Spyware / Malware / Virus Removal

[Resolved] Novice needs help, XP Pro, Several programs look like they

10 min read

Looking for the outcome? Ask AI

gcdi Topic Starter

Post #1August 23, 2009, 7:08 AM UTC

XP Pro, Several programs look like they close as soon as they start to open. Internet Explorer is the most common, with this computer I can not get on the net although I think it is being hidden and not closed as I tried a Microsoft update and that did work. When I try to open IE you see a very quick flash of a window and then it's gone, does not show to be running in processes either. When this started I wasn't sure what to do , so just unplugged ethernet cable to router, I have tried a few times after with same result. I may not be able to reply quickly since I can't seem to get my computer on the net, so am using one at work to send this
Following will be logs:

StartupList report, 8/22/2009, 9:17:23 PM
StartupList version: 1.52.2
Started from : E:\Program Files\HiJack\HiJackThis.EXE
Detected: Windows XP SP3 (WinNT 5.01.2600)
Detected: Internet Explorer v8.00 (8.00.6001.18702)
* Using default options
* Showing rarely important sections
==================================================

Running processes:

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Creative\Shared Files\CTAudSvc.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
E:\Program Files\Spyware Doctor\pctsAuxs.exe
E:\Program Files\Spyware Doctor\pctsSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\CTHELPER.EXE
C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Creative\Volume Panel\VolPanlu.exe
C:\WINDOWS\tsnp2std.exe
E:\Program Files\Spyware Doctor\pctsTray.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\WINDOWS\vsnp2std.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\WINDOWS\system32\ctfmon.exe
E:\Program Files\Ascentive\PC SpeedScan Pro\PCSpeedScan.exe
C:\Program Files\Registry Mechanic\RegMech.exe
C:\WINDOWS\SYSTEM32\CTXFISPI.EXE
C:\Program Files\Creative\MediaSource5\MtdAcqu.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\SetPoint\SetPoint.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\Program Files\SEC\Natural Color\NaturalColorLoad.exe
E:\Program Files\Belvedere\Belvedere.exe
E:\Program Files\HiJack\HiJackThis.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\notepad.exe

————————————————–

Listing of startup folders:

Shell folders Startup:
[C:\Documents and Settings\MIKE\Start Menu\Programs\Startup]
Belvedere.lnk = E:\Program Files\Belvedere\Belvedere.exe

Shell folders Common Startup:
[C:\Documents and Settings\All Users\Start Menu\Programs\Startup]
HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
Logitech SetPoint.lnk = C:\SetPoint\SetPoint.exe
NaturalColorLoad.lnk = C:\Program Files\SEC\Natural Color\NaturalColorLoad.exe

————————————————–

Checking Windows NT UserInit:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS\system32\userinit.exe,

————————————————–

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

AudioDrvEmulator = C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" -1 AudioDrvEmulator "C:\Program Files\Creative\Shared Files\Module Loader\Audio Emulator\AudDrvEm.dll
CTHelper = CTHELPER.EXE
YBrowser = C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
NvCplDaemon = RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
nwiz = nwiz.exe /install
ccApp = C:\Program Files\Common Files\Symantec Shared\ccApp.exe
osCheck = C:\PROGRA~1\Symantec\osCheck.exe
Start WingMan Profiler = C:\Program Files\Logitech\Gaming Software\LWEMon.exe /noui
Motive SmartBridge = C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
NvMediaCenter = RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
VolPanel = "C:\Program Files\Creative\Volume Panel\VolPanlu.exe" /r
tsnp2std = C:\WINDOWS\tsnp2std.exe
ISTray = "E:\Program Files\Spyware Doctor\pctsTray.exe"
Windows Defender = "C:\Program Files\Windows Defender\MSASCui.exe" -hide
snp2std = C:\WINDOWS\vsnp2std.exe

————————————————–

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

Creative Detector = "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
ctfmon.exe = C:\WINDOWS\system32\ctfmon.exe
PC SpeedScan Pro = E:\Program Files\Ascentive\PC SpeedScan Pro\PCSpeedScan.exe -m
RegistryMechanic = C:\Program Files\Registry Mechanic\RegMech.exe /H
MtdAcqu = "C:\Program Files\Creative\MediaSource5\MtdAcqu.exe" /s
MSMSGS = "C:\Program Files\Messenger\msmsgs.exe" /background

————————————————–

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

[OptionalComponents]
=

————————————————–

Enumerating Active Setup stub paths:
HKLM\Software\Microsoft\Active Setup\Installed Components
(* = disabled by HKCU twin)

[<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}]
StubPath = C:\WINDOWS\system32\ieudinit.exe

[>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
StubPath = C:\WINDOWS\inf\unregmp2.exe /ShowWMP

[>{26923b43-4d38-484f-9b9e-de460746276c}] *
StubPath = %systemroot%\system32\shmgrate.exe OCInstallUserConfigIE

[>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}] *
StubPath = %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE

[{2C7339CF-2B09-4501-B3F3-F3508C9228ED}] *
StubPath = %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

[{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] *
StubPath = "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install

[{7790769C-0471-11d2-AF11-00C04FA35D02}] *
StubPath = "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install

[{89820200-ECBD-11cf-8B85-00AA005B4340}] *
StubPath = regsvr32.exe /s /n /i:U shell32.dll

[{89820200-ECBD-11cf-8B85-00AA005B4383}] *
StubPath = C:\WINDOWS\system32\ie4uinit.exe -BaseSettings

[{89B4C1CD-B018-4511-B0A1-5476DBF70820}] *
StubPath = C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install

————————————————–

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

Shell=*INI section not found*
SCRNSAVE.EXE=*INI section not found*
drivers=*INI section not found*

Shell & screensaver key from Registry:

Shell=Explorer.exe
SCRNSAVE.EXE=*Registry value not found*
drivers=*Registry value not found*

Policies Shell key:

HKCU\..\Policies: Shell=*Registry value not found*
HKLM\..\Policies: Shell=*Registry value not found*

————————————————–

Checking for EXPLORER.EXE instances:

C:\WINDOWS\Explorer.exe: PRESENT!

C:\Explorer.exe: not present
C:\WINDOWS\Explorer\Explorer.exe: not present
C:\WINDOWS\System\Explorer.exe: not present
C:\WINDOWS\System32\Explorer.exe: not present
C:\WINDOWS\Command\Explorer.exe: not present
C:\WINDOWS\Fonts\Explorer.exe: not present

————————————————–

Checking for superhidden extensions:

.lnk: HIDDEN! (arrow overlay: yes)
.pif: HIDDEN! (arrow overlay: yes)
.exe: not hidden
.com: not hidden
.bat: not hidden
.hta: not hidden
.scr: not hidden
.shs: HIDDEN!
.shb: HIDDEN!
.vbs: not hidden
.vbe: not hidden
.wsh: not hidden
.scf: HIDDEN! (arrow overlay: NO!)
.url: HIDDEN! (arrow overlay: yes)
.js: not hidden
.jse: not hidden

————————————————–

Enumerating Browser Helper Objects:

(no name) - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll - {02478D38-C3F9-4EFB-9B51-7695ECA05670}
(no name) - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
(no name) - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll - {3049C3E9-B461-4BC5-8870-4C09146192CA}
(no name) - C:\PROGRA~1\Yahoo!\common\yiesrvc.dll - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897}
(no name) - C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll - {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D}

————————————————–

Enumerating Task Scheduler jobs:

McDefragTask.job
McQcTask.job
MP Scheduled Scan.job
ParetoLogic Registration.job
ParetoLogic Update.job
WGASetup.job

————————————————–

Enumerating Download Program Files:

[QuickTime Plugin Control]
InProcServer32 = C:\Program Files\QuickTime\QTPlugin.ocx
CODEBASE = http://appldnld.apple.com.edgesuite.net/co…ex/qtplugin.cab

[ClientEXE Class]
InProcServer32 = C:\PROGRA~1\SAMSUN~1\DOWNLO~1\CM_CLI~2.DLL
CODEBASE = http://service.samsungportal.com/EP/web/co…M_ClientEXE.cab

[Creative Software AutoUpdate]
CODEBASE = http://www.creative.com/softwareupdate/su/…031/CTSUEng.cab

[asusTek_sysctrl Class]
CODEBASE = http://support.asus.com/common/asusTek_sys_ctrl.cab

[DjVuCtl Class]
InProcServer32 = C:\Program Files\LizardTech\DjVuControl\DjVuCntl.dll
CODEBASE = http://naskp.samsungportal.com/km/htdocs/i…ntrol_en_US.cab

[Windows Genuine Advantage Validation Tool]
InProcServer32 = C:\WINDOWS\system32\legitcheckcontrol.dll
CODEBASE = http://go.microsoft.com/fwlink/?linkid=39204

[yucsetreg Class]
InProcServer32 = C:\Program Files\Yahoo!\common\yucconfig.dll
CODEBASE = C:\Program Files\Yahoo!\common\yucconfig.dll

[Installation Support]
InProcServer32 = C:\Program Files\Yahoo!\Common\Yinsthelper.dll
CODEBASE = http://us.dl1.yimg.com/download.yahoo.com/…nst_current.cab

[Office Update Installation Engine]
InProcServer32 = C:\WINDOWS\opuc.dll
CODEBASE = http://office.microsoft.com/officeupdate/content/opuc3.cab

[WUWebControl Class]
InProcServer32 = C:\WINDOWS\system32\wuweb.dll
CODEBASE = http://update.microsoft.com/windowsupdate/…b?1140764665312

[System Requirements Lab Class]
CODEBASE = http://www.nvidia.com/content/DriverDownlo…/sysreqlab2.cab

[Creative Software AutoUpdate]
CODEBASE = http://www.creative.com/softwareupdate/su/…101/CTSUEng.cab

[MUWebControl Class]
InProcServer32 = C:\WINDOWS\system32\muweb.dll
CODEBASE = http://www.update.microsoft.com/microsoftu…b?1199951014250

[ACUBETrustChecker Control]
CODEBASE = http://service.samsungportal.com/EP/web/co…rustChecker.cab

[NVIDIA Smart Scan]
CODEBASE = http://www.nvidia.com/content/DriverDownlo…iaSmartScan.cab

[{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}]
CODEBASE = http://fpdownload.macromedia.com/get/flash…t/ultrashim.cab

[SSOCheck Class]
CODEBASE = http://service.samsungportal.com/EP/web/co…UniSSOCheck.cab

[Setup Class]
InProcServer32 = C:\PROGRA~1\SAMSUN~1\DOWNLO~1\ACTIVE~1.DLL
CODEBASE = http://service.samsungportal.com/EP/web/co…ctiveXSetup.cab

[Futuremark Measurement Services Client]
InProcServer32 = C:\WINDOWS\system32\FUTURE~1\MSC\MSC3.ocx
CODEBASE = http://www.yougamers.com/systeminfo/MSC3.cab

[Shockwave Flash Object]
InProcServer32 = C:\WINDOWS\system32\Macromed\Flash\Flash10a.ocx
CODEBASE = http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab

[Creative Software AutoUpdate Support Package]
CODEBASE = http://www.creative.com/softwareupdate/su/…15106/CTPID.cab

————————————————–

Enumerating Windows NT/2000/XP services

AsProbe: \??\C:\WINDOWS\system32\drivers\AsProbe.sys (autostart)
Windows Audio: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Automatic LiveUpdate Scheduler: "C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe" (autostart)
Symantec Event Manager: "C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (autostart)
Symantec Settings Manager: "C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (autostart)
Symantec Lic NetConnect service: "C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h cltCommon (autostart)
Creative Service for CDROM Access: C:\WINDOWS\system32\CTsvcCDA.EXE (autostart)
Cryptographic Services: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Creative Audio Service: C:\Program Files\Creative\Shared Files\CTAudSvc.exe (autostart)
DCOM Server Process Launcher: %SystemRoot%\system32\svchost -k DcomLaunch (autostart)
DHCP Client: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
DNS Client: %SystemRoot%\system32\svchost.exe -k NetworkService (autostart)
Event Log: %SystemRoot%\system32\services.exe (autostart)
Fast User Switching Compatibility: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Fax: %systemroot%\system32\fxssvc.exe (autostart)
Help and Support: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
HID Input Service: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
InCD Helper: C:\Program Files\Ahead\InCD\InCDsrv.exe (autostart)
InCD Helper (read only): C:\Program Files\Ahead\InCD\InCDsrv.exe -r (autostart)
Server: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Workstation: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
LBeepKE: System32\Drivers\LBeepKE.sys (autostart)
LiveUpdate Notice Service Ex: "C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (autostart)
LiveUpdate Notice Service: "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifEng.dll" (autostart)
AEGIS Protocol (IEEE 802.1x) v2.3.1.9: system32\DRIVERS\mdc8021x.sys (autostart)
NVIDIA Display Driver Service: %SystemRoot%\system32\nvsvc32.exe (autostart)
Plug and Play: %SystemRoot%\system32\services.exe (autostart)
Pml Driver HPZ12: C:\WINDOWS\system32\HPZipm12.exe (autostart)
DiRT Drivers Auto Removal (pr2ah4nc): %SystemRoot%\system32\pr2ah4nc.exe svc (autostart)
Protected Storage: %SystemRoot%\system32\lsass.exe (autostart)
Remote Procedure Call (RPC): %SystemRoot%\system32\svchost -k rpcss (autostart)
Security Accounts Manager: %SystemRoot%\system32\lsass.exe (autostart)
Task Scheduler: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
PC Tools Auxiliary Service: E:\Program Files\Spyware Doctor\pctsAuxs.exe (autostart)
PC Tools Security Service: E:\Program Files\Spyware Doctor\pctsSvc.exe (autostart)
System Event Notification: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Windows Firewall/Internet Connection Sharing (ICS): %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Print Spooler: %SystemRoot%\system32\spoolsv.exe (autostart)
System Restore Service: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Windows Image Acquisition (WIA): %SystemRoot%\system32\svchost.exe -k imgsvc (autostart)
Symantec AppCore Service: "C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe" (autostart)
Windows Defender: "C:\Program Files\Windows Defender\MsMpEng.exe" (autostart)
Automatic Updates: %systemroot%\system32\svchost.exe -k netsvcs (autostart)

————————————————–

Enumerating ShellServiceObjectDelayLoad items:

PostBootReminder: C:\WINDOWS\system32\SHELL32.dll
CDBurn: C:\WINDOWS\system32\SHELL32.dll
WebCheck: C:\WINDOWS\system32\webcheck.dll
SysTray: C:\WINDOWS\system32\stobject.dll
WPDShServiceObj: C:\WINDOWS\system32\WPDShServiceObj.dll

————————————————–
End of report, 16,449 bytes
Report generated in 0.062 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:55:59 PM, on 8/22/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Creative\Shared Files\CTAudSvc.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
E:\Program Files\Spyware Doctor\pctsAuxs.exe
E:\Program Files\Spyware Doctor\pctsSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\CTHELPER.EXE
C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Creative\Volume Panel\VolPanlu.exe
C:\WINDOWS\tsnp2std.exe
E:\Program Files\Spyware Doctor\pctsTray.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\WINDOWS\vsnp2std.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\WINDOWS\system32\ctfmon.exe
E:\Program Files\Ascentive\PC SpeedScan Pro\PCSpeedScan.exe
C:\Program Files\Registry Mechanic\RegMech.exe
C:\WINDOWS\SYSTEM32\CTXFISPI.EXE
C:\Program Files\Creative\MediaSource5\MtdAcqu.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\SetPoint\SetPoint.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\Program Files\SEC\Natural Color\NaturalColorLoad.exe
E:\Program Files\Belvedere\Belvedere.exe
E:\Program Files\HiJack\HiJackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/…/search/ie.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\common\yiesrvc.dll
O2 - BHO: SidebarAutoLaunch Class - {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D} - C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
O4 - HKLM\..\Run: [AudioDrvEmulator] C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" -1 AudioDrvEmulator "C:\Program Files\Creative\Shared Files\Module Loader\Audio Emulator\AudDrvEm.dll
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [YBrowser] C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe
O4 - HKLM\..\Run: [osCheck] C:\PROGRA~1\Symantec\osCheck.exe
O4 - HKLM\..\Run: [Start WingMan Profiler] C:\Program Files\Logitech\Gaming Software\LWEMon.exe /noui
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [VolPanel] "C:\Program Files\Creative\Volume Panel\VolPanlu.exe" /r
O4 - HKLM\..\Run: [tsnp2std] C:\WINDOWS\tsnp2std.exe
O4 - HKLM\..\Run: [ISTray] "E:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [snp2std] C:\WINDOWS\vsnp2std.exe
O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [PC SpeedScan Pro] E:\Program Files\Ascentive\PC SpeedScan Pro\PCSpeedScan.exe -m
O4 - HKCU\..\Run: [RegistryMechanic] C:\Program Files\Registry Mechanic\RegMech.exe /H
O4 - HKCU\..\Run: [MtdAcqu] "C:\Program Files\Creative\MediaSource5\MtdAcqu.exe" /s
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-21-448539723-1035525444-725345543-500\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'Administrator')
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - Startup: Belvedere.lnk = E:\Program Files\Belvedere\Belvedere.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\SetPoint\SetPoint.exe
O4 - Global Startup: NaturalColorLoad.lnk = C:\Program Files\SEC\Natural Color\NaturalColorLoad.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: AT&T Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: *.samsungportal.com
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Plugin Control) - http://appldnld.apple.com.edgesuite.net/co…ex/qtplugin.cab
O16 - DPF: {08BCD971-A13B-4D6E-A2A5-E9B2324FC00D} (ClientEXE Class) - http://service.samsungportal.com/EP/web/co…M_ClientEXE.cab
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/softwareupdate/su/…031/CTSUEng.cab
O16 - DPF: {0D41B8C5-2599-4893-8183-00195EC8D5F9} (asusTek_sysctrl Class) - http://support.asus.com/common/asusTek_sys_ctrl.cab
O16 - DPF: {0E8D0700-75DF-11D3-8B4A-0008C7450C4A} (DjVuCtl Class) - http://naskp.samsungportal.com/km/htdocs/i…ntrol_en_US.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {231B1C6E-F934-42A2-92B6-C2FEFEC24276} (yucsetreg Class) - C:\Program Files\Yahoo!\common\yucconfig.dll
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - http://us.dl1.yimg.com/download.yahoo.com/…nst_current.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1140764665312
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownlo…/sysreqlab2.cab
O16 - DPF: {6C269571-C6D7-4818-BCA4-32A035E8C884} (Creative Software AutoUpdate) - http://www.creative.com/softwareupdate/su/…101/CTSUEng.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1199951014250
O16 - DPF: {714E667D-360C-4BFB-8C1A-E4812B608CC1} (ACUBETrustChecker Control) - http://service.samsungportal.com/EP/web/co…rustChecker.cab
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - http://www.nvidia.com/content/DriverDownlo…iaSmartScan.cab
O16 - DPF: {9D67EBF0-AF1A-4BCE-BAC9-C84A9383E0B3} (SSOCheck Class) - http://service.samsungportal.com/EP/web/co…UniSSOCheck.cab
O16 - DPF: {C4D88B8E-352B-11D6-BF77-0080C740A177} (Setup Class) - http://service.samsungportal.com/EP/web/co…ctiveXSetup.cab
O16 - DPF: {D1E7CBDA-E60E-4970-A01C-37301EF7BF98} (Futuremark Measurement Services Client) - http://www.yougamers.com/systeminfo/MSC3.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/softwareupdate/su/…15106/CTPID.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O23 - Service: Automatic LiveUpdate Scheduler - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: COM Host (comHost) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe (file missing)
O23 - Service: Creative Audio Engine Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: Creative Audio Service (CTAudSvcService) - Creative Technology Ltd - C:\Program Files\Creative\Shared Files\CTAudSvc.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: InCD Helper (read only) (InCDsrvR) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Unknown owner - C:\PROGRA~1\Symantec\isPwdSvc.exe (file missing)
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logitech\Bluetooth\LBTServ.exe
O23 - Service: LiveUpdate - Unknown owner - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE (file missing)
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: DiRT Drivers Auto Removal (pr2ah4nc) (pr2ah4nc) - CODEMASTERS - C:\WINDOWS\system32\pr2ah4nc.exe
O23 - Service: SiSoftware Deployment Agent Service (SandraAgentSrv) - SiSoftware - E:\Documents and Settings\MIKE\XP TWEAKS\SiSoftware Sandra Lite 2009\RpcAgentSrv.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - E:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - E:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe (file missing)
O23 - Service: Symantec AppCore Service (SymAppCore) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe (file missing)
O23 - Service: YPCService - Unknown owner - C:\WINDOWS\system32\YPCSER~1.EXE (file missing)

–
End of file - 13081 bytes

Thanks for any help you could provide

LDTate

Post #2August 26, 2009, 9:46 PM UTC

Hello and welcome to the forum.

Lets see if we can get the PC back on the internet. This file will fit on a floppy or thumb drive.

Get a copy of winsockxpfix.exe and copy it to the infected computer.
You just run it and things should work OK after it reboots your system.

http://www.snapfiles.com/get/winsockxpfix.html

gcdi

Post #3August 27, 2009, 7:40 PM UTC

Okay, ran WinsockXPFix, after it completed pressed to restart and two error messages popped up but not long enough to see what they said. After restart attempting to access internet is the same, I see a window open then instantly close..

LDTate

Post #4August 27, 2009, 9:04 PM UTC

Uninstall Internet Explorer 8 to return to Internet Explorer 7 on Windows XP Click "Start," and then click "Control Panel." Click "Add or Remove Programs." Check "Show Updates" at the top of the dialog box. Scroll down the list and highlight the version of Internet Explorer 8 that you are running, and then click "Change/Remove." Remove IE 8

gcdi

Post #5August 28, 2009, 3:39 PM UTC

I couldn't find IE8 or any updates for IE8 only had IE7 and it's updates.

LDTate

Post #6August 28, 2009, 11:34 PM UTC

Uninstall Internet Explorer 7 to return to Internet Explorer 6 on Windows XP Click "Start," and then click "Control Panel." Click "Add or Remove Programs." Check "Show Updates" at the top of the dialog box. Scroll down the list and highlight the version of Internet Explorer 7 that you are running, and then click "Change/Remove." Remove IE 7

gcdi

Post #7August 30, 2009, 6:00 AM UTC

I can remove any of the updates but when I select IE7 I don't get the window to remove or modify it, I just get the link for support info.

LDTate

Post #8August 30, 2009, 10:30 AM UTC

You might have some corrupt system files.

You can use windows sfc (system file checker) You'd need your XP CD to make this work.
Click Start> Run> type sfc /scannow Note the space.
(Note that there is a space between sfc and /scannow)

gcdi

Post #9August 31, 2009, 2:07 AM UTC

Okay, ran sfc, happened to be in another room when it finished so don't know if it shows any results. In add/remove programs clicking on IE7 still doesn't show size or change/remove box. The PC will go on internet now!

LDTate

Post #10August 31, 2009, 4:50 PM UTC

DO NOT use any TOOLS such as Combofix, SmitfraudFix, MBAM, Vundofix, or HijackThis fixes without supervision.

Doing so could make your pc inoperatible and could require a full reinstall of your OS, losing all your programs and data.

Stay with this topic until I give you the all clean post.

You might want to print these instructions out.

I suggest you do this:

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Uncheck "Hide file extensions for known file types."
Under the "Hidden files" folder, select "Show hidden files and folders."
Uncheck "Hide protected operating system files."
Click Apply, and then click OK.

Please do not delete anything unless instructed to.

Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
[external image: Posted Image]
Click the Empty Selected button.

(If you use FireFox or the Opera browser
To keep saved passwords, click No at the prompt.)

It's normal after running ATF cleaner that the PC will be slower to boot the first time or two.

Next:

Please download Malwarebytes' Anti-Malware to your desktop.

Double-click mbam-setup.exe and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform quick scan, then click Scan.
[external image: Posted Image]
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected .
When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot.

Also "copy/paste" a new HijackThis log file into this thread.

Also please describe how your computer behaves at the moment.

Please don't attach the scans / logs, use "copy/paste". .

gcdi

Post #11September 1, 2009, 1:44 PM UTC

Seems like it is working pretty good, haven't had much time to test, seems like webpages may be missing some content, a lot of white area.
Logs:
Malwarebytes' Anti-Malware 1.40
Database version: 2724
Windows 5.1.2600 Service Pack 3

9/1/2009 7:17:42 AM
mbam-log-2009-09-01 (07-17-42).txt

Scan type: Quick Scan
Objects scanned: 104176
Time elapsed: 4 minute(s), 1 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 4
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 2

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\TypeLib\{497dddb6-6eee-4561-9621-b77dc82c1f84} (Rogue.Ascentive) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{4e980492-027b-47f1-a7ab-ab086dacbb9e} (Rogue.Ascentive) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{5ead8321-fcbb-4c3f-888c-ac373d366c3f} (Rogue.Ascentive) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{31f3cf6e-a71a-4daa-852b-39ac230940b4} (Rogue.Ascentive) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\system32\SysRestore.dll (Rogue.Ascentive) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\smss.TMP (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:29:10 AM, on 9/1/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Creative\Shared Files\CTAudSvc.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\CTHELPER.EXE
C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Creative\Volume Panel\VolPanlu.exe
C:\WINDOWS\tsnp2std.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\WINDOWS\vsnp2std.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Creative\MediaSource5\MtdAcqu.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\SYSTEM32\CTXFISPI.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\SetPoint\SetPoint.exe
C:\Program Files\SEC\Natural Color\NaturalColorLoad.exe
E:\Program Files\Belvedere\Belvedere.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe
E:\Documents and Settings\Steam.exe
E:\Program Files\HiJack\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/?fr=fp-yie8
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/?fr=fp-yie8
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Yahoo!
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\common\yiesrvc.dll
O2 - BHO: SidebarAutoLaunch Class - {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D} - C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
O4 - HKLM\..\Run: [AudioDrvEmulator] C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" -1 AudioDrvEmulator "C:\Program Files\Creative\Shared Files\Module Loader\Audio Emulator\AudDrvEm.dll
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [YBrowser] C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe
O4 - HKLM\..\Run: [osCheck] C:\PROGRA~1\Symantec\osCheck.exe
O4 - HKLM\..\Run: [Start WingMan Profiler] C:\Program Files\Logitech\Gaming Software\LWEMon.exe /noui
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [VolPanel] "C:\Program Files\Creative\Volume Panel\VolPanlu.exe" /r
O4 - HKLM\..\Run: [tsnp2std] C:\WINDOWS\tsnp2std.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [snp2std] C:\WINDOWS\vsnp2std.exe
O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [PC SpeedScan Pro] E:\Program Files\Ascentive\PC SpeedScan Pro\PCSpeedScan.exe -m
O4 - HKCU\..\Run: [MtdAcqu] "C:\Program Files\Creative\MediaSource5\MtdAcqu.exe" /s
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - Startup: Belvedere.lnk = E:\Program Files\Belvedere\Belvedere.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\SetPoint\SetPoint.exe
O4 - Global Startup: NaturalColorLoad.lnk = C:\Program Files\SEC\Natural Color\NaturalColorLoad.exe
O9 - Extra button: AT&T Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O15 - Trusted Zone: *.samsungportal.com
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Plugin Control) - http://appldnld.apple.com.edgesuite.net/co…ex/qtplugin.cab
O16 - DPF: {08BCD971-A13B-4D6E-A2A5-E9B2324FC00D} (ClientEXE Class) - http://service.samsungportal.com/EP/web/co…M_ClientEXE.cab
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/softwareupdate/su/…031/CTSUEng.cab
O16 - DPF: {0D41B8C5-2599-4893-8183-00195EC8D5F9} (asusTek_sysctrl Class) - http://support.asus.com/common/asusTek_sys_ctrl.cab
O16 - DPF: {0E8D0700-75DF-11D3-8B4A-0008C7450C4A} (DjVuCtl Class) - http://naskp.samsungportal.com/km/htdocs/i…ntrol_en_US.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {231B1C6E-F934-42A2-92B6-C2FEFEC24276} (yucsetreg Class) - C:\Program Files\Yahoo!\common\yucconfig.dll
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - http://us.dl1.yimg.com/download.yahoo.com/…nst_current.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1140764665312
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownlo…/sysreqlab2.cab
O16 - DPF: {6C269571-C6D7-4818-BCA4-32A035E8C884} (Creative Software AutoUpdate) - http://www.creative.com/softwareupdate/su/…101/CTSUEng.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1199951014250
O16 - DPF: {714E667D-360C-4BFB-8C1A-E4812B608CC1} (ACUBETrustChecker Control) - http://service.samsungportal.com/EP/web/co…rustChecker.cab
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - http://www.nvidia.com/content/DriverDownlo…iaSmartScan.cab
O16 - DPF: {9D67EBF0-AF1A-4BCE-BAC9-C84A9383E0B3} (SSOCheck Class) - http://service.samsungportal.com/EP/web/co…UniSSOCheck.cab
O16 - DPF: {C4D88B8E-352B-11D6-BF77-0080C740A177} (Setup Class) - http://service.samsungportal.com/EP/web/co…ctiveXSetup.cab
O16 - DPF: {D1E7CBDA-E60E-4970-A01C-37301EF7BF98} (Futuremark Measurement Services Client) - http://www.yougamers.com/systeminfo/MSC3.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/softwareupdate/su/…15106/CTPID.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O23 - Service: Automatic LiveUpdate Scheduler - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: COM Host (comHost) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe (file missing)
O23 - Service: Creative Audio Engine Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: Creative Audio Service (CTAudSvcService) - Creative Technology Ltd - C:\Program Files\Creative\Shared Files\CTAudSvc.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: InCD Helper (read only) (InCDsrvR) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Unknown owner - C:\PROGRA~1\Symantec\isPwdSvc.exe (file missing)
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logitech\Bluetooth\LBTServ.exe
O23 - Service: LiveUpdate - Unknown owner - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE (file missing)
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: DiRT Drivers Auto Removal (pr2ah4nc) (pr2ah4nc) - CODEMASTERS - C:\WINDOWS\system32\pr2ah4nc.exe
O23 - Service: SiSoftware Deployment Agent Service (SandraAgentSrv) - SiSoftware - E:\Documents and Settings\MIKE\XP TWEAKS\SiSoftware Sandra Lite 2009\RpcAgentSrv.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe (file missing)
O23 - Service: Symantec AppCore Service (SymAppCore) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe (file missing)
O23 - Service: YPCService - Unknown owner - C:\WINDOWS\system32\YPCSER~1.EXE (file missing)

–
End of file - 11963 bytes

LDTate

Post #12September 1, 2009, 3:50 PM UTC

Download ComboFix from one of these locations:

Link 1
Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : Protective Programs
Double click on ComboFix.exe & follow the prompts.

Note: Combofix will run without the Recovery Console installed.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
"copy/paste" a new HijackThis log file into this thread as well.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Give it atleast 20-30 minutes to finish if needed.

Also please describe how your computer behaves at the moment.

gcdi

Post #13September 2, 2009, 1:22 PM UTC

Computer working pretty well, still looks like items don't show, you're screen shots in instructions I could not open, on websites there will be areas that look blank but if I roll mouse over right spot I can see cursor change.

Files:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:16:23 AM, on 9/2/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Creative\Shared Files\CTAudSvc.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\WINDOWS\system32\ctfmon.exe
E:\Program Files\HiJack\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\common\yiesrvc.dll
O2 - BHO: SidebarAutoLaunch Class - {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D} - C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
O4 - HKLM\..\Run: [AudioDrvEmulator] C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" -1 AudioDrvEmulator "C:\Program Files\Creative\Shared Files\Module Loader\Audio Emulator\AudDrvEm.dll
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [YBrowser] C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Start WingMan Profiler] C:\Program Files\Logitech\Gaming Software\LWEMon.exe /noui
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [VolPanel] "C:\Program Files\Creative\Volume Panel\VolPanlu.exe" /r
O4 - HKLM\..\Run: [tsnp2std] C:\WINDOWS\tsnp2std.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [snp2std] C:\WINDOWS\vsnp2std.exe
O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
O4 - HKCU\..\Run: [PC SpeedScan Pro] E:\Program Files\Ascentive\PC SpeedScan Pro\PCSpeedScan.exe -m
O4 - HKCU\..\Run: [MtdAcqu] "C:\Program Files\Creative\MediaSource5\MtdAcqu.exe" /s
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - Startup: Belvedere.lnk = E:\Program Files\Belvedere\Belvedere.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\SetPoint\SetPoint.exe
O4 - Global Startup: NaturalColorLoad.lnk = C:\Program Files\SEC\Natural Color\NaturalColorLoad.exe
O9 - Extra button: AT&T Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O15 - Trusted Zone: *.samsungportal.com
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Plugin Control) - http://appldnld.apple.com.edgesuite.net/co…ex/qtplugin.cab
O16 - DPF: {08BCD971-A13B-4D6E-A2A5-E9B2324FC00D} (ClientEXE Class) - http://service.samsungportal.com/EP/web/co…M_ClientEXE.cab
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/softwareupdate/su/…031/CTSUEng.cab
O16 - DPF: {0D41B8C5-2599-4893-8183-00195EC8D5F9} (asusTek_sysctrl Class) - http://support.asus.com/common/asusTek_sys_ctrl.cab
O16 - DPF: {0E8D0700-75DF-11D3-8B4A-0008C7450C4A} (DjVuCtl Class) - http://naskp.samsungportal.com/km/htdocs/i…ntrol_en_US.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {231B1C6E-F934-42A2-92B6-C2FEFEC24276} (yucsetreg Class) - C:\Program Files\Yahoo!\common\yucconfig.dll
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - http://us.dl1.yimg.com/download.yahoo.com/…nst_current.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1140764665312
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownlo…/sysreqlab2.cab
O16 - DPF: {6C269571-C6D7-4818-BCA4-32A035E8C884} (Creative Software AutoUpdate) - http://www.creative.com/softwareupdate/su/…101/CTSUEng.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1199951014250
O16 - DPF: {714E667D-360C-4BFB-8C1A-E4812B608CC1} (ACUBETrustChecker Control) - http://service.samsungportal.com/EP/web/co…rustChecker.cab
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - http://www.nvidia.com/content/DriverDownlo…iaSmartScan.cab
O16 - DPF: {9D67EBF0-AF1A-4BCE-BAC9-C84A9383E0B3} (SSOCheck Class) - http://service.samsungportal.com/EP/web/co…UniSSOCheck.cab
O16 - DPF: {C4D88B8E-352B-11D6-BF77-0080C740A177} (Setup Class) - http://service.samsungportal.com/EP/web/co…ctiveXSetup.cab
O16 - DPF: {D1E7CBDA-E60E-4970-A01C-37301EF7BF98} (Futuremark Measurement Services Client) - http://www.yougamers.com/systeminfo/MSC3.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/softwareupdate/su/…15106/CTPID.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O23 - Service: Automatic LiveUpdate Scheduler - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: COM Host (comHost) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe (file missing)
O23 - Service: Creative Audio Engine Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: Creative Audio Service (CTAudSvcService) - Creative Technology Ltd - C:\Program Files\Creative\Shared Files\CTAudSvc.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: InCD Helper (read only) (InCDsrvR) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Unknown owner - C:\PROGRA~1\Symantec\isPwdSvc.exe (file missing)
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logitech\Bluetooth\LBTServ.exe
O23 - Service: LiveUpdate - Unknown owner - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE (file missing)
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: DiRT Drivers Auto Removal (pr2ah4nc) (pr2ah4nc) - CODEMASTERS - C:\WINDOWS\system32\pr2ah4nc.exe
O23 - Service: SiSoftware Deployment Agent Service (SandraAgentSrv) - SiSoftware - E:\Documents and Settings\MIKE\XP TWEAKS\SiSoftware Sandra Lite 2009\RpcAgentSrv.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe (file missing)
O23 - Service: Symantec AppCore Service (SymAppCore) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe (file missing)
O23 - Service: YPCService - Unknown owner - C:\WINDOWS\system32\YPCSER~1.EXE (file missing)

–
End of file - 10827 bytes

ComboFix 09-09-01.04 - MIKE 09/02/2009 4:00.1.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3071.2621 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\COMBOFIX.exe
FW: McAfee Personal Firewall *enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Start Menu\HP Image Zone .lnk
C:\setup.exe
c:\windows\HMD.exe
c:\windows\Installer\115b979.msp
c:\windows\Installer\1401c8.msi
c:\windows\Installer\1401d9.msi
c:\windows\Installer\1401e1.msi
c:\windows\Installer\1d5d47.msp
c:\windows\Installer\1e77e41.msi
c:\windows\Installer\1f7e0ef.msi
c:\windows\Installer\20b4dd7.msi
c:\windows\Installer\20b4ddd.msi
c:\windows\Installer\274039.msp
c:\windows\Installer\2978a8.msi
c:\windows\Installer\2978ae.msi
c:\windows\Installer\2978b4.msi
c:\windows\Installer\2978bf.msi
c:\windows\Installer\34903e.msp
c:\windows\Installer\3c756.msp
c:\windows\Installer\3d562b.msi
c:\windows\Installer\3fa016.msp
c:\windows\Installer\3fa028.msp
c:\windows\Installer\3fa030.msp
c:\windows\Installer\3fa041.msp
c:\windows\Installer\58586fa.msp
c:\windows\Installer\6239c6.msp
c:\windows\Installer\692c13.msp
c:\windows\Installer\6d5763.msp
c:\windows\Installer\6d576e.msp
c:\windows\Installer\6d577a.msp
c:\windows\Installer\6ddd30.msp
c:\windows\Installer\707e5c.msi
c:\windows\Installer\828e1.msi
c:\windows\Installer\8817a.msi
c:\windows\Installer\88185.msi
c:\windows\Installer\8818b.msi
c:\windows\Installer\88191.msi
c:\windows\Installer\a1bc0f.msp
c:\windows\Installer\dbe181.msi
c:\windows\Installer\ea16d.msi
c:\windows\Installer\fb14e.msi
c:\windows\system32\tmp16.tmp
c:\windows\system32\tmp26.tmp

.
((((((((((((((((((((((((( Files Created from 2009-08-02 to 2009-09-02 )))))))))))))))))))))))))))))))
.

2009-09-02 08:36 . 2009-09-02 08:36 ——– d—–w- c:\windows\LastGood
2009-09-01 12:10 . 2009-09-01 12:10 ——– d—–w- c:\documents and settings\MIKE\Application Data\Malwarebytes
2009-09-01 12:09 . 2009-08-03 18:36 38160 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-09-01 12:09 . 2009-09-01 12:09 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-09-01 12:09 . 2009-08-03 18:36 19096 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-08-31 01:45 . 2008-04-14 00:12 116224 -c–a-w- c:\windows\system32\dllcache\xrxwiadr.dll
2009-08-31 01:45 . 2001-08-18 03:36 23040 -c–a-w- c:\windows\system32\dllcache\xrxwbtmp.dll
2009-08-31 01:45 . 2008-04-14 00:12 18944 -c–a-w- c:\windows\system32\dllcache\xrxscnui.dll
2009-08-31 01:45 . 2001-08-18 03:37 27648 -c–a-w- c:\windows\system32\dllcache\xrxftplt.exe
2009-08-31 01:45 . 2001-08-18 03:37 4608 -c–a-w- c:\windows\system32\dllcache\xrxflnch.exe
2009-08-31 01:44 . 2001-08-18 03:37 99865 -c–a-w- c:\windows\system32\dllcache\xlog.exe
2009-08-31 01:44 . 2001-08-17 17:11 16970 -c–a-w- c:\windows\system32\dllcache\xem336n5.sys
2009-08-31 01:44 . 2004-08-04 03:29 19455 -c–a-w- c:\windows\system32\dllcache\wvchntxx.sys
2009-08-31 01:44 . 2004-08-04 03:29 12063 -c–a-w- c:\windows\system32\dllcache\wsiintxx.sys
2009-08-31 01:44 . 2008-04-14 00:12 8192 -c–a-w- c:\windows\system32\dllcache\wshirda.dll
2009-08-31 01:44 . 2008-04-13 18:36 8832 -c–a-w- c:\windows\system32\dllcache\wmiacpi.sys
2009-08-31 01:44 . 2004-08-04 03:31 154624 -c–a-w- c:\windows\system32\dllcache\wlluc48.sys
2009-08-31 01:44 . 2001-08-17 17:12 34890 -c–a-w- c:\windows\system32\dllcache\wlandrv2.sys
2009-08-31 01:44 . 2001-08-17 18:28 771581 -c–a-w- c:\windows\system32\dllcache\winacisa.sys
2009-08-31 01:44 . 2001-08-18 03:36 53760 -c–a-w- c:\windows\system32\dllcache\wiamsmud.dll
2009-08-31 01:44 . 2001-08-18 03:36 87040 -c–a-w- c:\windows\system32\dllcache\wiafbdrv.dll
2009-08-31 01:42 . 2001-08-17 18:28 687999 -c–a-w- c:\windows\system32\dllcache\usrwdxjs.sys
2009-08-31 01:41 . 2001-08-18 03:36 211968 -c–a-w- c:\windows\system32\dllcache\um54scan.dll
2009-08-31 01:40 . 2001-08-17 17:14 123995 -c–a-w- c:\windows\system32\dllcache\tjisdn.sys
2009-08-31 01:39 . 2001-08-17 18:50 103936 -c–a-w- c:\windows\system32\dllcache\sx.sys
2009-08-31 01:38 . 2001-08-17 17:51 37040 -c–a-w- c:\windows\system32\dllcache\sonypi.sys
2009-08-31 01:37 . 2001-08-18 03:36 45568 -c–a-w- c:\windows\system32\dllcache\smb3w.dll
2009-08-31 01:37 . 2001-08-18 03:36 33792 -c–a-w- c:\windows\system32\dllcache\smb0w.dll
2009-08-31 01:37 . 2001-08-18 03:36 28672 -c–a-w- c:\windows\system32\dllcache\sma0w.dll
2009-08-31 01:37 . 2001-08-18 03:36 28160 -c–a-w- c:\windows\system32\dllcache\sm91w.dll
2009-08-31 01:37 . 2004-08-04 03:31 63547 -c–a-w- c:\windows\system32\dllcache\sla30nd5.sys
2009-08-31 01:37 . 2001-08-17 17:12 91294 -c–a-w- c:\windows\system32\dllcache\skfpwin.sys
2009-08-31 01:37 . 2001-08-17 17:12 94698 -c–a-w- c:\windows\system32\dllcache\sk98xwin.sys
2009-08-31 01:37 . 2001-08-17 19:56 157696 -c–a-w- c:\windows\system32\dllcache\sisv256.dll
2009-08-31 01:37 . 2001-08-17 17:50 50432 -c–a-w- c:\windows\system32\dllcache\sisv.sys
2009-08-31 01:37 . 2004-08-04 03:31 32768 -c–a-w- c:\windows\system32\dllcache\sisnic.sys
2009-08-31 01:37 . 2001-08-18 03:36 238592 -c–a-w- c:\windows\system32\dllcache\sisgrv.dll
2009-08-31 01:35 . 2001-08-17 18:51 23936 -c–a-w- c:\windows\system32\dllcache\sccmusbm.sys
2009-08-31 01:34 . 2004-08-04 03:31 20992 -c–a-w- c:\windows\system32\dllcache\rtl8139.sys
2009-08-31 01:33 . 2001-08-17 18:52 33152 -c–a-w- c:\windows\system32\dllcache\ql10wnt.sys
2009-08-31 01:32 . 2001-08-17 19:04 75776 -c–a-w- c:\windows\system32\dllcache\philcam1.sys
2009-08-31 01:31 . 2001-08-18 03:36 20480 -c–a-w- c:\windows\system32\dllcache\ovcomc.dll
2009-08-31 01:30 . 2004-08-04 03:31 132695 -c–a-w- c:\windows\system32\dllcache\netwlan5.sys
2009-08-31 01:29 . 2001-08-17 18:48 12416 -c–a-w- c:\windows\system32\dllcache\msriffwv.sys
2009-08-31 01:29 . 2008-04-13 18:54 22016 -c–a-w- c:\windows\system32\dllcache\msircomm.sys
2009-08-31 01:29 . 2001-08-17 19:02 35200 -c–a-w- c:\windows\system32\dllcache\msgame.sys
2009-08-31 01:29 . 2001-08-17 18:48 6016 -c–a-w- c:\windows\system32\dllcache\msfsio.sys
2009-08-31 01:29 . 2008-04-13 18:46 51200 -c–a-w- c:\windows\system32\dllcache\msdv.sys
2009-08-31 01:29 . 2001-08-17 18:52 17280 -c–a-w- c:\windows\system32\dllcache\mraid35x.sys
2009-08-31 01:29 . 2008-04-13 18:46 15232 -c–a-w- c:\windows\system32\dllcache\mpe.sys
2009-08-31 01:29 . 2001-08-17 18:57 16128 -c–a-w- c:\windows\system32\dllcache\modemcsa.sys
2009-08-31 01:29 . 2001-08-17 18:52 6528 -c–a-w- c:\windows\system32\dllcache\miniqic.sys
2009-08-31 01:29 . 2001-08-17 17:50 320384 -c–a-w- c:\windows\system32\dllcache\mgaum.sys
2009-08-31 01:29 . 2001-08-17 19:56 235648 -c–a-w- c:\windows\system32\dllcache\mgaud.dll
2009-08-31 01:29 . 2008-04-13 18:41 26112 -c–a-w- c:\windows\system32\dllcache\memstpci.sys
2009-08-31 01:29 . 2001-08-18 03:36 47616 -c–a-w- c:\windows\system32\dllcache\memgrp.dll
2009-08-31 01:27 . 2001-08-18 03:36 37376 -c–a-w- c:\windows\system32\dllcache\kousd.dll
2009-08-31 01:27 . 2008-04-14 00:11 48640 -c–a-w- c:\windows\system32\dllcache\kdsui.dll
2009-08-31 01:27 . 2008-04-14 00:11 253952 -c–a-w- c:\windows\system32\dllcache\kdsusd.dll
2009-08-31 01:27 . 2001-08-18 03:36 8192 -c–a-w- c:\windows\system32\dllcache\kbdkor.dll
2009-08-31 01:25 . 2001-08-17 18:47 13056 -c–a-w- c:\windows\system32\dllcache\inport.sys
2009-08-31 01:25 . 2001-08-17 18:52 16000 -c–a-w- c:\windows\system32\dllcache\ini910u.sys
2009-08-31 01:25 . 2001-08-18 03:36 372824 -c–a-w- c:\windows\system32\dllcache\iconf32.dll
2009-08-31 01:25 . 2001-08-17 19:06 100992 -c–a-w- c:\windows\system32\dllcache\icam5usb.sys
2009-08-31 01:25 . 2001-08-18 03:36 20480 -c–a-w- c:\windows\system32\dllcache\icam5ext.dll
2009-08-31 01:25 . 2001-08-18 03:36 45056 -c–a-w- c:\windows\system32\dllcache\icam5com.dll
2009-08-31 01:25 . 2001-08-17 19:06 154496 -c–a-w- c:\windows\system32\dllcache\icam4usb.sys
2009-08-31 01:25 . 2001-08-18 03:36 61952 -c–a-w- c:\windows\system32\dllcache\icam4ext.dll
2009-08-31 01:25 . 2001-08-18 03:36 91136 -c–a-w- c:\windows\system32\dllcache\icam4com.dll
2009-08-31 01:23 . 2001-08-17 18:28 115807 -c–a-w- c:\windows\system32\dllcache\hsf_fsks.sys
2009-08-31 01:22 . 2001-08-17 18:28 907456 -c–a-w- c:\windows\system32\dllcache\hcf_msft.sys
2009-08-31 01:21 . 2001-08-17 17:10 22090 -c–a-w- c:\windows\system32\dllcache\fem556n5.sys
2009-08-31 01:20 . 2001-08-17 17:10 19996 -c–a-w- c:\windows\system32\dllcache\em556n4.sys
2009-08-31 01:19 . 2001-08-18 03:36 229462 -c–a-w- c:\windows\system32\dllcache\digifwrk.dll
2009-08-31 01:18 . 2008-04-13 18:36 10240 -c–a-w- c:\windows\system32\dllcache\compbatt.sys
2009-08-31 01:17 . 2001-08-17 17:13 164923 -c–a-w- c:\windows\system32\dllcache\diapi2.sys
2009-08-31 01:17 . 2008-04-14 00:11 121856 -c–a-w- c:\windows\system32\dllcache\camext30.dll
2009-08-31 01:17 . 2001-08-18 03:36 236032 -c–a-w- c:\windows\system32\dllcache\camext20.dll
2009-08-31 01:17 . 2001-08-18 03:36 74240 -c–a-w- c:\windows\system32\dllcache\camexo20.dll
2009-08-31 01:17 . 2001-08-17 19:04 171264 -c–a-w- c:\windows\system32\dllcache\camdrv30.sys
2009-08-31 01:17 . 2001-08-17 19:05 314752 -c–a-w- c:\windows\system32\dllcache\camdro21.sys
2009-08-31 01:17 . 2001-08-17 19:04 223232 -c–a-w- c:\windows\system32\dllcache\camdrv21.sys
2009-08-31 01:16 . 2001-08-17 18:51 13824 -c–a-w- c:\windows\system32\dllcache\bulltlp3.sys
2009-08-31 01:16 . 2001-08-17 17:11 31529 -c–a-w- c:\windows\system32\dllcache\brzwlan.sys
2009-08-31 01:16 . 2001-08-17 18:12 10368 -c–a-w- c:\windows\system32\dllcache\brusbscn.sys
2009-08-31 01:16 . 2001-08-17 18:12 60416 -c–a-w- c:\windows\system32\dllcache\brserwdm.sys
2009-08-31 01:16 . 2001-08-17 18:12 11008 -c–a-w- c:\windows\system32\dllcache\brusbmdm.sys
2009-08-31 01:14 . 2001-08-17 19:55 96128 -c–a-w- c:\windows\system32\dllcache\ati.dll
2009-08-31 01:13 . 2001-08-17 19:56 66048 -c–a-w- c:\windows\system32\dllcache\s3legacy.dll
2009-08-19 16:02 . 2009-08-19 16:02 70721 —-a-w- c:\windows\hpqins01.dat
2009-08-18 08:27 . 2009-08-18 08:27 ——– d—–w- c:\windows\system32\wbem\Repository
2009-08-04 04:38 . 2009-08-04 22:50 5154304 —-a-w- C:\WindowsDefender.msi

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-01 12:29 . 2009-05-29 05:59 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-09-01 11:45 . 2009-09-01 11:45 7396 —-a-w- c:\windows\system32\drivers\pctcore.cat
2009-08-30 01:53 . 2009-08-30 01:53 13470 —-a-w- c:\documents and settings\All Users\Application Data\xml7B.tmp
2009-08-30 01:53 . 2008-11-17 03:12 2311 —-a-w- c:\documents and settings\All Users\Application Data\xml76.tmp
2009-08-30 01:53 . 2008-10-17 11:08 7918 —-a-w- c:\documents and settings\All Users\Application Data\xml11.tmp
2009-08-26 13:28 . 2006-10-03 11:11 ——– d—–w- c:\documents and settings\MIKE\Application Data\Music Coach
2009-08-19 16:01 . 2008-04-11 13:28 111990 -c–a-w- c:\windows\hpoins07.dat
2009-08-17 23:48 . 2009-08-17 23:48 0 —-a-w- c:\documents and settings\All Users\Application Data\xml5B.tmp
2009-08-17 21:03 . 2009-08-17 21:03 0 —-a-w- c:\documents and settings\All Users\Application Data\xml57.tmp
2009-08-16 19:25 . 2009-08-16 19:25 0 —-a-w- c:\documents and settings\All Users\Application Data\xml50.tmp
2009-08-05 09:01 . 2004-08-04 13:00 204800 —-a-w- c:\windows\system32\mswebdvd.dll
2009-07-25 09:02 . 2009-07-25 09:02 0 —-a-w- c:\documents and settings\All Users\Application Data\xml31.tmp
2009-07-17 19:01 . 2004-08-04 12:00 58880 —-a-w- c:\windows\system32\atl.dll
2009-07-14 04:43 . 2004-08-04 13:00 286208 —-a-w- c:\windows\system32\wmpdxm.dll
2009-06-16 14:36 . 2004-08-04 13:00 81920 —-a-w- c:\windows\system32\fontsub.dll
2009-06-16 14:36 . 2004-08-04 13:00 119808 —-a-w- c:\windows\system32\t2embed.dll
2009-06-12 12:31 . 2004-08-04 13:00 80896 —-a-w- c:\windows\system32\tlntsess.exe
2009-06-12 12:31 . 2004-08-04 13:00 76288 —-a-w- c:\windows\system32\telnet.exe
2009-06-10 14:19 . 2006-02-12 02:51 2066432 —-a-w- c:\windows\system32\mstscax.dll
2009-06-10 14:13 . 2004-08-04 13:00 84992 —-a-w- c:\windows\system32\avifil32.dll
2009-06-10 06:14 . 2004-08-04 12:00 132096 —-a-w- c:\windows\system32\wkssvc.dll
2006-03-28 08:23 . 2006-03-05 22:38 34387328 -c—-w- c:\program files\setpoint247enu.exe
2006-03-08 05:42 . 2006-03-08 05:42 16384 -c—-w- c:\program files\10x10_Grid.xlt
2006-03-06 22:28 . 2006-03-06 22:28 9543112 -c—-w- c:\program files\ldm.exe
2006-03-06 22:12 . 2006-03-06 22:12 242 -c—-w- c:\program files\XPSP2Patch.reg
2006-03-06 22:10 . 2006-03-06 22:10 4429593 -c—-w- c:\program files\it222enu.exe
2006-02-12 15:44 . 2006-02-12 15:44 65 -c—-w- c:\program files\Common Files\appop.log
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Creative Detector"="c:\program files\Creative\MediaSource\Detector\CTDetect.exe" [2004-12-02 102400]
"PC SpeedScan Pro"="e:\program files\Ascentive\PC SpeedScan Pro\PCSpeedScan.exe" [2008-08-21 2093056]
"MtdAcqu"="c:\program files\Creative\MediaSource5\MtdAcqu.exe" [2006-03-08 278528]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AudioDrvEmulator"="c:\program files\Creative\Shared Files\Module Loader\DLLML.exe" [2005-06-16 49152]
"YBrowser"="c:\progra~1\Yahoo!\browser\ybrwicon.exe" [2006-07-21 129536]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-12-26 13680640]
"Start WingMan Profiler"="c:\program files\Logitech\Gaming Software\LWEMon.exe" [2007-09-25 93208]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-12-26 86016]
"VolPanel"="c:\program files\Creative\Volume Panel\VolPanlu.exe" [2008-08-06 233576]
"tsnp2std"="c:\windows\tsnp2std.exe" [2007-08-31 262144]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2006-11-04 866584]
"snp2std"="c:\windows\vsnp2std.exe" [2007-08-07 348160]
"CTHelper"="CTHELPER.EXE" - c:\windows\CTHELPER.EXE [2006-08-17 17920]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2008-10-07 1630208]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-23 39264]

c:\documents and settings\MIKE\Start Menu\Programs\Startup\
Belvedere.lnk - e:\program files\Belvedere\Belvedere.exe [2009-4-14 817950]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-5-12 282624]
Logitech SetPoint.lnk - c:\setpoint\SetPoint.exe [2008-1-31 789008]
NaturalColorLoad.lnk - c:\program files\SEC\Natural Color\NaturalColorLoad.exe [2006-2-11 155715]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2008-01-09 18:30 72208 ——w- c:\program files\Common Files\Logitech\Bluetooth\LBTWLgn.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WB]
2001-12-21 07:34 24576 ——w- c:\progra~1\OBJECT~1\WINDOW~1\fastload.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^InterVideo WinCinema Manager.lnk]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\HP\\HP Software Update\\HPWUCli.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\Creative\\Sound Blaster X-Fi\\Diagnostics\\diagnos3.exe"=
"c:\\WINDOWS\\system32\\mmc.exe"=
"c:\\Program Files\\Ahead\\Nero MediaHome\\NeroMediaHome.exe"=
"c:\\Program Files\\Ahead\\Nero ShowTime\\ShowTime.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Codemasters\\DiRT\\DiRT.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Logitech\\Logitech Harmony Remote Software 7\\HarmonyRemote.exe"=
"e:\\Documents and Settings\\MIKE\\XP TWEAKS\\SiSoftware Sandra Lite 2009\\RpcAgentSrv.exe"=
"c:\\Program Files\\TmUnitedForever\\TmForever.exe"=
"e:\\Documents and Settings\\SteamApps\\common\\gti racing\\GTIRacing.exe"=
"e:\\Documents and Settings\\SteamApps\\common\\xpand rally\\xpandrally.exe"=
"e:\\Documents and Settings\\SteamApps\\common\\xpand rally\\ChromEd.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"e:\\Documents and Settings\\MIKE\\XP TWEAKS\\SiSoftware Sandra Lite 2009\\WNt500x86\\RpcSandraSrv.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)

R0 ivicd;Ivi CDVD Filter Driver;c:\windows\system32\drivers\ivicd.sys [2/12/2006 10:44 AM 38784]
R0 pe3ah4nc;DiRT Environment Driver (pe3ah4nc);c:\windows\system32\drivers\pe3ah4nc.sys [5/18/2007 2:53 PM 64880]
R0 ps6ah4nc;DiRT Synchronization Driver (ps6ah4nc);c:\windows\system32\drivers\ps6ah4nc.sys [5/18/2007 2:52 PM 55160]
R0 ps7ah4nc;DiRT Synchronization Driver (ps7ah4nc);c:\windows\system32\drivers\ps7ah4nc.sys [8/17/2007 12:34 PM 68208]
R2 AsProbe;AsProbe;c:\windows\system32\drivers\AsProbe.sys [2/27/2006 9:58 AM 4644]
R2 LBeepKE;LBeepKE;c:\windows\system32\drivers\LBeepKE.sys [7/27/2006 11:56 PM 3712]
R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [11/3/2006 8:19 PM 13592]
R3 iviudf;iviudf;c:\windows\system32\drivers\IviUdf.sys [2/12/2006 10:44 AM 116224]
S0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys –> c:\windows\system32\drivers\PCTCore.sys [?]
S2 pr2ah4nc;DiRT Drivers Auto Removal (pr2ah4nc);c:\windows\system32\pr2ah4nc.exe svc –> c:\windows\system32\pr2ah4nc.exe svc [?]
S3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [9/8/2008 3:01 AM 79360]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;\??\c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys –> c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [?]
S3 SandraAgentSrv;SiSoftware Deployment Agent Service;e:\documents and settings\MIKE\XP TWEAKS\SiSoftware Sandra Lite 2009\RpcAgentSrv.exe [10/17/2008 6:08 AM 98488]

— Other Services/Drivers In Memory —

*NewlyCreated* - COMHOST
*Deregistered* - udffsrec
.
Contents of the 'Scheduled Tasks' folder

2009-09-02 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-04 01:20]

2009-08-16 c:\windows\Tasks\ParetoLogic Registration.job
- c:\program files\Common Files\ParetoLogic\UUS2\UUS.dll [2007-09-19 05:55]

2008-09-06 c:\windows\Tasks\ParetoLogic Update.job
- c:\program files\Common Files\ParetoLogic\UUS2\Pareto_Update.exe [2007-09-19 05:55]
.
- - - - ORPHANS REMOVED - - - -

Toolbar-Locked - (no file)
HKLM-Run-ccApp - c:\program files\Common Files\Symantec Shared\ccApp.exe
HKLM-Run-osCheck - c:\progra~1\Symantec\osCheck.exe
HKLM-Run-Motive SmartBridge - c:\progra~1\SBCSEL~1\SMARTB~1\MotiveSB.exe

.
——- Supplementary Scan ——-
.
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
uStart Page = hxxp://www.yahoo.com/?fr=fp-yie8
Trusted Zone: creative.com\us
Trusted Zone: samsungportal.com
Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\desktop messenger\8876480\Program\GAPlugProtocol-8876480.dll
DPF: Microsoft XML Parser for Java
DPF: {08BCD971-A13B-4D6E-A2A5-E9B2324FC00D} - hxxp://service.samsungportal.com/EP/web/common/cabfiles/CM_ClientEXE.cab
DPF: {714E667D-360C-4BFB-8C1A-E4812B608CC1} - hxxp://service.samsungportal.com/EP/web/common/cabfiles/ACUBETrustChecker.cab
DPF: {9D67EBF0-AF1A-4BCE-BAC9-C84A9383E0B3} - hxxp://service.samsungportal.com/EP/web/common/cabfiles/UniSSOCheck.cab
DPF: {C4D88B8E-352B-11D6-BF77-0080C740A177} - hxxp://service.samsungportal.com/EP/web/common/cabfiles/ActiveXSetup.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-02 04:04
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(460)
c:\program files\common files\logitech\bluetooth\LBTWlgn.dll
c:\program files\common files\logitech\bluetooth\LBTServ.dll
c:\progra~1\OBJECT~1\WINDOW~1\fastload.dll
.
Completion time: 2009-09-02 4:05
ComboFix-quarantined-files.txt 2009-09-02 09:05

Pre-Run: 32,055,234,560 bytes free
Post-Run: 32,108,265,472 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

330 — E O F — 2009-09-02 08:37

LDTate

Post #14September 3, 2009, 12:19 AM UTC

Copy/paste the text in the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Take your mouse, and place your cursor at the beginning of the text in the box below, then click and hold the left mouse button, while pulling your mouse over the text. This should highlight the text. Now release the left mouse button. Now, with the cursor over the highlighted text, right click the mouse for options, and select 'copy'. Now over the empty Notepad box, right click your mouse again, and select 'paste' and you will have copied and pasted the text.

File::
c:\documents and settings\All Users\Application Data\xml7B.tmp
c:\documents and settings\All Users\Application Data\xml76.tmp
c:\documents and settings\All Users\Application Data\xml11.tmp
c:\documents and settings\All Users\Application Data\xml5B.tmp
c:\documents and settings\All Users\Application Data\xml57.tmp
c:\documents and settings\All Users\Application Data\xml50.tmp
c:\documents and settings\All Users\Application Data\xml31.tmp
e:\program files\Ascentive\PC SpeedScan Pro\PCSpeedScan.exe
e:\program files\Belvedere\Belvedere.exe

Folder::
e:\program files\Ascentive
e:\program files\Belvedere

Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PC SpeedScan Pro"=-

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:
1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …

[external image: Posted Image]

Drag CFScript.txt into ComboFix.exe

Then post the results log and a new HijackThis log.

Also please describe how your computer behaves at the moment.

gcdi

Post #15September 4, 2009, 6:50 AM UTC

Computer seems to be operating well, just finished the last instructions so haven't done much with computer yet.
I wouldn't anticipate that you would have the time but just in case you do, as we go through these steps I would love a brief explanation of what we're getting ready to do and why.
Also, have received some notices about updates but have not downloaded any yet. Should I allow the updates or wait until we are finished?
Thanks, Mike

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:36:09 AM, on 9/4/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Creative\Shared Files\CTAudSvc.exe
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\CTHELPER.EXE
C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Creative\Volume Panel\VolPanlu.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\tsnp2std.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\WINDOWS\vsnp2std.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\Program Files\Creative\MediaSource5\MtdAcqu.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\SetPoint\SetPoint.exe
C:\Program Files\SEC\Natural Color\NaturalColorLoad.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\WINDOWS\SYSTEM32\CTXFISPI.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
E:\Program Files\HiJack\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\common\yiesrvc.dll
O2 - BHO: SidebarAutoLaunch Class - {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D} - C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
O4 - HKLM\..\Run: [AudioDrvEmulator] C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" -1 AudioDrvEmulator "C:\Program Files\Creative\Shared Files\Module Loader\Audio Emulator\AudDrvEm.dll
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [YBrowser] C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Start WingMan Profiler] C:\Program Files\Logitech\Gaming Software\LWEMon.exe /noui
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [VolPanel] "C:\Program Files\Creative\Volume Panel\VolPanlu.exe" /r
O4 - HKLM\..\Run: [tsnp2std] C:\WINDOWS\tsnp2std.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [snp2std] C:\WINDOWS\vsnp2std.exe
O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
O4 - HKCU\..\Run: [MtdAcqu] "C:\Program Files\Creative\MediaSource5\MtdAcqu.exe" /s
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - Startup: Belvedere.lnk = E:\Program Files\Belvedere\Belvedere.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\SetPoint\SetPoint.exe
O4 - Global Startup: NaturalColorLoad.lnk = C:\Program Files\SEC\Natural Color\NaturalColorLoad.exe
O9 - Extra button: AT&T Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O15 - Trusted Zone: *.samsungportal.com
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Plugin Control) - http://appldnld.apple.com.edgesuite.net/co…ex/qtplugin.cab
O16 - DPF: {08BCD971-A13B-4D6E-A2A5-E9B2324FC00D} (ClientEXE Class) - http://service.samsungportal.com/EP/web/co…M_ClientEXE.cab
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/softwareupdate/su/…031/CTSUEng.cab
O16 - DPF: {0D41B8C5-2599-4893-8183-00195EC8D5F9} (asusTek_sysctrl Class) - http://support.asus.com/common/asusTek_sys_ctrl.cab
O16 - DPF: {0E8D0700-75DF-11D3-8B4A-0008C7450C4A} (DjVuCtl Class) - http://naskp.samsungportal.com/km/htdocs/i…ntrol_en_US.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {231B1C6E-F934-42A2-92B6-C2FEFEC24276} (yucsetreg Class) - C:\Program Files\Yahoo!\common\yucconfig.dll
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - http://us.dl1.yimg.com/download.yahoo.com/…nst_current.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1140764665312
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownlo…/sysreqlab2.cab
O16 - DPF: {6C269571-C6D7-4818-BCA4-32A035E8C884} (Creative Software AutoUpdate) - http://www.creative.com/softwareupdate/su/…101/CTSUEng.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1199951014250
O16 - DPF: {714E667D-360C-4BFB-8C1A-E4812B608CC1} (ACUBETrustChecker Control) - http://service.samsungportal.com/EP/web/co…rustChecker.cab
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - http://www.nvidia.com/content/DriverDownlo…iaSmartScan.cab
O16 - DPF: {9D67EBF0-AF1A-4BCE-BAC9-C84A9383E0B3} (SSOCheck Class) - http://service.samsungportal.com/EP/web/co…UniSSOCheck.cab
O16 - DPF: {C4D88B8E-352B-11D6-BF77-0080C740A177} (Setup Class) - http://service.samsungportal.com/EP/web/co…ctiveXSetup.cab
O16 - DPF: {D1E7CBDA-E60E-4970-A01C-37301EF7BF98} (Futuremark Measurement Services Client) - http://www.yougamers.com/systeminfo/MSC3.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/softwareupdate/su/…15106/CTPID.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O23 - Service: Automatic LiveUpdate Scheduler - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: COM Host (comHost) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe (file missing)
O23 - Service: Creative Audio Engine Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: Creative Audio Service (CTAudSvcService) - Creative Technology Ltd - C:\Program Files\Creative\Shared Files\CTAudSvc.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: InCD Helper (read only) (InCDsrvR) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Unknown owner - C:\PROGRA~1\Symantec\isPwdSvc.exe (file missing)
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logitech\Bluetooth\LBTServ.exe
O23 - Service: LiveUpdate - Unknown owner - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE (file missing)
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: DiRT Drivers Auto Removal (pr2ah4nc) (pr2ah4nc) - CODEMASTERS - C:\WINDOWS\system32\pr2ah4nc.exe
O23 - Service: SiSoftware Deployment Agent Service (SandraAgentSrv) - SiSoftware - E:\Documents and Settings\MIKE\XP TWEAKS\SiSoftware Sandra Lite 2009\RpcAgentSrv.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe (file missing)
O23 - Service: Symantec AppCore Service (SymAppCore) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe (file missing)
O23 - Service: YPCService - Unknown owner - C:\WINDOWS\system32\YPCSER~1.EXE (file missing)

–
End of file - 11510 bytes

ComboFix 09-09-03.02 - MIKE 09/04/2009 1:14.2.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3071.2625 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\COMBOFIX.exe
Command switches used :: c:\documents and settings\MIKE\Desktop\CFScript.txt
FW: McAfee Personal Firewall *enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\docume~1\MIKE\LOCALS~1\Temp\catchme.dll
c:\documents and settings\MIKE\Local Settings\temp\catchme.dll
e:\program files\Ascentive
e:\program files\Ascentive\PC SpeedScan Pro\PCSpeedScan.exe
e:\program files\Ascentive\PC SpeedScan Pro\SSRes.dll
e:\program files\Ascentive\PC SpeedScan Pro\WatchList.ini
e:\program files\Belvedere
e:\program files\Belvedere\Belvedere.exe
e:\program files\Belvedere\Belvedere.url
e:\program files\Belvedere\resources\belvedere.ico
e:\program files\Belvedere\resources\belvederename.png
e:\program files\Belvedere\resources\both.png
e:\program files\Belvedere\rules.ini
e:\program files\Belvedere\uninst.exe

.
((((((((((((((((((((((((( Files Created from 2009-08-04 to 2009-09-04 )))))))))))))))))))))))))))))))
.

2009-09-01 12:10 . 2009-09-01 12:10 ——– d—–w- c:\documents and settings\MIKE\Application Data\Malwarebytes
2009-09-01 12:09 . 2009-08-03 18:36 38160 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-09-01 12:09 . 2009-09-01 12:09 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-09-01 12:09 . 2009-08-03 18:36 19096 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-08-31 01:45 . 2008-04-14 00:12 116224 -c–a-w- c:\windows\system32\dllcache\xrxwiadr.dll
2009-08-31 01:45 . 2001-08-18 03:36 23040 -c–a-w- c:\windows\system32\dllcache\xrxwbtmp.dll
2009-08-31 01:45 . 2008-04-14 00:12 18944 -c–a-w- c:\windows\system32\dllcache\xrxscnui.dll
2009-08-31 01:45 . 2001-08-18 03:37 27648 -c–a-w- c:\windows\system32\dllcache\xrxftplt.exe
2009-08-31 01:45 . 2001-08-18 03:37 4608 -c–a-w- c:\windows\system32\dllcache\xrxflnch.exe
2009-08-31 01:44 . 2001-08-18 03:37 99865 -c–a-w- c:\windows\system32\dllcache\xlog.exe
2009-08-31 01:44 . 2001-08-17 17:11 16970 -c–a-w- c:\windows\system32\dllcache\xem336n5.sys
2009-08-31 01:44 . 2004-08-04 03:29 19455 -c–a-w- c:\windows\system32\dllcache\wvchntxx.sys
2009-08-31 01:44 . 2004-08-04 03:29 12063 -c–a-w- c:\windows\system32\dllcache\wsiintxx.sys
2009-08-31 01:44 . 2008-04-14 00:12 8192 -c–a-w- c:\windows\system32\dllcache\wshirda.dll
2009-08-31 01:44 . 2008-04-13 18:36 8832 -c–a-w- c:\windows\system32\dllcache\wmiacpi.sys
2009-08-31 01:44 . 2004-08-04 03:31 154624 -c–a-w- c:\windows\system32\dllcache\wlluc48.sys
2009-08-31 01:44 . 2001-08-17 17:12 34890 -c–a-w- c:\windows\system32\dllcache\wlandrv2.sys
2009-08-31 01:44 . 2001-08-17 18:28 771581 -c–a-w- c:\windows\system32\dllcache\winacisa.sys
2009-08-31 01:44 . 2001-08-18 03:36 53760 -c–a-w- c:\windows\system32\dllcache\wiamsmud.dll
2009-08-31 01:44 . 2001-08-18 03:36 87040 -c–a-w- c:\windows\system32\dllcache\wiafbdrv.dll
2009-08-31 01:42 . 2001-08-17 18:28 687999 -c–a-w- c:\windows\system32\dllcache\usrwdxjs.sys
2009-08-31 01:41 . 2001-08-18 03:36 211968 -c–a-w- c:\windows\system32\dllcache\um54scan.dll
2009-08-31 01:40 . 2001-08-17 17:14 123995 -c–a-w- c:\windows\system32\dllcache\tjisdn.sys
2009-08-31 01:39 . 2001-08-17 18:50 103936 -c–a-w- c:\windows\system32\dllcache\sx.sys
2009-08-31 01:38 . 2001-08-17 17:51 37040 -c–a-w- c:\windows\system32\dllcache\sonypi.sys
2009-08-31 01:37 . 2001-08-18 03:36 45568 -c–a-w- c:\windows\system32\dllcache\smb3w.dll
2009-08-31 01:37 . 2001-08-18 03:36 33792 -c–a-w- c:\windows\system32\dllcache\smb0w.dll
2009-08-31 01:37 . 2001-08-18 03:36 28672 -c–a-w- c:\windows\system32\dllcache\sma0w.dll
2009-08-31 01:37 . 2001-08-18 03:36 28160 -c–a-w- c:\windows\system32\dllcache\sm91w.dll
2009-08-31 01:37 . 2004-08-04 03:31 63547 -c–a-w- c:\windows\system32\dllcache\sla30nd5.sys
2009-08-31 01:37 . 2001-08-17 17:12 91294 -c–a-w- c:\windows\system32\dllcache\skfpwin.sys
2009-08-31 01:37 . 2001-08-17 17:12 94698 -c–a-w- c:\windows\system32\dllcache\sk98xwin.sys
2009-08-31 01:37 . 2001-08-17 19:56 157696 -c–a-w- c:\windows\system32\dllcache\sisv256.dll
2009-08-31 01:37 . 2001-08-17 17:50 50432 -c–a-w- c:\windows\system32\dllcache\sisv.sys
2009-08-31 01:37 . 2004-08-04 03:31 32768 -c–a-w- c:\windows\system32\dllcache\sisnic.sys
2009-08-31 01:37 . 2001-08-18 03:36 238592 -c–a-w- c:\windows\system32\dllcache\sisgrv.dll
2009-08-31 01:35 . 2001-08-17 18:51 23936 -c–a-w- c:\windows\system32\dllcache\sccmusbm.sys
2009-08-31 01:34 . 2004-08-04 03:31 20992 -c–a-w- c:\windows\system32\dllcache\rtl8139.sys
2009-08-31 01:33 . 2001-08-17 18:52 33152 -c–a-w- c:\windows\system32\dllcache\ql10wnt.sys
2009-08-31 01:32 . 2001-08-17 19:04 75776 -c–a-w- c:\windows\system32\dllcache\philcam1.sys
2009-08-31 01:31 . 2001-08-18 03:36 20480 -c–a-w- c:\windows\system32\dllcache\ovcomc.dll
2009-08-31 01:30 . 2004-08-04 03:31 132695 -c–a-w- c:\windows\system32\dllcache\netwlan5.sys
2009-08-31 01:29 . 2001-08-17 18:48 12416 -c–a-w- c:\windows\system32\dllcache\msriffwv.sys
2009-08-31 01:29 . 2008-04-13 18:54 22016 -c–a-w- c:\windows\system32\dllcache\msircomm.sys
2009-08-31 01:29 . 2001-08-17 19:02 35200 -c–a-w- c:\windows\system32\dllcache\msgame.sys
2009-08-31 01:29 . 2001-08-17 18:48 6016 -c–a-w- c:\windows\system32\dllcache\msfsio.sys
2009-08-31 01:29 . 2008-04-13 18:46 51200 -c–a-w- c:\windows\system32\dllcache\msdv.sys
2009-08-31 01:29 . 2001-08-17 18:52 17280 -c–a-w- c:\windows\system32\dllcache\mraid35x.sys
2009-08-31 01:29 . 2008-04-13 18:46 15232 -c–a-w- c:\windows\system32\dllcache\mpe.sys
2009-08-31 01:29 . 2001-08-17 18:57 16128 -c–a-w- c:\windows\system32\dllcache\modemcsa.sys
2009-08-31 01:29 . 2001-08-17 18:52 6528 -c–a-w- c:\windows\system32\dllcache\miniqic.sys
2009-08-31 01:29 . 2001-08-17 17:50 320384 -c–a-w- c:\windows\system32\dllcache\mgaum.sys
2009-08-31 01:29 . 2001-08-17 19:56 235648 -c–a-w- c:\windows\system32\dllcache\mgaud.dll
2009-08-31 01:29 . 2008-04-13 18:41 26112 -c–a-w- c:\windows\system32\dllcache\memstpci.sys
2009-08-31 01:29 . 2001-08-18 03:36 47616 -c–a-w- c:\windows\system32\dllcache\memgrp.dll
2009-08-31 01:27 . 2001-08-18 03:36 37376 -c–a-w- c:\windows\system32\dllcache\kousd.dll
2009-08-31 01:27 . 2008-04-14 00:11 48640 -c–a-w- c:\windows\system32\dllcache\kdsui.dll
2009-08-31 01:27 . 2008-04-14 00:11 253952 -c–a-w- c:\windows\system32\dllcache\kdsusd.dll
2009-08-31 01:27 . 2001-08-18 03:36 8192 -c–a-w- c:\windows\system32\dllcache\kbdkor.dll
2009-08-31 01:25 . 2001-08-17 18:47 13056 -c–a-w- c:\windows\system32\dllcache\inport.sys
2009-08-31 01:25 . 2001-08-17 18:52 16000 -c–a-w- c:\windows\system32\dllcache\ini910u.sys
2009-08-31 01:25 . 2001-08-18 03:36 372824 -c–a-w- c:\windows\system32\dllcache\iconf32.dll
2009-08-31 01:25 . 2001-08-17 19:06 100992 -c–a-w- c:\windows\system32\dllcache\icam5usb.sys
2009-08-31 01:25 . 2001-08-18 03:36 20480 -c–a-w- c:\windows\system32\dllcache\icam5ext.dll
2009-08-31 01:25 . 2001-08-18 03:36 45056 -c–a-w- c:\windows\system32\dllcache\icam5com.dll
2009-08-31 01:25 . 2001-08-17 19:06 154496 -c–a-w- c:\windows\system32\dllcache\icam4usb.sys
2009-08-31 01:25 . 2001-08-18 03:36 61952 -c–a-w- c:\windows\system32\dllcache\icam4ext.dll
2009-08-31 01:25 . 2001-08-18 03:36 91136 -c–a-w- c:\windows\system32\dllcache\icam4com.dll
2009-08-31 01:23 . 2001-08-17 18:28 115807 -c–a-w- c:\windows\system32\dllcache\hsf_fsks.sys
2009-08-31 01:22 . 2001-08-17 18:28 907456 -c–a-w- c:\windows\system32\dllcache\hcf_msft.sys
2009-08-31 01:21 . 2001-08-17 17:10 22090 -c–a-w- c:\windows\system32\dllcache\fem556n5.sys
2009-08-31 01:20 . 2001-08-17 17:10 19996 -c–a-w- c:\windows\system32\dllcache\em556n4.sys
2009-08-31 01:19 . 2001-08-18 03:36 229462 -c–a-w- c:\windows\system32\dllcache\digifwrk.dll
2009-08-31 01:18 . 2008-04-13 18:36 10240 -c–a-w- c:\windows\system32\dllcache\compbatt.sys
2009-08-31 01:17 . 2001-08-17 17:13 164923 -c–a-w- c:\windows\system32\dllcache\diapi2.sys
2009-08-31 01:17 . 2008-04-14 00:11 121856 -c–a-w- c:\windows\system32\dllcache\camext30.dll
2009-08-31 01:17 . 2001-08-18 03:36 236032 -c–a-w- c:\windows\system32\dllcache\camext20.dll
2009-08-31 01:17 . 2001-08-18 03:36 74240 -c–a-w- c:\windows\system32\dllcache\camexo20.dll
2009-08-31 01:17 . 2001-08-17 19:04 171264 -c–a-w- c:\windows\system32\dllcache\camdrv30.sys
2009-08-31 01:17 . 2001-08-17 19:05 314752 -c–a-w- c:\windows\system32\dllcache\camdro21.sys
2009-08-31 01:17 . 2001-08-17 19:04 223232 -c–a-w- c:\windows\system32\dllcache\camdrv21.sys
2009-08-31 01:16 . 2001-08-17 18:51 13824 -c–a-w- c:\windows\system32\dllcache\bulltlp3.sys
2009-08-31 01:16 . 2001-08-17 17:11 31529 -c–a-w- c:\windows\system32\dllcache\brzwlan.sys
2009-08-31 01:16 . 2001-08-17 18:12 10368 -c–a-w- c:\windows\system32\dllcache\brusbscn.sys
2009-08-31 01:16 . 2001-08-17 18:12 60416 -c–a-w- c:\windows\system32\dllcache\brserwdm.sys
2009-08-31 01:16 . 2001-08-17 18:12 11008 -c–a-w- c:\windows\system32\dllcache\brusbmdm.sys
2009-08-31 01:14 . 2001-08-17 19:55 96128 -c–a-w- c:\windows\system32\dllcache\ati.dll
2009-08-31 01:13 . 2001-08-17 19:56 66048 -c–a-w- c:\windows\system32\dllcache\s3legacy.dll
2009-08-19 16:02 . 2009-08-19 16:02 70721 —-a-w- c:\windows\hpqins01.dat
2009-08-18 08:27 . 2009-08-18 08:27 ——– d—–w- c:\windows\system32\wbem\Repository

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-01 12:29 . 2009-05-29 05:59 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-09-01 11:45 . 2009-09-01 11:45 7396 —-a-w- c:\windows\system32\drivers\pctcore.cat
2009-08-30 01:53 . 2009-08-30 01:53 13470 —-a-w- c:\documents and settings\All Users\Application Data\xml7B.tmp
2009-08-30 01:53 . 2008-11-17 03:12 2311 —-a-w- c:\documents and settings\All Users\Application Data\xml76.tmp
2009-08-30 01:53 . 2008-10-17 11:08 7918 —-a-w- c:\documents and settings\All Users\Application Data\xml11.tmp
2009-08-26 13:28 . 2006-10-03 11:11 ——– d—–w- c:\documents and settings\MIKE\Application Data\Music Coach
2009-08-19 16:01 . 2008-04-11 13:28 111990 -c–a-w- c:\windows\hpoins07.dat
2009-08-17 23:48 . 2009-08-17 23:48 0 —-a-w- c:\documents and settings\All Users\Application Data\xml5B.tmp
2009-08-17 21:03 . 2009-08-17 21:03 0 —-a-w- c:\documents and settings\All Users\Application Data\xml57.tmp
2009-08-16 19:25 . 2009-08-16 19:25 0 —-a-w- c:\documents and settings\All Users\Application Data\xml50.tmp
2009-08-05 09:01 . 2004-08-04 13:00 204800 —-a-w- c:\windows\system32\mswebdvd.dll
2009-08-04 22:50 . 2009-08-04 04:38 5154304 —-a-w- C:\WindowsDefender.msi
2009-07-25 09:02 . 2009-07-25 09:02 0 —-a-w- c:\documents and settings\All Users\Application Data\xml31.tmp
2009-07-17 19:01 . 2004-08-04 12:00 58880 —-a-w- c:\windows\system32\atl.dll
2009-07-14 04:43 . 2004-08-04 13:00 286208 —-a-w- c:\windows\system32\wmpdxm.dll
2009-06-16 14:36 . 2004-08-04 13:00 81920 —-a-w- c:\windows\system32\fontsub.dll
2009-06-16 14:36 . 2004-08-04 13:00 119808 —-a-w- c:\windows\system32\t2embed.dll
2009-06-12 12:31 . 2004-08-04 13:00 80896 —-a-w- c:\windows\system32\tlntsess.exe
2009-06-12 12:31 . 2004-08-04 13:00 76288 —-a-w- c:\windows\system32\telnet.exe
2009-06-10 14:19 . 2006-02-12 02:51 2066432 —-a-w- c:\windows\system32\mstscax.dll
2009-06-10 14:13 . 2004-08-04 13:00 84992 —-a-w- c:\windows\system32\avifil32.dll
2009-06-10 06:14 . 2004-08-04 12:00 132096 —-a-w- c:\windows\system32\wkssvc.dll
2006-03-28 08:23 . 2006-03-05 22:38 34387328 -c—-w- c:\program files\setpoint247enu.exe
2006-03-08 05:42 . 2006-03-08 05:42 16384 -c—-w- c:\program files\10x10_Grid.xlt
2006-03-06 22:28 . 2006-03-06 22:28 9543112 -c—-w- c:\program files\ldm.exe
2006-03-06 22:12 . 2006-03-06 22:12 242 -c—-w- c:\program files\XPSP2Patch.reg
2006-03-06 22:10 . 2006-03-06 22:10 4429593 -c—-w- c:\program files\it222enu.exe
2006-02-12 15:44 . 2006-02-12 15:44 65 -c—-w- c:\program files\Common Files\appop.log
.

((((((((((((((((((((((((((((( SnapShot@2009-09-02_09.04.02 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-03-20 16:48 . 2009-03-20 16:48 183808 c:\windows\Installer\18c36.msp
+ 2009-09-04 05:34 . 2009-09-04 05:34 240128 c:\windows\assembly\NativeImages_v2.0.50727_32\WindowsFormsIntegra#\6a818099f0386e2356ae94f886a2196f\WindowsFormsIntegration.ni.dll
- 2009-08-19 13:20 . 2009-08-19 13:20 240128 c:\windows\assembly\NativeImages_v2.0.50727_32\WindowsFormsIntegra#\6a818099f0386e2356ae94f886a2196f\WindowsFormsIntegration.ni.dll
+ 2009-09-04 05:34 . 2009-09-04 05:34 224768 c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\f475294d8c7dc2dd4febeef27bc0417e\PresentationFramework.Classic.ni.dll
- 2009-08-19 13:18 . 2009-08-19 13:18 224768 c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\f475294d8c7dc2dd4febeef27bc0417e\PresentationFramework.Classic.ni.dll
+ 2009-09-04 05:34 . 2009-09-04 05:34 539648 c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\8003abaf6bcf70f7eb620d06837e897b\PresentationFramework.Luna.ni.dll
- 2009-08-19 13:18 . 2009-08-19 13:18 539648 c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\8003abaf6bcf70f7eb620d06837e897b\PresentationFramework.Luna.ni.dll
- 2009-08-19 13:18 . 2009-08-19 13:18 368128 c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\59a67874d8d8475faa5be1d993083d12\PresentationFramework.Aero.ni.dll
+ 2009-09-04 05:34 . 2009-09-04 05:34 368128 c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\59a67874d8d8475faa5be1d993083d12\PresentationFramework.Aero.ni.dll
- 2009-08-19 13:18 . 2009-08-19 13:18 258048 c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\2c980c9a5051d723c6ec2a78a3d0e2b3\PresentationFramework.Royale.ni.dll
+ 2009-09-04 05:34 . 2009-09-04 05:34 258048 c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\2c980c9a5051d723c6ec2a78a3d0e2b3\PresentationFramework.Royale.ni.dll
- 2009-08-19 13:19 . 2009-08-19 13:19 1035264 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Printing\646ab52eef343380aa002c220dc31e13\System.Printing.ni.dll
+ 2009-09-04 05:34 . 2009-09-04 05:34 1035264 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Printing\646ab52eef343380aa002c220dc31e13\System.Printing.ni.dll
- 2009-08-19 13:18 . 2009-08-19 13:18 2128896 c:\windows\assembly\NativeImages_v2.0.50727_32\ReachFramework\4bfb3048bf200a6a8592d1b4ba861a7f\ReachFramework.ni.dll
+ 2009-09-04 05:34 . 2009-09-04 05:34 2128896 c:\windows\assembly\NativeImages_v2.0.50727_32\ReachFramework\4bfb3048bf200a6a8592d1b4ba861a7f\ReachFramework.ni.dll
+ 2009-09-04 05:34 . 2009-09-04 05:34 1657856 c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationUI\6bafb1a2a73794ddb9761cb321c9e7e2\PresentationUI.ni.dll
- 2009-08-19 13:18 . 2009-08-19 13:18 1657856 c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationUI\6bafb1a2a73794ddb9761cb321c9e7e2\PresentationUI.ni.dll
- 2009-08-19 13:18 . 2009-08-19 13:18 14327808 c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\96e710f47c601cba3f2348a8d11ddede\PresentationFramework.ni.dll
+ 2009-09-04 05:34 . 2009-09-04 05:34 14327808 c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\96e710f47c601cba3f2348a8d11ddede\PresentationFramework.ni.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Creative Detector"="c:\program files\Creative\MediaSource\Detector\CTDetect.exe" [2004-12-02 102400]
"MtdAcqu"="c:\program files\Creative\MediaSource5\MtdAcqu.exe" [2006-03-08 278528]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AudioDrvEmulator"="c:\program files\Creative\Shared Files\Module Loader\DLLML.exe" [2005-06-16 49152]
"YBrowser"="c:\progra~1\Yahoo!\browser\ybrwicon.exe" [2006-07-21 129536]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-12-26 13680640]
"Start WingMan Profiler"="c:\program files\Logitech\Gaming Software\LWEMon.exe" [2007-09-25 93208]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-12-26 86016]
"VolPanel"="c:\program files\Creative\Volume Panel\VolPanlu.exe" [2008-08-06 233576]
"tsnp2std"="c:\windows\tsnp2std.exe" [2007-08-31 262144]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2006-11-04 866584]
"snp2std"="c:\windows\vsnp2std.exe" [2007-08-07 348160]
"CTHelper"="CTHELPER.EXE" - c:\windows\CTHELPER.EXE [2006-08-17 17920]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2008-10-07 1630208]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-23 39264]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-5-12 282624]
Logitech SetPoint.lnk - c:\setpoint\SetPoint.exe [2008-1-31 789008]
NaturalColorLoad.lnk - c:\program files\SEC\Natural Color\NaturalColorLoad.exe [2006-2-11 155715]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2008-01-09 18:30 72208 ——w- c:\program files\Common Files\Logitech\Bluetooth\LBTWLgn.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WB]
2001-12-21 07:34 24576 ——w- c:\progra~1\OBJECT~1\WINDOW~1\fastload.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^InterVideo WinCinema Manager.lnk]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\HP\\HP Software Update\\HPWUCli.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\Creative\\Sound Blaster X-Fi\\Diagnostics\\diagnos3.exe"=
"c:\\WINDOWS\\system32\\mmc.exe"=
"c:\\Program Files\\Ahead\\Nero MediaHome\\NeroMediaHome.exe"=
"c:\\Program Files\\Ahead\\Nero ShowTime\\ShowTime.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Codemasters\\DiRT\\DiRT.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Logitech\\Logitech Harmony Remote Software 7\\HarmonyRemote.exe"=
"e:\\Documents and Settings\\MIKE\\XP TWEAKS\\SiSoftware Sandra Lite 2009\\RpcAgentSrv.exe"=
"c:\\Program Files\\TmUnitedForever\\TmForever.exe"=
"e:\\Documents and Settings\\SteamApps\\common\\gti racing\\GTIRacing.exe"=
"e:\\Documents and Settings\\SteamApps\\common\\xpand rally\\xpandrally.exe"=
"e:\\Documents and Settings\\SteamApps\\common\\xpand rally\\ChromEd.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"e:\\Documents and Settings\\MIKE\\XP TWEAKS\\SiSoftware Sandra Lite 2009\\WNt500x86\\RpcSandraSrv.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)

R0 ivicd;Ivi CDVD Filter Driver;c:\windows\system32\drivers\ivicd.sys [2/12/2006 10:44 AM 38784]
R0 pe3ah4nc;DiRT Environment Driver (pe3ah4nc);c:\windows\system32\drivers\pe3ah4nc.sys [5/18/2007 2:53 PM 64880]
R0 ps6ah4nc;DiRT Synchronization Driver (ps6ah4nc);c:\windows\system32\drivers\ps6ah4nc.sys [5/18/2007 2:52 PM 55160]
R0 ps7ah4nc;DiRT Synchronization Driver (ps7ah4nc);c:\windows\system32\drivers\ps7ah4nc.sys [8/17/2007 12:34 PM 68208]
R2 AsProbe;AsProbe;c:\windows\system32\drivers\AsProbe.sys [2/27/2006 9:58 AM 4644]
R2 LBeepKE;LBeepKE;c:\windows\system32\drivers\LBeepKE.sys [7/27/2006 11:56 PM 3712]
R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [11/3/2006 8:19 PM 13592]
R3 iviudf;iviudf;c:\windows\system32\drivers\IviUdf.sys [2/12/2006 10:44 AM 116224]
S0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys –> c:\windows\system32\drivers\PCTCore.sys [?]
S2 pr2ah4nc;DiRT Drivers Auto Removal (pr2ah4nc);c:\windows\system32\pr2ah4nc.exe svc –> c:\windows\system32\pr2ah4nc.exe svc [?]
S3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [9/8/2008 3:01 AM 79360]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;\??\c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys –> c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [?]
S3 SandraAgentSrv;SiSoftware Deployment Agent Service;e:\documents and settings\MIKE\XP TWEAKS\SiSoftware Sandra Lite 2009\RpcAgentSrv.exe [10/17/2008 6:08 AM 98488]

— Other Services/Drivers In Memory —

*NewlyCreated* - COMHOST
*Deregistered* - udffsrec
.
Contents of the 'Scheduled Tasks' folder

2009-09-04 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-04 01:20]

2009-08-16 c:\windows\Tasks\ParetoLogic Registration.job
- c:\program files\Common Files\ParetoLogic\UUS2\UUS.dll [2007-09-19 05:55]

2008-09-06 c:\windows\Tasks\ParetoLogic Update.job
- c:\program files\Common Files\ParetoLogic\UUS2\Pareto_Update.exe [2007-09-19 05:55]
.
.
——- Supplementary Scan ——-
.
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
uStart Page = hxxp://www.yahoo.com/?fr=fp-yie8
Trusted Zone: creative.com\us
Trusted Zone: samsungportal.com
Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\desktop messenger\8876480\Program\GAPlugProtocol-8876480.dll
DPF: Microsoft XML Parser for Java
DPF: {08BCD971-A13B-4D6E-A2A5-E9B2324FC00D} - hxxp://service.samsungportal.com/EP/web/common/cabfiles/CM_ClientEXE.cab
DPF: {714E667D-360C-4BFB-8C1A-E4812B608CC1} - hxxp://service.samsungportal.com/EP/web/common/cabfiles/ACUBETrustChecker.cab
DPF: {9D67EBF0-AF1A-4BCE-BAC9-C84A9383E0B3} - hxxp://service.samsungportal.com/EP/web/common/cabfiles/UniSSOCheck.cab
DPF: {C4D88B8E-352B-11D6-BF77-0080C740A177} - hxxp://service.samsungportal.com/EP/web/common/cabfiles/ActiveXSetup.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-04 01:20
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(468)
c:\program files\common files\logitech\bluetooth\LBTWlgn.dll
c:\program files\common files\logitech\bluetooth\LBTServ.dll
c:\progra~1\OBJECT~1\WINDOW~1\fastload.dll

- - - - - - - > 'explorer.exe'(2020)
c:\windows\system32\nview.dll
c:\setpoint\GameHook.dll
c:\setpoint\lgscroll.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\program files\Ahead\InCD\InCDsrv.exe
c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
c:\program files\Creative\Shared Files\CTAudSvc.exe
c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
c:\windows\system32\CTSVCCDA.EXE
c:\windows\system32\nvsvc32.exe
c:\windows\system32\HPZipm12.exe
c:\progra~1\Yahoo!\browser\ycommon.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\rundll32.exe
c:\program files\Common Files\Logishrd\KHAL2\KHALMNPR.exe
c:\windows\system32\CTxfispi.exe
c:\program files\HP\Digital Imaging\bin\hpqste08.exe
.
**************************************************************************
.
Completion time: 2009-09-04 1:23 - machine was rebooted
ComboFix-quarantined-files.txt 2009-09-04 06:23
ComboFix2.txt 2009-09-02 09:05

Pre-Run: 32,514,924,544 bytes free
Post-Run: 32,445,501,440 bytes free

335 — E O F — 2009-09-04 05:34

Logs:

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] Novice needs help, XP Pro, Several programs look like they

✨ Ask AI

Ask AI