009-05-11 00:55 37280 —-a-w- c:\windows\system32\drivers\btwmodem.sys
2009-05-11 00:53 . 2009-05-11 00:55 149123 —-a-w- c:\windows\system32\drivers\btwdndis.sys
2009-05-11 00:53 . 2006-05-12 20:05 67960 —-a-w- c:\windows\system32\drivers\btwusb.sys
2009-05-11 00:53 . 2009-05-11 00:55 539072 —-a-w- c:\windows\system32\drivers\btaudio.sys
2009-05-07 15:32 . 2006-03-16 04:00 345600 —-a-w- c:\windows\system32\localspl.dll
2009-05-01 21:02 . 2009-05-01 21:02 90112 —-a-w- c:\windows\system32\dpl100.dll
2009-05-01 21:02 . 2009-05-01 21:02 823296 —-a-w- c:\windows\system32\divx_xx0c.dll
2009-05-01 21:02 . 2009-05-01 21:02 823296 —-a-w- c:\windows\system32\divx_xx07.dll
2009-05-01 21:02 . 2009-05-01 21:02 815104 —-a-w- c:\windows\system32\divx_xx0a.dll
2009-05-01 21:02 . 2009-05-01 21:02 811008 —-a-w- c:\windows\system32\divx_xx16.dll
2009-05-01 21:02 . 2009-05-01 21:02 802816 —-a-w- c:\windows\system32\divx_xx11.dll
2009-05-01 21:02 . 2009-05-01 21:02 685056 —-a-w- c:\windows\system32\DivX.dll
2009-05-01 18:30 . 2009-05-01 18:30 3366912 —-a-w- c:\windows\system32\GPhotos.scr
.

((((((((((((((((((((((((((((( SnapShot@2009-07-22_16.30.37 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-07-22 18:03 . 2009-07-22 18:03 16384 c:\windows\temp\Perflib_Perfdata_740.dat
+ 2009-07-22 18:03 . 2009-07-22 18:03 16384 c:\windows\temp\Perflib_Perfdata_6c8.dat
+ 2008-08-22 12:57 . 2009-07-22 18:07 227731 c:\windows\system32\inetsrv\MetaBase.bin
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"Messenger (Yahoo!)"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2009-05-27 4351216]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-10-19 204288]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpWirelessAssistant"="c:\program files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2006-05-04 458752]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-08-18 7585792]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-08-18 86016]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-04-01 761946]
"QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2006-07-12 102400]
"ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-08-11 249856]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-08-11 81920]
"QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2006-06-19 163840]
"Cpqset"="c:\program files\Hewlett-Packard\Default Settings\cpqset.exe" [2006-05-30 40960]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2008-03-26 49152]
"MaxMenuMgr"="c:\program files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe" [2008-07-17 177448]
"hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-03-13 81920]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"mumservice"="c:\program files\Motorola\Software Update\mumservice.exe" [2009-03-25 996608]
"CloneCDTray"="c:\program files\SlySoft\CloneCD\CloneCDTray.exe" [2003-10-26 57344]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-06-26 198160]
"iCall Internet Phone"="c:\program files\iCall\iCall.exe" [2008-12-18 1587576]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]
"RecGuard"="c:\windows\SMINST\RecGuard.exe" [2005-10-11 1187840]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-02-16 282624]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"NeroCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2007-03-02 257088]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-06 64512]
"dvd43"="c:\program files\dvd43\dvd43_tray.exe" [2008-11-17 827904]
"MsmqIntCert"="mqrt.dll" - c:\windows\system32\mqrt.dll [2008-04-14 177152]
"High Definition Audio Property Page Shortcut"="CHDAudPropShortcut.exe" - c:\windows\system32\CHDAudPropShortcut.exe [2006-06-02 61952]
"WD Button Manager"="WDBtnMgr.exe" - c:\windows\system32\WDBtnMgr.exe [2006-12-07 331776]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2006-08-18 1617920]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 39264]
"MySpaceIM"="c:\program files\MySpace\IM\MySpaceIM.exe" [2007-03-07 5181440]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-1-22 113664]
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2007-4-1 568176]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2008-3-25 214360]
HP Photosmart Premier Fast Start.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2005-9-24 73728]
hpoddt01.exe.lnk - c:\program files\HP\Digital Imaging\bin\hpotdd01.exe [2003-4-6 28672]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
officejet 6100.lnk - c:\program files\HP\Digital Imaging\bin\hposol08.exe [2003-4-6 147456]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\mqsvc.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Excursion9.5\\mIRC.ExCurSioN.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\FrostWire\\FrostWire.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\YahELite\\YahVox.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"=
"c:\\Program Files\\Common Files\\HP\\Digital Imaging\\Bin\\hpqPhotoCrm.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqpsapp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxs08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqpse.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqsudi.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgplgtupl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgpc01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"c:\\Program Files\\Motorola\\Software Update\\msu.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\iCall\\iCall.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
"1723:TCP"= 1723:TCP:@xpsp2res.dll,-22015
"1701:UDP"= 1701:UDP:@xpsp2res.dll,-22016
"500:UDP"= 500:UDP:@xpsp2res.dll,-22017
"427:UDP"= 427:UDP:SLP_Port(427)

R0 ntcdrdrv;ntcdrdrv;c:\windows\system32\drivers\ntcdrdrv.sys [8/30/2007 4:44 PM 13440]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [7/9/2009 10:30 PM 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [7/9/2009 10:30 PM 20560]
R2 FreeAgentGoNext Service;Seagate Service;c:\program files\Seagate\SeagateManager\Sync\FreeAgentService.exe [7/17/2008 6:12 PM 161064]
R3 5U870CAP_VID_1262&PID_25FD;HP Pavilion Webcam ;c:\windows\system32\drivers\5U870CAP.sys [6/6/2006 4:39 PM 61952]
S3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\DRIVERS\motccgp.sys –> c:\windows\system32\DRIVERS\motccgp.sys [?]
S3 motccgpfl;MotCcgpFlService;c:\windows\system32\DRIVERS\motccgpfl.sys –> c:\windows\system32\DRIVERS\motccgpfl.sys [?]
S3 motport;Motorola USB Diagnostic Port;c:\windows\system32\DRIVERS\motport.sys –> c:\windows\system32\DRIVERS\motport.sys [?]
S3 SWNC8U56;Sierra Wireless MUX NDIS Driver (UMTS56);c:\windows\system32\drivers\swnc8u56.sys [8/6/2008 12:33 PM 101248]
S3 SWUMX56;Sierra Wireless USB MUX Driver (UMTS56);c:\windows\system32\drivers\swumx56.sys [8/6/2008 12:33 PM 73856]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
HPService REG_MULTI_SZ HPSLPSVC
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2009-07-20 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]

2009-07-22 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-07-20 19:06]

2009-07-22 c:\windows\Tasks\User_Feed_Synchronization-{5027FA4C-25FB-44B5-8605-6E98082C0E92}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 08:31]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
uDefault_Search_URL = hxxp://www.google.com/ie
mStart Page = hxxp://www.yahoo.com/
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
uInternet Connection Wizard,ShellNext = iexplore
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Add to Vbuzzer RSS list - c:\program files\vbuzzer\addurl.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office10\EXCEL.EXE/3000
IE: Send to &Bluetooth Device… - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-22 14:06
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = c:\program files\Hewlett-Packard\Default Settings\cpqset.exe????????????
scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'explorer.exe'(4860)
c:\windows\system32\WININET.dll
c:\windows\system32\btmmhook.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\btncopy.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\windows\system32\msdtc.exe
c:\windows\ehome\ehrecvr.exe
c:\windows\ehome\ehSched.exe
c:\windows\system32\inetsrv\inetinfo.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
c:\windows\system32\nvsvc32.exe
c:\program files\Dantz\Retrospect\retrorun.exe
c:\progra~1\Dantz\RETROS~1\wdsvc.exe
c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe
c:\windows\ehome\mcrdsvc.exe
c:\windows\system32\mqsvc.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\system32\mqtgsvc.exe
c:\windows\system32\rundll32.exe
c:\program files\Alwil Software\Avast4\ashMaiSv.exe
c:\program files\Alwil Software\Avast4\ashWebSv.exe
c:\windows\system32\dllhost.exe
c:\program files\HP\Digital Imaging\bin\hpqimzone.exe
c:\program files\iPod\bin\iPodService.exe
c:\windows\ehome\ehmsas.exe
c:\program files\Yahoo!\Messenger\Ymsgr_tray.exe
c:\program files\HP\Digital Imaging\bin\hpqste08.exe
c:\program files\HP\Digital Imaging\bin\hpqbam08.exe
c:\program files\HP\Digital Imaging\bin\hpqgpc01.exe
.
**************************************************************************
.
Completion time: 2009-07-22 14:13 - machine was rebooted
ComboFix-quarantined-files.txt 2009-07-22 18:13
ComboFix2.txt 2009-07-22 16:33

Pre-Run: 16,477,925,376 bytes free
Post-Run: 16,318,898,176 bytes free

330 — E O F — 2009-07-16 07:04

Tomk

Post #8July 22, 2009, 6:55 PM UTC

maax,

Please go to Kaspersky website and perform an online antivirus scan.

Read through the requirements and privacy statement and click on Accept button.
It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
When the downloads have finished, click on Settings.
Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
- Spyware, Adware, Dialers, and other potentially dangerous programs
  Archives
  Mail databases
Click on My Computer under Scan.
Once the scan is complete, it will display the results. Click on View Scan Report.
You will see a list of infected items there. Click on Save Report As….
Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
Please post this log in your next reply.

Also please post me a new HijackThis log and let me know how it is running.

maax

Post #9July 23, 2009, 5:21 PM UTC

——————————————————————————– KASPERSKY ONLINE SCANNER 7.0 REPORT Thursday, July 23, 2009 Operating System: Microsoft Windows XP Professional Service Pack 3 (build 2600) Kaspersky Online Scanner version: 7.0.26.13 Program database last update: Thursday, July 23, 2009 00:49:25 Records in database: 2516115 ——————————————————————————– Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - My Computer: C:\ D:\ E:\ F:\ Scan statistics: Files scanned: 131152 Threat name: 2 Infected objects: 7 Suspicious objects: 0 Duration of the scan: 05:08:04 File name / Threat name / Threats count C:\Documents and Settings\Gregg\Desktop\ExcursionKR31.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.616 1 C:\Documents and Settings\Gregg\Shared\Abba - The way old friends do.mp3 Infected: Trojan-Downloader.WMA.GetCodec.c 1 C:\Excursion9.5\mIRC.ExCurSioN.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.616 1 C:\Karaoke Software\ExcursionKR31.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.616 1 C:\Karaoke Software\mIRC.ExCurSioN.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.616 1 C:\System Volume Information\_restore{3A579F61-82CF-4117-919A-DB7B394CD5BC}\RP548\A0082232.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.616 1 C:\System Volume Information\_restore{3A579F61-82CF-4117-919A-DB7B394CD5BC}\RP551\A0083464.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.616 1 The selected area was scanned. I do not want to delete the "Excursion" program.

Tomk

Post #10July 23, 2009, 5:27 PM UTC

maax,

That's not to bad. You have one infected music file.

COMBOFIX-Script

Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:
```
File::
C:\Documents and Settings\Gregg\Shared\Abba - The way old friends do.mp3
```
Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

[external image: Posted Image]
Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
If ComboFix asks to update… let it.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

Then please post a new HijackThis log and let me know how it's running.

maax

Post #11July 23, 2009, 6:44 PM UTC

ComboFix 09-07-23.01 - Gregg 07/23/2009 14:27.3.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.991.587 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Gregg\Desktop\CFScript.txt
AV: avast! antivirus 4.8.1335 [VPS 090722-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: Norton Internet Worm Protection *disabled* {990F9400-4CEE-43EA-A83A-D013ADD8EA6E}

FILE ::
"c:\documents and settings\Gregg\Shared\Abba - The way old friends do.mp3"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Gregg\Shared\Abba - The way old friends do.mp3

.
((((((((((((((((((((((((( Files Created from 2009-06-23 to 2009-07-23 )))))))))))))))))))))))))))))))
.

2009-07-17 15:59 . 2009-07-17 15:59 3775175 —-a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2009-07-17 13:43 . 2009-07-17 14:44 ——– d—–w- c:\documents and settings\All Users\Application Data\SecTaskMan
2009-07-17 13:43 . 2009-07-17 13:45 ——– d—–w- c:\program files\Security Task Manager
2009-07-13 19:28 . 2009-07-13 19:28 ——– d—–w- C:\ApolloOutput
2009-07-13 15:47 . 2009-07-13 15:47 ——– d—–w- c:\windows\Performance
2009-07-13 15:46 . 2009-07-13 15:46 ——– d—–w- c:\documents and settings\Gregg\Local Settings\Application Data\Microsoft Corporation
2009-07-13 15:45 . 2009-07-13 15:45 ——– d—–w- c:\program files\Microsoft Windows 7 Upgrade Advisor
2009-07-10 15:15 . 2009-07-10 15:15 ——– d—–w- C:\temp
2009-07-10 02:30 . 2009-02-05 20:06 51376 —-a-w- c:\windows\system32\drivers\aswTdi.sys
2009-07-10 02:30 . 2009-02-05 20:06 23152 —-a-w- c:\windows\system32\drivers\aswRdr.sys
2009-07-10 02:30 . 2009-02-05 20:05 26944 —-a-w- c:\windows\system32\drivers\aavmker4.sys
2009-07-10 02:30 . 2009-02-05 20:04 97480 —-a-w- c:\windows\system32\AvastSS.scr
2009-07-10 02:30 . 2009-02-05 20:08 93296 —-a-w- c:\windows\system32\drivers\aswmon.sys
2009-07-10 02:30 . 2009-02-05 20:08 94032 —-a-w- c:\windows\system32\drivers\aswmon2.sys
2009-07-10 02:30 . 2009-02-05 20:07 114768 —-a-w- c:\windows\system32\drivers\aswSP.sys
2009-07-10 02:30 . 2009-02-05 20:07 20560 —-a-w- c:\windows\system32\drivers\aswFsBlk.sys
2009-07-10 02:30 . 2009-02-05 20:11 1256296 —-a-w- c:\windows\system32\aswBoot.exe
2009-07-08 15:18 . 2009-07-22 18:05 ——– d—–w- c:\program files\iCall
2009-07-08 15:03 . 2009-07-08 15:05 ——– d—–w- c:\documents and settings\Gregg\Application Data\Vbuzzer Messenger
2009-07-08 15:02 . 2007-11-02 09:00 245760 —-a-w- c:\windows\system32\FaxHelper.exe
2009-07-08 15:02 . 2007-11-02 08:06 57344 —-a-w- c:\windows\system32\FaxMonitor.dll
2009-07-08 14:40 . 2009-07-08 14:52 ——– d—–w- c:\documents and settings\Gregg\Application Data\Paltalk
2009-07-07 19:27 . 2009-07-07 19:27 56 —ha-w- c:\windows\system32\ezsidmv.dat
2009-07-07 19:27 . 2009-07-08 13:52 ——– d—–w- c:\documents and settings\Gregg\Application Data\skypePM
2009-07-07 19:21 . 2009-07-07 19:21 ——– d—–w- c:\program files\Common Files\Skype
2009-07-03 19:33 . 2009-07-03 19:33 ——– d—–w- c:\program files\AMR to MP3 Converter
2009-06-26 16:18 . 2009-06-26 16:18 ——– d—–w- c:\program files\Common Files\xing shared

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-23 18:36 . 2009-06-14 16:01 13002784 –sha-w- c:\windows\system32\drivers\fidbox.dat
2009-07-23 18:35 . 2009-06-14 16:01 314400 –sha-w- c:\windows\system32\drivers\fidbox2.dat
2009-07-22 23:34 . 2008-07-20 21:45 ——– d—–w- c:\documents and settings\All Users\Application Data\Google Updater
2009-07-22 18:47 . 2009-01-05 21:56 ——– d—–w- c:\documents and settings\Gregg\Application Data\HPAppData
2009-07-22 18:02 . 2009-06-14 16:01 30608 –sha-w- c:\windows\system32\drivers\fidbox2.idx
2009-07-22 18:02 . 2009-06-14 16:01 175772 –sha-w- c:\windows\system32\drivers\fidbox.idx
2009-07-20 20:54 . 2006-12-09 16:27 664 —-a-w- c:\windows\system32\d3d9caps.dat
2009-07-18 20:22 . 2007-01-31 02:15 ——– d—–w- c:\documents and settings\Gregg\Application Data\U3
2009-07-17 15:59 . 2009-02-26 21:10 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2009-07-17 13:51 . 2007-05-03 13:23 ——– d—–w- c:\program files\mobile PhoneTools
2009-07-15 16:37 . 2007-08-18 14:59 ——– d—–w- c:\documents and settings\Gregg\Application Data\FrostWire
2009-07-14 20:06 . 2009-07-14 20:06 664 —-a-w- c:\documents and settings\Gregg\Local Settings\Application Data\d3d9caps.tmp
2009-07-14 20:04 . 2006-09-19 22:35 ——– d—–w- c:\documents and settings\All Users\Application Data\CyberLink
2009-07-14 18:45 . 2009-03-21 16:26 ——– d—–w- c:\program files\FrostWire
2009-07-13 17:36 . 2009-02-26 21:10 38160 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-07-13 17:36 . 2009-02-26 21:10 19096 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-07-10 15:02 . 2006-12-07 15:59 ——– d—–w- c:\documents and settings\All Users\Application Data\Retrospect
2009-07-09 14:28 . 2009-07-09 14:27 ——– d—–w- c:\program files\Polyphonic Wizard
2009-07-08 14:52 . 2006-09-19 22:46 ——– d—–w- c:\program files\Yahoo!
2009-07-08 13:55 . 2007-03-06 20:41 ——– d—–w- c:\documents and settings\Gregg\Application Data\Skype
2009-07-07 19:21 . 2007-03-06 20:40 ——– d—–r- c:\program files\Skype
2009-07-07 19:21 . 2007-03-06 20:41 ——– d—–w- c:\documents and settings\All Users\Application Data\Skype
2009-07-01 18:45 . 2008-02-12 04:07 ——– d—–w- c:\program files\YahELite
2009-06-26 16:19 . 2007-05-15 14:30 ——– d—–w- c:\program files\Common Files\Real
2009-06-26 16:18 . 2007-05-15 14:30 ——– d—–w- c:\program files\Real
2009-06-21 14:59 . 2009-06-14 15:51 ——– d—–w- c:\documents and settings\All Users\Application Data\ParetoLogic
2009-06-16 20:18 . 2007-08-27 05:21 ——– d—–w- c:\program files\NovaLogic
2009-06-16 20:18 . 2006-09-19 20:58 ——– d–h–w- c:\program files\InstallShield Installation Information
2009-06-16 14:36 . 2005-10-18 05:14 81920 —-a-w- c:\windows\system32\fontsub.dll
2009-06-16 14:36 . 2005-10-18 05:14 119808 —-a-w- c:\windows\system32\t2embed.dll
2009-06-15 06:33 . 2009-06-15 06:33 152576 —-a-w- c:\documents and settings\Gregg\Application Data\Sun\Java\jre1.6.0_14\lzma.dll
2009-06-14 15:52 . 2006-09-19 22:05 73632 -c–a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-06-14 15:51 . 2009-06-14 15:51 ——– d—–w- c:\documents and settings\All Users\Application Data\ParetoLogic Anti-Virus PLUS
2009-06-10 17:35 . 1999-04-14 00:24 11468 —-a-w- c:\windows\Fonts\COLLEGES.TTF
2009-06-10 17:35 . 1999-04-14 00:24 11192 —-a-w- c:\windows\Fonts\COLLEGEC.TTF
2009-06-10 17:35 . 1999-04-14 00:23 11476 —-a-w- c:\windows\Fonts\COLLEGEB.TTF
2009-06-10 17:35 . 1999-04-14 00:17 11336 —-a-w- c:\windows\Fonts\COLLEGE.TTF
2009-06-10 17:35 . 1998-05-25 17:32 1490 —-a-w- c:\windows\Fonts\COLLEGE.TXT
2009-06-08 14:49 . 2008-09-17 21:01 ——– d—–w- c:\program files\Thoosje Vista Sidebar
2009-06-08 14:48 . 2006-09-19 20:58 ——– d—–w- c:\program files\HP
2009-06-08 14:43 . 2009-06-08 14:43 ——– d—–w- c:\documents and settings\All Users\Application Data\AT&T
2009-06-08 14:30 . 2006-09-19 22:50 ——– d—–w- c:\program files\DivX
2009-06-08 14:28 . 2009-06-08 14:28 ——– d—–w- c:\program files\Common Files\DivX Shared
2009-06-06 17:14 . 2009-06-06 17:14 ——– d—–w- c:\program files\CamFrog
2009-06-03 19:09 . 2005-08-30 12:13 1291264 —-a-w- c:\windows\system32\quartz.dll
2009-05-28 19:43 . 2009-05-28 19:43 ——– d—–w- c:\documents and settings\Gregg\Application Data\Yahoo!
2009-05-28 19:42 . 2007-01-04 01:50 ——– d—–w- c:\documents and settings\All Users\Application Data\Yahoo!
2009-05-26 23:50 . 2009-06-15 06:05 607472 —-a-w- c:\documents and settings\All Users\Application Data\Yahoo!\YUpdater\yupdater.exe
2009-05-13 05:15 . 2006-03-16 04:00 915456 —-a-w- c:\windows\system32\wininet.dll
2009-05-11 00:53 . 2007-04-01 13:00 86016 —-a-w- c:\windows\system32\BtMmHook.dll
2009-05-11 00:53 . 2007-04-01 12:30 749568 —-a-w- c:\windows\system32\btrez.dll
2009-05-11 00:53 . 2009-05-11 00:55 876384 —-a-w- c:\windows\system32\drivers\btkrnl.sys
2009-05-11 00:53 . 2009-05-11 00:55 55352 —-a-w- c:\windows\system32\drivers\btwhid.sys
2009-05-11 00:53 . 2009-05-11 00:55 37424 —-a-w- c:\windows\system32\drivers\btport.sys
2009-05-11 00:53 . 2009-05-11 00:55 37280 —-a-w- c:\windows\system32\drivers\btwmodem.sys
2009-05-11 00:53 . 2009-05-11 00:55 149123 —-a-w- c:\windows\system32\drivers\btwdndis.sys
2009-05-11 00:53 . 2006-05-12 20:05 67960 —-a-w- c:\windows\system32\drivers\btwusb.sys
2009-05-11 00:53 . 2009-05-11 00:55 539072 —-a-w- c:\windows\system32\drivers\btaudio.sys
2009-05-07 15:32 . 2006-03-16 04:00 345600 —-a-w- c:\windows\system32\localspl.dll
2009-05-01 21:02 . 2009-05-01 21:02 90112 —-a-w- c:\windows\system32\dpl100.dll
2009-05-01 21:02 . 2009-05-01 21:02 823296 —-a-w- c:\windows\system32\divx_xx0c.dll
2009-05-01 21:02 . 2009-05-01 21:02 823296 —-a-w- c:\windows\system32\divx_xx07.dll
2009-05-01 21:02 . 2009-05-01 21:02 815104 —-a-w- c:\windows\system32\divx_xx0a.dll
2009-05-01 21:02 . 2009-05-01 21:02 811008 —-a-w- c:\windows\system32\divx_xx16.dll
2009-05-01 21:02 . 2009-05-01 21:02 802816 —-a-w- c:\windows\system32\divx_xx11.dll
2009-05-01 21:02 . 2009-05-01 21:02 685056 —-a-w- c:\windows\system32\DivX.dll
2009-05-01 18:30 . 2009-05-01 18:30 3366912 —-a-w- c:\windows\system32\GPhotos.scr
.

((((((((((((((((((((((((((((( SnapShot@2009-07-22_16.30.37 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-07-22 18:03 . 2009-07-22 18:03 16384 c:\windows\temp\Perflib_Perfdata_740.dat
+ 2009-07-22 18:03 . 2009-07-22 18:03 16384 c:\windows\temp\Perflib_Perfdata_6c8.dat
+ 2008-08-22 12:57 . 2009-07-22 18:07 227731 c:\windows\system32\inetsrv\MetaBase.bin
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"Messenger (Yahoo!)"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2009-05-27 4351216]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-10-19 204288]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpWirelessAssistant"="c:\program files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2006-05-04 458752]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-08-18 7585792]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-08-18 86016]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-04-01 761946]
"QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2006-07-12 102400]
"ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-08-11 249856]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-08-11 81920]
"QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2006-06-19 163840]
"Cpqset"="c:\program files\Hewlett-Packard\Default Settings\cpqset.exe" [2006-05-30 40960]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2008-03-26 49152]
"MaxMenuMgr"="c:\program files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe" [2008-07-17 177448]
"hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-03-13 81920]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"mumservice"="c:\program files\Motorola\Software Update\mumservice.exe" [2009-03-25 996608]
"CloneCDTray"="c:\program files\SlySoft\CloneCD\CloneCDTray.exe" [2003-10-26 57344]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-06-26 198160]
"iCall Internet Phone"="c:\program files\iCall\iCall.exe" [2008-12-18 1587576]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]
"RecGuard"="c:\windows\SMINST\RecGuard.exe" [2005-10-11 1187840]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-02-16 282624]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"NeroCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2007-03-02 257088]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-06 64512]
"dvd43"="c:\program files\dvd43\dvd43_tray.exe" [2008-11-17 827904]
"MsmqIntCert"="mqrt.dll" - c:\windows\system32\mqrt.dll [2008-04-14 177152]
"High Definition Audio Property Page Shortcut"="CHDAudPropShortcut.exe" - c:\windows\system32\CHDAudPropShortcut.exe [2006-06-02 61952]
"WD Button Manager"="WDBtnMgr.exe" - c:\windows\system32\WDBtnMgr.exe [2006-12-07 331776]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2006-08-18 1617920]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 39264]
"MySpaceIM"="c:\program files\MySpace\IM\MySpaceIM.exe" [2007-03-07 5181440]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-1-22 113664]
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2007-4-1 568176]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2008-3-25 214360]
HP Photosmart Premier Fast Start.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2005-9-24 73728]
hpoddt01.exe.lnk - c:\program files\HP\Digital Imaging\bin\hpotdd01.exe [2003-4-6 28672]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
officejet 6100.lnk - c:\program files\HP\Digital Imaging\bin\hposol08.exe [2003-4-6 147456]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\mqsvc.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Excursion9.5\\mIRC.ExCurSioN.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\FrostWire\\FrostWire.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\YahELite\\YahVox.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"=
"c:\\Program Files\\Common Files\\HP\\Digital Imaging\\Bin\\hpqPhotoCrm.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqpsapp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxs08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqpse.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqsudi.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgplgtupl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgpc01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"c:\\Program Files\\Motorola\\Software Update\\msu.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\iCall\\iCall.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
"1723:TCP"= 1723:TCP:@xpsp2res.dll,-22015
"1701:UDP"= 1701:UDP:@xpsp2res.dll,-22016
"500:UDP"= 500:UDP:@xpsp2res.dll,-22017
"427:UDP"= 427:UDP:SLP_Port(427)

R0 ntcdrdrv;ntcdrdrv;c:\windows\system32\drivers\ntcdrdrv.sys [8/30/2007 4:44 PM 13440]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [7/9/2009 10:30 PM 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [7/9/2009 10:30 PM 20560]
R2 FreeAgentGoNext Service;Seagate Service;c:\program files\Seagate\SeagateManager\Sync\FreeAgentService.exe [7/17/2008 6:12 PM 161064]
R3 5U870CAP_VID_1262&PID_25FD;HP Pavilion Webcam ;c:\windows\system32\drivers\5U870CAP.sys [6/6/2006 4:39 PM 61952]
S3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\DRIVERS\motccgp.sys –> c:\windows\system32\DRIVERS\motccgp.sys [?]
S3 motccgpfl;MotCcgpFlService;c:\windows\system32\DRIVERS\motccgpfl.sys –> c:\windows\system32\DRIVERS\motccgpfl.sys [?]
S3 motport;Motorola USB Diagnostic Port;c:\windows\system32\DRIVERS\motport.sys –> c:\windows\system32\DRIVERS\motport.sys [?]
S3 SWNC8U56;Sierra Wireless MUX NDIS Driver (UMTS56);c:\windows\system32\drivers\swnc8u56.sys [8/6/2008 12:33 PM 101248]
S3 SWUMX56;Sierra Wireless USB MUX Driver (UMTS56);c:\windows\system32\drivers\swumx56.sys [8/6/2008 12:33 PM 73856]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
HPService REG_MULTI_SZ HPSLPSVC
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2009-07-20 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]

2009-07-23 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-07-20 19:06]

2009-07-23 c:\windows\Tasks\User_Feed_Synchronization-{5027FA4C-25FB-44B5-8605-6E98082C0E92}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 08:31]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
uDefault_Search_URL = hxxp://www.google.com/ie
mStart Page = hxxp://www.yahoo.com/
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
uInternet Connection Wizard,ShellNext = iexplore
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Add to Vbuzzer RSS list - c:\program files\vbuzzer\addurl.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office10\EXCEL.EXE/3000
IE: Send to &Bluetooth Device… - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-23 14:35
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = c:\program files\Hewlett-Packard\Default Settings\cpqset.exe????????????
scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2009-07-23 14:38
ComboFix-quarantined-files.txt 2009-07-23 18:38
ComboFix2.txt 2009-07-22 18:13
ComboFix3.txt 2009-07-22 16:33

Pre-Run: 16,063,229,952 bytes free
Post-Run: 16,095,404,032 bytes free

275 — E O F — 2009-07-16 07:04

Tomk

Post #12July 23, 2009, 7:21 PM UTC

maax, Could I please have a new HijackThis log and would you please update me as to how your computer is operating at this point?

maax

Post #13July 23, 2009, 9:01 PM UTC

I still have 2 iexplorer.exe in task manager and only 1 open.

Internet is still sluggish. Most everything else seems fine.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:59:15 PM, on 7/23/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Dantz\Retrospect\retrorun.exe
C:\PROGRA~1\Dantz\RETROS~1\wdsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\system32\mqsvc.exe
C:\WINDOWS\system32\mqtgsvc.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe
C:\WINDOWS\system32\WDBtnMgr.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\iCall\iCall.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\dvd43\dvd43_tray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\HP\Digital Imaging\bin\hposol08.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_clipbook.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\Hewlett-Packard\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [WD Button Manager] WDBtnMgr.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [MaxMenuMgr] "C:\Program Files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe"
O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [mumservice] C:\Program Files\Motorola\Software Update\mumservice.exe
O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [iCall Internet Phone] "C:\Program Files\iCall\iCall.exe" /startup
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /nodetect
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [dvd43] C:\Program Files\dvd43\dvd43_tray.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - .DEFAULT User Startup: Vongo Tray.lnk = C:\Program Files\Vongo\Tray.exe (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: officejet 6100.lnk = ?
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: Add to Vbuzzer RSS list - C:\Program Files\vbuzzer\addurl.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Send to &Bluetooth Device… - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: HP Smart Select - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=64&bd=pavilion&pf=laptop
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/200612…ex/qtplugin.cab
O16 - DPF: {1851174C-97BD-4217-A0CC-E908F60D5B7A} (Hewlett-Packard Online Support Services) - http://h50203.www5.hp.com/HPISWeb/Customer…DataManager.CAB
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photos.walmart.com/WalmartActivia.cab
O16 - DPF: {49232000-16E4-426C-A231-62846947304B} (SysData Class) - https://wimpro.cce.hp.com/ChatEntry/downloads/sysinfo.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} (GMNRev Class) - http://h20270.www2.hp.com/ediags/gmn2/inst…ctDetection.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AddFiltr - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Seagate Service (FreeAgentGoNext Service) - Seagate Technology LLC - C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\HP Game Console\GameConsoleService.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Retrospect Launcher (RetroLauncher) - Dantz Development Corporation - C:\Program Files\Dantz\Retrospect\retrorun.exe
O23 - Service: Retrospect WD Service (RetroWDSvc) - Dantz Development Corporation - C:\PROGRA~1\Dantz\RETROS~1\wdsvc.exe
O24 - Desktop Component 0: (no name) - http://www.gamecockcentral.com/images/wall…k3/1024x768.jpg

–
End of file - 14196 bytes

Tomk

Post #14July 23, 2009, 9:46 PM UTC

maax,

Well, your log says you have two instances of internet explorer running.

I suspect that you would notice if you open two each time.

Let's try this:

We need to repair some of windows' internal registration settings

Please download Dial-A-Fix from one of the following mirrors:
- Primary Mirror
- Secondary Mirror
Extract the zip file to your desktop.
Double click Dial-a-Fix.exe to start the program.
Press the green double checkmark box (Looks like this: [external image: Posted Image])
UNcheck "Empty Temp Folders", as well as "Adjust Time/Date" in the prep section.
Press the GO button in the bottom of the window.
Exit/Close Dial-A-Fix

maax

Post #15July 23, 2009, 9:50 PM UTC

I am doing what you told me but FYI primary mirror dl's a corrupt file.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] Maax HJT log-laptop

✨ Ask AI

Ask AI