Spyware / Malware / Virus Removal

[Resolved] browser keeps redirecting

10 min read

Looking for the outcome? Ask AI

lisa597 Topic Starter

Post #1September 1, 2009, 12:30 PM UTC last edited September 1, 2009, 12:32 PM UTC

Please can you help me a few days ago my browser started redirecting to sites that i am not looking for this has become more common as time has went on. Also it keeps loading a screen saying that im infected and need to do a scan by installing an anti virus. Hope you can help as it is causing major problems for me, thanks in advance im hoping Lisa. Sorry forgot to say im using firefox as my browser

Attachments:

📎hijackthislog.txt

Raktor

Post #2September 1, 2009, 1:53 PM UTC

[external image: Posted Image]

Hi, welcome to the WTT Forums. My username is Raktor, and I would be glad to help you with your malware issues. I'd be grateful if you would note the following:

Absence of symptoms does not always mean the computer is clean
Please do not run any scans or fixes without my direction.
Finally, stay with this topic until I give you the final 'All clear' post.

Please follow the instructions in the Welcome New Members thread, and post back in this topic with those logs.

lisa597

Post #3September 1, 2009, 2:54 PM UTC

ROOTREPL © AD, 2007-2009 ================================================== Scan Start Time: 2009/09/01 15:44 Program Version: Version 1.3.5.0 Windows Version: Windows XP Media Center Edition SP3 ================================================== Drivers ——————- Name: PCI_PNP7072 Image Path: \Driver\PCI_PNP7072 Address: 0x00000000 Size: 0 File Visible: No Signed: - Status: - Name: rootrepeal.sys Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys Address: 0xA9A0A000 Size: 49152 File Visible: No Signed: - Status: - Name: spbn.sys Image Path: spbn.sys Address: 0xBA6A6000 Size: 1052672 File Visible: No Signed: - Status: - Name: sptd Image Path: \Driver\sptd Address: 0x00000000 Size: 0 File Visible: No Signed: - Status: - Hidden Services ——————- Service Name: kbiwkmparmyyxr Image Path: C:\WINDOWS\system32\drivers\kbiwkmmqlhxlxu.sys ==EOF== DDS Report DDS (Ver_09-06-26.01) - NTFSx86 Run by [removed] at 15:41:00.00 on 01/09/2009 Internet Explorer: 6.0.2900.5512 Microsoft Windows XP Professional 5.1.2600.3.1252.44.1033.18.2046.1259 [GMT 1:00] AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF} ============== Running Processes =============== C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup C:\WINDOWS\system32\Ati2evxx.exe svchost.exe svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe svchost.exe C:\Program Files\AskBarDis\bar\bin\AskService.exe C:\Program Files\AskBarDis\bar\bin\ASKUpgrade.exe C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\Program Files\Google\Update\GoogleUpdate.exe C:\WINDOWS\eHome\ehRecvr.exe C:\WINDOWS\eHome\ehSched.exe C:\WINDOWS\system32\PnkBstrA.exe C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\PROGRA~1\AVG\AVG8\avgnsx.exe svchost.exe C:\WINDOWS\system32\svchost.exe -k imgsvc C:\WINDOWS\ehome\ehtray.exe C:\PROGRA~1\AVG\AVG8\avgtray.exe C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\USBDeviceService.exe C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe C:\Program Files\802.11g USB Wireless Network Driver and Utility HW.14 V1.0.0\RtWLan.exe C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe C:\PROGRA~1\AVG\AVG8\avgemc.exe C:\Program Files\AVG\AVG8\avgcsrvx.exe C:\WINDOWS\eHome\ehmsas.exe C:\WINDOWS\system32\dllhost.exe C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe C:\Program Files\GameTracker\GSInGameService.exe C:\WINDOWS\system32\PnkBstrB.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\explorer.exe C:\Documents and Settings\Family\My Documents\Downloads\dds.scr ============== Pseudo HJT Report =============== uStart Page = hxxp://search.bearshare.com/ uSearch Page = hxxp://www.google.com uSearch Bar = hxxp://search.bearshare.com/sidebar.html?src=ssb mDefault_Page_URL = hxxp://format.packardbell.com/cgi-bin/redirect/?country=UK&range=AD&phase=8&key=IESTART uInternet Connection Wizard,ShellNext = hxxp://www1.partypoker.com/pam_images/installer/omn.htm?pid=Poker&bid=Party&lid=en&sid=1 uInternet Settings,ProxyOverride = *.local uSearchURL,(Default) = hxxp://www.google.com/keyword/%s mSearchAssistant = hxxp://www.google.com/ie uURLSearchHooks: free-downloads.net Toolbar: {ecdee021-0d17-467f-a1ff-c7a115230949} - BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll BHO: AskBar BHO: {201f27d4-3704-41d6-89c1-aa35e39143ed} - c:\program files\askbardis\bar\bin\askBar.dll BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll BHO: UrlHelper Class: {74322bf9-df26-493f-b0da-6d2fc5e6429e} - c:\program files\bearshare applications\bearshare\BearShareIEHelper.dll {d56d7a88-9574-4acc-8ac8-dd7d34f4a1c1} BHO: {ecdee021-0d17-467f-a1ff-c7a115230949} - free-downloads.net Toolbar TB: free-downloads.net Toolbar: {ecdee021-0d17-467f-a1ff-c7a115230949} - TB: Ask Toolbar: {3041d03e-fd4b-44e0-b742-2d9b88305f98} - c:\program files\askbardis\bar\bin\askBar.dll TB: {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - No File uRun: [RocketDock] "c:\windows\bricopacks\vista inspirat 2\rocketdock\RocketDock.exe" uRun: [Anders Kjersem: TransBar] c:\program files\anders kjersem\transbar\TransBar.exe /NoConfig uRun: [Steam] "c:\program files\steam\steam.exe" -silent uRunOnce: [SpybotDeletingB8303] command.com /c del "c:\windows\system32\drivers\kbiwkmmqlhxlxu.sys_old" uRunOnce: [SpybotDeletingD6013] cmd.exe /c del "c:\windows\system32\drivers\kbiwkmmqlhxlxu.sys_old" uRunOnce: [SpybotDeletingB5871] command.com /c del "c:\windows\system32\drivers\kbiwkmmqlhxlxu.sys" uRunOnce: [SpybotDeletingD7598] cmd.exe /c del "c:\windows\system32\drivers\kbiwkmmqlhxlxu.sys" uRunOnce: [SpybotDeletingB2390] command.com /c del "c:\windows\system32\kbiwkmmvvmlkte.dll_old" uRunOnce: [SpybotDeletingD3371] cmd.exe /c del "c:\windows\system32\kbiwkmmvvmlkte.dll_old" uRunOnce: [SpybotDeletingB9912] command.com /c del "c:\windows\system32\kbiwkmmvvmlkte.dll" uRunOnce: [SpybotDeletingD7537] cmd.exe /c del "c:\windows\system32\kbiwkmmvvmlkte.dll" uRunOnce: [SpybotDeletingB6884] command.com /c del "c:\windows\system32\kbiwkmxeyrxvxu.dll_old" uRunOnce: [SpybotDeletingD787] cmd.exe /c del "c:\windows\system32\kbiwkmxeyrxvxu.dll_old" uRunOnce: [SpybotDeletingB3856] command.com /c del "c:\windows\system32\kbiwkmxeyrxvxu.dll" uRunOnce: [SpybotDeletingD9962] cmd.exe /c del "c:\windows\system32\kbiwkmxeyrxvxu.dll" uRunOnce: [SpybotDeletingB3285] command.com /c del "c:\windows\system32\kbiwkmbmqegvpx.dat_old" uRunOnce: [SpybotDeletingD863] cmd.exe /c del "c:\windows\system32\kbiwkmbmqegvpx.dat_old" uRunOnce: [SpybotDeletingB5472] command.com /c del "c:\windows\system32\kbiwkmbmqegvpx.dat" uRunOnce: [SpybotDeletingD1502] cmd.exe /c del "c:\windows\system32\kbiwkmbmqegvpx.dat" uRunOnce: [SpybotDeletingB5956] command.com /c del "c:\windows\system32\kbiwkmhnunupkc.dat_old" uRunOnce: [SpybotDeletingD6330] cmd.exe /c del "c:\windows\system32\kbiwkmhnunupkc.dat_old" uRunOnce: [SpybotDeletingB5694] command.com /c del "c:\windows\system32\kbiwkmhnunupkc.dat" uRunOnce: [SpybotDeletingD3263] cmd.exe /c del "c:\windows\system32\kbiwkmhnunupkc.dat" mRun: [PHIME2002ASync] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /SYNC mRun: [PHIME2002A] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /IMEName mRun: [ehTray] c:\windows\ehome\ehtray.exe mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe mRun: [LXCECATS] rundll32 c:\windows\system32\spool\drivers\w32x86\3\LXCEtime.dll,_RunDLLEntry@16 mRun: [Windows Center] iexplorer.exe mRun: [AdobeCS4ServiceManager] "c:\program files\common files\adobe\cs4servicemanager\CS4ServiceManager.exe" -launchedbylogin mRunOnce: [SpybotDeletingA8953] command.com /c del "c:\windows\system32\drivers\kbiwkmmqlhxlxu.sys_old" mRunOnce: [SpybotDeletingC7547] cmd.exe /c del "c:\windows\system32\drivers\kbiwkmmqlhxlxu.sys_old" mRunOnce: [SpybotDeletingA513] command.com /c del "c:\windows\system32\drivers\kbiwkmmqlhxlxu.sys" mRunOnce: [SpybotDeletingC5156] cmd.exe /c del "c:\windows\system32\drivers\kbiwkmmqlhxlxu.sys" mRunOnce: [SpybotDeletingA9351] command.com /c del "c:\windows\system32\kbiwkmmvvmlkte.dll_old" mRunOnce: [SpybotDeletingC1822] cmd.exe /c del "c:\windows\system32\kbiwkmmvvmlkte.dll_old" mRunOnce: [SpybotDeletingA2957] command.com /c del "c:\windows\system32\kbiwkmmvvmlkte.dll" mRunOnce: [SpybotDeletingC4990] cmd.exe /c del "c:\windows\system32\kbiwkmmvvmlkte.dll" mRunOnce: [SpybotDeletingA3299] command.com /c del "c:\windows\system32\kbiwkmxeyrxvxu.dll_old" mRunOnce: [SpybotDeletingC3888] cmd.exe /c del "c:\windows\system32\kbiwkmxeyrxvxu.dll_old" mRunOnce: [SpybotDeletingA947] command.com /c del "c:\windows\system32\kbiwkmxeyrxvxu.dll" mRunOnce: [SpybotDeletingC5624] cmd.exe /c del "c:\windows\system32\kbiwkmxeyrxvxu.dll" mRunOnce: [SpybotDeletingA5066] command.com /c del "c:\windows\system32\kbiwkmbmqegvpx.dat_old" mRunOnce: [SpybotDeletingC5833] cmd.exe /c del "c:\windows\system32\kbiwkmbmqegvpx.dat_old" mRunOnce: [SpybotDeletingA5765] command.com /c del "c:\windows\system32\kbiwkmbmqegvpx.dat" mRunOnce: [SpybotDeletingC6985] cmd.exe /c del "c:\windows\system32\kbiwkmbmqegvpx.dat" mRunOnce: [SpybotDeletingA4370] command.com /c del "c:\windows\system32\kbiwkmhnunupkc.dat_old" mRunOnce: [SpybotDeletingC7357] cmd.exe /c del "c:\windows\system32\kbiwkmhnunupkc.dat_old" mRunOnce: [SpybotDeletingA1435] command.com /c del "c:\windows\system32\kbiwkmhnunupkc.dat" mRunOnce: [SpybotDeletingC4300] cmd.exe /c del "c:\windows\system32\kbiwkmhnunupkc.dat" dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE StartupFolder: c:\docume~1\family\startm~1\programs\startup\rocket~1.lnk - c:\windows\bricopacks\vista inspirat 2\rocketdock\RocketDock.exe StartupFolder: c:\docume~1\family\startm~1\programs\startup\winflip.lnk - c:\program files\winflip\WinFlip.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\80211g~1.lnk - c:\program files\802.11g usb wireless network driver and utility hw.14 v1.0.0\RtWLan.exe uPolicies-explorer: NoInternetIcon = 1 (0x1) uPolicies-explorer: NoActiveDesktop = 00000000 IE: {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - c:\program files\partygaming\partypoker\RunApp.exe IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0015-0000-0004-ABCDEFFEDCBC} - c:\program files\java\jre1.5.0_04\bin\npjpi150_04.dll DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_04-windows-i586.cab DPF: {CAFEEFAC-0015-0000-0004-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_04-windows-i586.cab Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - c:\program files\belarc\advisor\system\BAVoilaX.dll Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll Notify: AtiExtEvent - Ati2evxx.dll Notify: avgrsstarter - avgrsstx.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll LSA: Notification Packages = scecli c:\windows\system32\tozewala.dll c:\windows\system32\ruhekepu.dll c:\windows\system32\kivigoru.dll ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\family\applic~1\mozilla\firefox\profiles\905ajkym.default\ FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q= FF - prefs.js: browser.startup.homepage - hxxp://www.google.co.uk/firefox FF - component: c:\program files\avg\avg8\firefox\components\avgssff.dll FF - plugin: c:\program files\google\update\1.2.183.7\npGoogleOneClick8.dll FF - plugin: c:\program files\java\jre1.5.0_04\bin\NPJava11.dll FF - plugin: c:\program files\java\jre1.5.0_04\bin\NPJava12.dll FF - plugin: c:\program files\java\jre1.5.0_04\bin\NPJava13.dll FF - plugin: c:\program files\java\jre1.5.0_04\bin\NPJava14.dll FF - plugin: c:\program files\java\jre1.5.0_04\bin\NPJava32.dll FF - plugin: c:\program files\java\jre1.5.0_04\bin\NPJPI150_04.dll FF - plugin: c:\program files\java\jre1.5.0_04\bin\NPOJI610.dll FF - plugin: c:\program files\mozilla firefox\plugins\np-mswmp.dll FF - plugin: c:\program files\mozilla firefox\plugins\npLegitCheckPlugin.dll FF - plugin: c:\program files\mozilla firefox\plugins\npnul32.dll FF - plugin: c:\program files\veetle\player\npvlc.dll FF - plugin: c:\program files\veetle\plugins\npVeetle.dll FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\ —- FIREFOX POLICIES —- c:\program files\mozilla firefox 3.5 beta 4\greprefs\all.js - pref("media.enforce_same_site_origin", false); c:\program files\mozilla firefox 3.5 beta 4\greprefs\all.js - pref("media.cache_size", 51200); c:\program files\mozilla firefox 3.5 beta 4\greprefs\all.js - pref("media.ogg.enabled", true); c:\program files\mozilla firefox 3.5 beta 4\greprefs\all.js - pref("media.wave.enabled", true); c:\program files\mozilla firefox 3.5 beta 4\greprefs\all.js - pref("media.autoplay.enabled", true); c:\program files\mozilla firefox 3.5 beta 4\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true); c:\program files\mozilla firefox 3.5 beta 4\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess"); c:\program files\mozilla firefox 3.5 beta 4\greprefs\all.js - pref("dom.storage.default_quota", 5120); c:\program files\mozilla firefox 3.5 beta 4\greprefs\all.js - pref("network.http.prompt-temp-redirect", true); c:\program files\mozilla firefox 3.5 beta 4\greprefs\all.js - pref("gestures.enable_single_finger_input", true); c:\program files\mozilla firefox 3.5 beta 4\greprefs\all.js - pref("network.tcp.sendbuffer", 131072); c:\program files\mozilla firefox 3.5 beta 4\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2); c:\program files\mozilla firefox 3.5 beta 4\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~"); c:\program files\mozilla firefox 3.5 beta 4\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0); c:\program files\mozilla firefox 3.5 beta 4\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2); c:\program files\mozilla firefox 3.5 beta 4\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror"); c:\program files\mozilla firefox 3.5 beta 4\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false); c:\program files\mozilla firefox 3.5 beta 4\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false); c:\program files\mozilla firefox 3.5 beta 4\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json"); ============= SERVICES / DRIVERS =============== R0 xfilt;VIA SATA IDE Hot-plug Driver;c:\windows\system32\drivers\xfilt.sys [2009-5-26 21144] R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-5-7 335240] R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2009-5-7 27784] R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-5-7 108552] R2 ASKService;ASKService;c:\program files\askbardis\bar\bin\AskService.exe [2009-8-29 464264] R2 ASKUpgrade;ASKUpgrade;c:\program files\askbardis\bar\bin\ASKUpgrade.exe [2009-8-29 234888] R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\avg\avg8\avgemc.exe [2009-5-7 908056] R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2009-5-7 297752] R2 GS In-Game Service;GS In-Game Service;c:\program files\gametracker\GSInGameService.exe [2009-9-1 1612128] R2 McrdSvc;Media Center Extender Service;c:\windows\ehome\mcrdsvc.exe [2005-8-5 99328] R3 3xHybrid;ASUSTek SAA713x PCI Card;c:\windows\system32\drivers\3xHybrid.sys [2009-5-6 882688] R3 RTLWUSB;Realtek RTL8187 Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\drivers\RTL8187.sys [2009-5-6 332928] R3 SjyPkt;SjyPkt;c:\windows\system32\drivers\SjyPkt.sys [2009-5-6 13532] R3 X10Hid;X10 Hid Device;c:\windows\system32\drivers\x10hid.sys [2009-5-6 7040] S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [2009-5-15 1684736] S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\gamemon.des -service –> c:\windows\system32\GameMon.des -service [?] S4 gupdate1c9d3c98a12cbc;Google Update Service (gupdate1c9d3c98a12cbc);c:\program files\google\update\GoogleUpdate.exe [2009-5-13 133104] =============== Created Last 30 ================ 2009-09-01 15:27 –d—– c:\program files\common files\ParetoLogic 2009-09-01 13:51 –d—– c:\program files\GameTracker 2009-09-01 13:51 –d—– c:\docume~1\family\applic~1\GameTracker 2009-08-31 22:22 –d—– c:\program files\Trend Micro 2009-08-31 12:14 –d—– c:\docume~1\alluse~1\applic~1\F-Secure 2009-08-30 12:22 309,616 a——- c:\windows\system32\wmv8dmod.dll 2009-08-30 12:22 245,760 a——- c:\windows\system32\mp4sds32.ax 2009-08-30 12:22 420,240 a——- c:\windows\system32\mpg4c32.dll 2009-08-29 21:46 54,156 a—h— c:\windows\QTFont.qfn 2009-08-29 21:46 1,409 a——- c:\windows\QTFont.for 2009-08-29 16:13 –d—– c:\windows\Google Earth Pro 4.2 2009-08-29 16:05 889,809 a——- c:\windows\system32\xa.tmp 2009-08-29 13:08 –d—– c:\program files\AskBarDis 2009-08-28 16:50 –d—– c:\program files\NVIDIA Corporation 2009-08-28 16:49 151,552 a——- c:\windows\system32\nvRegDev.dll 2009-08-28 13:13 –d—– c:\program files\Steam 2009-08-27 14:47 –d—– c:\program files\common files\Macrovision Shared 2009-08-26 22:07 –d—– c:\program files\Winflip 2009-08-26 12:06 –d-h— C:\$AVG8.VAULT$ 2009-08-25 18:30 –d—– c:\documents and settings\family\Library 2009-08-25 18:30 –d—– c:\docume~1\family\applic~1\com.adobe.ExMan 2009-08-25 17:09 3,840 a——- c:\windows\system32\drivers\BANTExt.sys 2009-08-25 17:09 –d—– c:\program files\Belarc 2009-08-21 16:02 –d—– c:\program files\TmNationsForever 2009-08-21 15:40 676 a——- c:\windows\ChaseHQ2EvoConfig.ini 2009-08-21 14:24 4,548 a——- c:\windows\system32\PerfStringBackup.TMP 2009-08-21 14:23 0 a—h— c:\windows\system32\drivers\Msft_User_PCCSWpdDriver_01_07_00.Wdf 2009-08-21 14:23 0 a—h— c:\windows\system32\drivers\MsftWdf_user_01_07_00.Wdf 2009-08-20 14:41 –d—– c:\docume~1\family\applic~1\MegaplexMadnessSummerBlockbuster 2009-08-19 22:20 151,552 a——- c:\windows\system32\MSOSS.DLL 2009-08-19 22:20 –d—– c:\program files\Codemasters 2009-08-19 22:18 –d—– C:\Colin Mcrae Rally 2009-08-19 14:36 –d—– c:\program files\common files\EasyInfo 2009-08-18 21:36 0 a—h— c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01007.Wdf 2009-08-18 21:36 0 a—h— c:\windows\system32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf 2009-08-18 21:36 14,640 ——– c:\windows\system32\spmsgXP_2k3.dll 2009-08-18 21:35 –dsh— c:\documents and settings\family\Phone Browser 2009-08-18 21:34 –d—– c:\program files\common files\PCSuite 2009-08-18 21:34 –d—– c:\program files\common files\Nokia 2009-08-18 21:34 18,816 a——- c:\windows\system32\drivers\pccsmcfd.sys 2009-08-18 21:34 –d—– c:\program files\PC Connectivity Solution 2009-08-18 21:34 22,016 a——- c:\windows\system32\drivers\ccdcmbo.sys 2009-08-18 21:34 7,808 a——- c:\windows\system32\drivers\usbser_lowerfltj.sys 2009-08-18 21:34 7,808 a——- c:\windows\system32\drivers\usbser_lowerflt.sys 2009-08-18 21:34 1,112,288 a——- c:\windows\system32\wdfcoinstaller01007.dll 2009-08-18 21:34 659,968 a——- c:\windows\system32\nmwcdcocls.dll 2009-08-18 21:34 17,664 a——- c:\windows\system32\drivers\ccdcmb.sys 2009-08-18 21:34 91,136 a——- c:\windows\system32\nmwcdcls.dll 2009-08-18 21:34 –d—– c:\program files\Nokia 2009-08-18 18:30 –d—– c:\docume~1\alluse~1\applic~1\FreshGames 2009-08-18 18:29 –d—– c:\windows\Ranch Rush 2009-08-18 18:29 –d—– c:\program files\Ranch Rush 2009-08-17 21:19 –d—– c:\docume~1\family\applic~1\Peace Craft 2009-08-17 17:32 –d—– c:\program files\Regseeker 2009-08-16 21:33 –d—– c:\program files\VideoLAN 2009-08-13 17:58 1,268,224 a——- c:\windows\d3d10.dll 2009-08-13 13:34 128,512 ——– c:\windows\system32\dllcache\dhtmled.ocx 2009-08-13 13:34 1,315,328 ——– c:\windows\system32\dllcache\msoe.dll 2009-08-11 16:04 –d—– c:\program files\EA GAMES 2009-08-11 13:34 –d—– c:\program files\DAEMON Tools Pro 2009-08-11 13:34 –d—– c:\docume~1\alluse~1\applic~1\DAEMON Tools Pro 2009-08-11 13:18 –d—– c:\docume~1\family\applic~1\DAEMON Tools Pro 2009-08-11 13:08 –d—– c:\program files\Conduit 2009-08-11 13:08 –d—– c:\program files\Alcohol Soft 2009-08-09 20:56 2,560 a——- c:\windows\_MSRSTRT.EXE 2009-08-09 20:45 42,672 ——– c:\windows\system32\wbsys.dll 2009-08-09 20:45 –d—– c:\program files\Stardock 2009-08-09 14:31 –d—– c:\program files\Veetle 2009-08-05 21:25 –d—– c:\docume~1\alluse~1\applic~1\Trymedia 2009-08-05 21:23 –d—– c:\program files\BFG 2009-08-05 20:21 –d—– c:\program files\Anders Kjersem 2009-08-04 21:55 –d—– c:\program files\Burger Shop 2 2009-08-04 01:15 –d—– c:\program files\MSXML 6.0 2009-08-04 01:04 –d—– c:\program files\Aspyr 2009-08-04 00:48 –d—– C:\guitar hero iso 2009-08-03 20:34 –d-h— c:\windows\PIF 2009-08-03 16:45 447,752 a——- c:\windows\system32\vp6vfw.dll ==================== Find3M ==================== 2009-09-01 14:29 189,104 a——- c:\windows\system32\PnkBstrB.exe 2009-09-01 13:54 139,584 a——- c:\windows\system32\drivers\PnkBstrK.sys 2009-08-22 10:00 335,240 a——- c:\windows\system32\drivers\avgldx86.sys 2009-08-22 10:00 11,952 a——- c:\windows\system32\avgrsstx.dll 2009-08-11 13:19 722,416 a——- c:\windows\system32\drivers\sptd.sys 2009-08-05 10:01 204,800 a——- c:\windows\system32\mswebdvd.dll 2009-08-05 10:01 204,800 a——- c:\windows\system32\dllcache\mswebdvd.dll 2009-08-03 13:36 38,160 a——- c:\windows\system32\drivers\mbamswissarmy.sys 2009-08-03 13:36 19,096 a——- c:\windows\system32\drivers\mbam.sys 2009-07-17 20:01 58,880 a——- c:\windows\system32\atl.dll 2009-07-17 20:01 58,880 ——– c:\windows\system32\dllcache\atl.dll 2009-07-16 14:08 510 a——- c:\docume~1\family\applic~1\wklnhst.dat 2009-07-13 23:43 286,208 a——- c:\windows\system32\wmpdxm.dll 2009-07-13 23:43 10,841,088 ——– c:\windows\system32\dllcache\wmp.dll 2009-07-13 23:43 286,208 ——– c:\windows\system32\dllcache\wmpdxm.dll 2009-06-26 12:12 107,888 a——- c:\windows\system32\CmdLineExt.dll 2009-06-26 12:10 22,328 a——- c:\docume~1\family\applic~1\PnkBstrK.sys 2009-06-26 12:10 2,250,024 a——- c:\windows\system32\pbsvc.exe 2009-06-25 09:25 730,112 a——- c:\windows\system32\lsasrv.dll 2009-06-25 09:25 730,112 a——- c:\windows\system32\dllcache\lsasrv.dll 2009-06-25 09:25 301,568 a——- c:\windows\system32\kerberos.dll 2009-06-25 09:25 147,456 a——- c:\windows\system32\schannel.dll 2009-06-25 09:25 147,456 a——- c:\windows\system32\dllcache\schannel.dll 2009-06-25 09:25 136,192 a——- c:\windows\system32\msv1_0.dll 2009-06-25 09:25 56,832 a——- c:\windows\system32\secur32.dll 2009-06-25 09:25 54,272 a——- c:\windows\system32\wdigest.dll 2009-06-25 09:25 301,568 ——– c:\windows\system32\dllcache\kerberos.dll 2009-06-25 09:25 136,192 ——– c:\windows\system32\dllcache\msv1_0.dll 2009-06-25 09:25 56,832 ——– c:\windows\system32\dllcache\secur32.dll 2009-06-25 09:25 54,272 ——– c:\windows\system32\dllcache\wdigest.dll 2009-06-24 12:18 92,928 ——– c:\windows\system32\dllcache\ksecdd.sys 2009-06-16 15:36 119,808 a——- c:\windows\system32\t2embed.dll 2009-06-16 15:36 81,920 a——- c:\windows\system32\fontsub.dll 2009-06-16 15:36 119,808 ——– c:\windows\system32\dllcache\t2embed.dll 2009-06-16 15:36 81,920 ——– c:\windows\system32\dllcache\fontsub.dll 2009-06-12 16:35 24,192 a——- c:\documents and settings\family\usbsermptxp.sys 2009-06-12 16:35 22,768 a——- c:\documents and settings\family\usbsermpt.sys 2009-06-12 13:31 80,896 a——- c:\windows\system32\tlntsess.exe 2009-06-12 13:31 80,896 ——– c:\windows\system32\dllcache\tlntsess.exe 2009-06-12 13:31 76,288 a——- c:\windows\system32\telnet.exe 2009-06-12 13:31 76,288 ——– c:\windows\system32\dllcache\telnet.exe 2009-06-10 15:13 84,992 a——- c:\windows\system32\avifil32.dll 2009-06-10 15:13 84,992 ——– c:\windows\system32\dllcache\avifil32.dll 2009-06-10 09:19 2,066,432 a——- c:\windows\system32\mstscax.dll 2009-06-10 09:19 2,066,432 ——– c:\windows\system32\dllcache\mstscax.dll 2009-06-10 07:14 132,096 a——- c:\windows\system32\wkssvc.dll 2009-06-10 07:14 132,096 ——– c:\windows\system32\dllcache\wkssvc.dll 2009-06-03 20:09 1,291,264 a——- c:\windows\system32\quartz.dll 2009-06-03 20:09 1,291,264 ——– c:\windows\system32\dllcache\quartz.dll 2009-05-21 18:08 87,608 a——- c:\docume~1\family\applic~1\inst.exe 2009-05-21 18:08 47,360 a——- c:\docume~1\family\applic~1\pcouffin.sys ============= FINISH: 15:41:55.46 =============== I hope ive done this right and put it in the right place all my thanks Lisa

Attachments:

📎Attached.txt

Raktor

Post #4September 1, 2009, 3:58 PM UTC

Please don't run anymore fixes without direction (Spybot S&D, etc.), as they might clash with others.

Please read through the instructions to familiarize yourself with what to expect when the tool runs.

Please download Combofix from either of the links below, and save it to your desktop.
You must rename it before saving it. Save it as Combo-Fix.exe.

[external image: Posted Image]

Link 1
Link 2

**Note: It is important that it is saved directly to your desktop**

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link:How to Disable your Security Programs
Double click on Combo-Fix.exe & follow the prompts. Close all browsers/windows first.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

lisa597

Post #5September 1, 2009, 5:51 PM UTC last edited September 1, 2009, 6:57 PM UTC

Think i might have double posted if im have my apoligies

lisa597

Post #6September 1, 2009, 5:52 PM UTC

Hi there, just to point out that that before the log was created it said (the system cannot find the file temp04) this may or may not mean anything but thought i would let you know. Also it told me to write this down ( c:\windows\system32\drivers\kbiwkmmqlhxlxu.sys) also this may not mean anything but thought i would include it.

This is the combifix file,,,

ComboFix 09-08-31.04 - Family 01/09/2009 18:31.1.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.44.1033.18.2046.1526 [GMT 1:00]
Running from: c:\documents and settings\[removed]\Desktop\Combo-Fix.exe.exe
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Start Menu\Programs\Startup\802.11g USB Wireless Network Utility .lnk
c:\documents and settings\Family\Application Data\inst.exe
c:\recycler\S-1-5-21-1644407709-2911996522-2064524667-500
c:\windows\Installer\2484a0.msp
c:\windows\Installer\2484ab.msp
c:\windows\Installer\2484b7.msp
c:\windows\Installer\WMEncoder.msi
c:\windows\kb913800.exe
c:\windows\run.log
c:\windows\system32\drivers\kbiwkmmqlhxlxu.sys
c:\windows\system32\kbiwkmbmqegvpx.dat
c:\windows\system32\kbiwkmhnunupkc.dat
c:\windows\system32\kbiwkmmvvmlkte.dll
c:\windows\system32\kbiwkmxeyrxvxu.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Service_kbiwkmparmyyxr

((((((((((((((((((((((((( Files Created from 2009-08-01 to 2009-09-01 )))))))))))))))))))))))))))))))
.

2009-09-01 17:19 . 2009-09-01 17:24 ——– d-s—w- C:\ComboFix
2009-09-01 14:43 . 2009-09-01 14:43 0 —-a-w- c:\documents and settings\Family\settings.dat
2009-09-01 14:27 . 2009-09-01 14:29 ——– d—–w- c:\program files\Common Files\ParetoLogic
2009-09-01 12:51 . 2009-09-01 12:51 ——– d—–w- c:\program files\GameTracker
2009-09-01 12:51 . 2009-09-01 13:30 ——– d—–w- c:\documents and settings\Family\Application Data\GameTracker
2009-09-01 12:36 . 2009-09-01 12:36 ——– d—–w- c:\program files\ERUNT
2009-08-31 21:22 . 2009-08-31 21:22 ——– d—–w- c:\program files\Trend Micro
2009-08-31 11:14 . 2009-08-31 11:14 ——– d—–w- c:\documents and settings\All Users\Application Data\F-Secure
2009-08-31 10:42 . 2009-08-31 10:42 3942047 —-a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2009-08-30 11:22 . 2001-05-16 16:54 309616 —-a-w- c:\windows\system32\wmv8dmod.dll
2009-08-30 11:22 . 2001-05-11 12:18 420240 —-a-w- c:\windows\system32\mpg4c32.dll
2009-08-29 15:13 . 2009-08-29 15:13 ——– d—–w- c:\windows\Google Earth Pro 4.2
2009-08-29 12:08 . 2009-08-29 12:08 ——– d—–w- c:\program files\AskBarDis
2009-08-28 15:50 . 2009-08-28 15:50 ——– d—–w- c:\program files\NVIDIA Corporation
2009-08-28 15:49 . 2009-08-28 15:49 151552 —-a-w- c:\windows\system32\nvRegDev.dll
2009-08-28 12:13 . 2009-08-28 12:13 15872 —-a-r- c:\documents and settings\Family\Application Data\Microsoft\Installer\{048298C9-A4D3-490B-9FF9-AB023A9238F3}\Icon048298C9.exe
2009-08-28 12:13 . 2009-09-01 17:15 ——– d—–w- c:\program files\Steam
2009-08-27 13:47 . 2009-08-27 13:47 ——– d—–w- c:\program files\Common Files\Macrovision Shared
2009-08-26 21:07 . 2009-09-01 17:15 ——– d—–w- c:\program files\Winflip
2009-08-26 15:01 . 2009-08-26 15:01 ——– d—–w- c:\program files\Adobe Media Player
2009-08-26 11:06 . 2009-08-30 11:29 ——– d–h–w- C:\$AVG8.VAULT$
2009-08-25 17:30 . 2009-08-25 17:30 ——– d—–w- c:\documents and settings\Family\Library
2009-08-25 17:30 . 2009-08-25 17:30 ——– d—–w- c:\documents and settings\Family\Application Data\com.adobe.ExMan
2009-08-25 17:09 . 2009-08-25 17:09 ——– d—–w- c:\program files\Common Files\Adobe AIR
2009-08-25 16:09 . 2009-08-25 16:09 ——– d—–w- c:\program files\Belarc
2009-08-25 16:09 . 2008-03-06 10:51 3840 —-a-w- c:\windows\system32\drivers\BANTExt.sys
2009-08-21 15:05 . 2009-08-25 21:19 ——– d—–w- c:\documents and settings\All Users\Application Data\TrackMania
2009-08-21 15:02 . 2009-08-21 15:03 ——– d—–w- c:\program files\TmNationsForever
2009-08-20 13:41 . 2009-08-20 15:37 ——– d—–w- c:\documents and settings\Family\Application Data\MegaplexMadnessSummerBlockbuster
2009-08-19 21:20 . 2009-08-30 11:14 ——– d—–w- c:\program files\Codemasters
2009-08-19 21:20 . 1999-04-23 21:22 151552 —-a-w- c:\windows\system32\MSOSS.DLL
2009-08-19 21:18 . 2009-08-19 21:18 ——– d—–w- C:\Colin Mcrae Rally
2009-08-19 13:36 . 2009-08-19 13:36 ——– d—–w- c:\program files\Common Files\EasyInfo
2009-08-18 20:36 . 2008-03-21 12:57 14640 ——w- c:\windows\system32\spmsgXP_2k3.dll
2009-08-18 20:35 . 2009-08-21 13:22 ——– d-sh–w- c:\documents and settings\Family\Phone Browser
2009-08-18 20:33 . 2009-08-18 20:05 33773208 —-a-w- c:\documents and settings\All Users\Application Data\Installations\{3D39E775-DDDA-4327-B747-0BDC5F191331}\Nokia_PC_Suite_7_1_30_9_eng_web.exe
2009-08-18 20:33 . 2009-08-18 20:33 95232 —-a-w- c:\documents and settings\All Users\Application Data\Installations\{3D39E775-DDDA-4327-B747-0BDC5F191331}\Installer\CommonCustomActions\pcswpcsi.exe
2009-08-18 20:33 . 2009-08-18 20:33 8192 —-a-w- c:\documents and settings\All Users\Application Data\Installations\{3D39E775-DDDA-4327-B747-0BDC5F191331}\Installer\CommonCustomActions\UninstCCD.exe
2009-08-18 20:33 . 2009-08-18 20:33 61440 —-a-w- c:\documents and settings\All Users\Application Data\Installations\{3D39E775-DDDA-4327-B747-0BDC5F191331}\Installer\CommonCustomActions\UninstPCSFEMsi.exe
2009-08-18 20:33 . 2009-08-18 20:33 10240 —-a-w- c:\documents and settings\All Users\Application Data\Installations\{3D39E775-DDDA-4327-B747-0BDC5F191331}\Installer\CommonCustomActions\UninstPCS.exe
2009-08-18 20:33 . 2009-08-18 20:33 ——– d—–w- c:\documents and settings\All Users\Application Data\Installations
2009-08-18 17:30 . 2009-08-18 17:30 ——– d—–w- c:\documents and settings\All Users\Application Data\FreshGames
2009-08-18 17:29 . 2009-08-18 17:29 ——– d—–w- c:\program files\Ranch Rush
2009-08-18 17:29 . 2009-08-18 17:29 ——– d—–w- c:\windows\Ranch Rush
2009-08-17 20:19 . 2009-08-17 20:25 ——– d—–w- c:\documents and settings\Family\Application Data\Peace Craft
2009-08-17 16:32 . 2009-08-17 16:32 ——– d—–w- c:\program files\Regseeker
2009-08-16 20:36 . 2009-08-28 11:59 ——– d—–w- c:\documents and settings\Family\Application Data\vlc
2009-08-16 20:33 . 2009-08-16 20:33 ——– d—–w- c:\program files\VideoLAN
2009-08-13 16:58 . 2006-11-02 11:16 1268224 —-a-w- c:\windows\d3d10.dll
2009-08-13 12:34 . 2009-07-10 13:27 1315328 ——w- c:\windows\system32\dllcache\msoe.dll
2009-08-11 15:04 . 2009-08-11 15:04 ——– d—–w- c:\program files\EA GAMES
2009-08-11 12:34 . 2009-08-11 12:37 ——– d—–w- c:\program files\DAEMON Tools Pro
2009-08-11 12:34 . 2009-08-11 12:34 ——– d—–w- c:\documents and settings\All Users\Application Data\DAEMON Tools Pro
2009-08-11 12:18 . 2009-08-11 12:18 ——– d—–w- c:\documents and settings\Family\Application Data\DAEMON Tools Pro
2009-08-11 12:08 . 2009-08-11 12:08 ——– d—–w- c:\program files\Conduit
2009-08-11 12:08 . 2009-08-11 12:08 ——– d—–w- c:\documents and settings\Family\Local Settings\Application Data\free-downloads.net
2009-08-11 12:08 . 2009-08-11 12:08 ——– d—–w- c:\documents and settings\Family\Local Settings\Application Data\Conduit
2009-08-11 12:08 . 2009-08-11 12:08 ——– d—–w- c:\program files\Alcohol Soft
2009-08-09 19:56 . 2009-08-09 19:56 2560 —-a-w- c:\windows\_MSRSTRT.EXE
2009-08-09 19:45 . 2007-07-11 13:06 42672 ——w- c:\windows\system32\wbsys.dll
2009-08-09 19:45 . 2009-08-09 19:45 ——– d—–w- c:\program files\Stardock
2009-08-09 13:31 . 2009-08-09 13:31 ——– d—–w- c:\program files\Veetle
2009-08-05 20:25 . 2009-08-05 20:25 ——– d—–w- c:\documents and settings\All Users\Application Data\Trymedia
2009-08-05 20:23 . 2009-08-05 20:23 ——– d—–w- c:\program files\BFG
2009-08-05 19:21 . 2009-08-05 19:21 ——– d—–w- c:\program files\Anders Kjersem
2009-08-04 20:55 . 2009-08-04 20:55 ——– d—–w- c:\program files\Burger Shop 2
2009-08-04 00:19 . 2009-08-04 00:19 ——– d—–w- c:\documents and settings\Family\Local Settings\Application Data\Aspyr
2009-08-04 00:15 . 2009-08-04 00:15 ——– d—–w- c:\program files\MSXML 6.0
2009-08-04 00:04 . 2009-08-04 00:04 ——– d—–w- c:\program files\Aspyr
2009-08-03 23:48 . 2009-08-03 23:49 ——– d—–w- C:\guitar hero iso
2009-08-03 19:34 . 2009-08-03 19:34 ——– d–h–w- c:\windows\PIF
2009-08-03 15:45 . 2008-09-04 20:17 447752 —-a-w- c:\windows\system32\vp6vfw.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-01 17:38 . 2009-06-04 20:41 ——– d—–w- c:\documents and settings\LocalService\Application Data\GameTracker
2009-09-01 13:29 . 2009-05-07 17:31 189104 —-a-w- c:\windows\system32\PnkBstrB.exe
2009-09-01 12:54 . 2009-05-07 17:32 139584 —-a-w- c:\windows\system32\drivers\PnkBstrK.sys
2009-09-01 12:15 . 2009-05-15 18:52 1324 —-a-w- c:\windows\system32\d3d9caps.dat
2009-08-31 10:43 . 2009-05-29 16:42 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2009-08-30 18:07 . 2009-05-26 15:52 ——– d—–w- c:\program files\Spybot - Search & Destroy
2009-08-30 17:55 . 2009-05-08 17:41 ——– d—–w- c:\documents and settings\Family\Application Data\Azureus
2009-08-30 14:56 . 2009-05-26 15:52 ——– d—–w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-08-30 11:14 . 2009-06-12 15:35 ——– d–h–w- c:\program files\InstallShield Installation Information
2009-08-29 15:05 . 2009-08-29 15:05 889809 —-a-w- c:\windows\system32\xa.tmp
2009-08-29 12:08 . 2009-05-08 17:40 ——– d—–w- c:\program files\Vuze
2009-08-28 19:12 . 2009-05-09 13:18 ——– d—–w- c:\documents and settings\Family\Application Data\Vso
2009-08-27 23:16 . 2009-07-25 19:42 ——– d—–w- c:\program files\PKR
2009-08-27 14:03 . 2009-05-06 22:19 74120 —-a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-27 13:56 . 2009-05-06 22:33 ——– d—–w- c:\program files\Common Files\Adobe
2009-08-22 09:00 . 2009-05-07 16:10 11952 —-a-w- c:\windows\system32\avgrsstx.dll
2009-08-22 09:00 . 2009-05-07 16:10 335240 —-a-w- c:\windows\system32\drivers\avgldx86.sys
2009-08-22 09:00 . 2009-05-07 16:10 27784 —-a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-08-21 15:00 . 2009-06-11 17:42 ——– d—–w- c:\program files\Games
2009-08-21 13:24 . 2009-08-21 13:24 4548 —-a-w- c:\windows\system32\PerfStringBackup.TMP
2009-08-21 13:23 . 2009-08-21 13:23 0 —ha-w- c:\windows\system32\drivers\Msft_User_PCCSWpdDriver_01_07_00.Wdf
2009-08-21 13:23 . 2009-08-21 13:23 0 —ha-w- c:\windows\system32\drivers\MsftWdf_user_01_07_00.Wdf
2009-08-21 13:23 . 2009-08-18 20:34 ——– d—–w- c:\documents and settings\Family\Application Data\PC Suite
2009-08-21 13:22 . 2009-08-18 20:34 ——– d—–w- c:\documents and settings\Family\Application Data\Nokia
2009-08-21 13:22 . 2009-08-18 20:34 ——– d—–w- c:\documents and settings\All Users\Application Data\PC Suite
2009-08-20 15:40 . 2009-05-19 15:28 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-08-20 12:40 . 2009-05-19 15:12 ——– d—–w- c:\documents and settings\All Users\Application Data\BigFishGamesCache
2009-08-20 10:36 . 2009-05-19 17:01 ——– d—–w- c:\program files\Nanny Mania 2 - Goes to Hollywood
2009-08-19 16:21 . 2009-06-12 15:35 ——– d—–w- c:\documents and settings\All Users\Application Data\BVRP Software
2009-08-18 20:36 . 2009-08-18 20:36 0 —ha-w- c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01007.Wdf
2009-08-18 20:36 . 2009-08-18 20:36 0 —ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf
2009-08-18 20:34 . 2009-08-18 20:34 ——– d—–w- c:\program files\DIFX
2009-08-18 20:34 . 2009-08-18 20:34 ——– d—–w- c:\program files\Common Files\PCSuite
2009-08-18 20:34 . 2009-08-18 20:34 ——– d—–w- c:\program files\Common Files\Nokia
2009-08-18 20:34 . 2009-08-18 20:34 ——– d—–w- c:\program files\Nokia
2009-08-18 20:34 . 2009-08-18 20:34 ——– d—–w- c:\program files\PC Connectivity Solution
2009-08-11 12:19 . 2009-05-23 15:10 722416 —-a-w- c:\windows\system32\drivers\sptd.sys
2009-08-09 19:35 . 2009-05-13 18:09 ——– d—–w- c:\program files\PeerGuardian2
2009-08-08 19:30 . 2009-05-07 17:21 ——– d—–w- c:\program files\Activision
2009-08-08 19:10 . 2009-07-18 15:28 ——– d—–w- c:\program files\Microsoft Games for Windows - LIVE
2009-08-05 09:01 . 2004-09-10 13:57 204800 —-a-w- c:\windows\system32\mswebdvd.dll
2009-08-03 12:36 . 2009-05-29 16:42 38160 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-03 12:36 . 2009-05-29 16:42 19096 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-08-01 19:43 . 2009-08-01 19:42 ——– d—–w- c:\program files\Farmer Jane
2009-08-01 09:37 . 2009-08-01 09:37 ——– d—–w- c:\program files\My Kingdom for the Princess
2009-08-01 09:10 . 2009-07-28 18:57 ——– d—–w- c:\documents and settings\Family\Application Data\IDM
2009-07-31 19:10 . 2009-07-31 19:10 ——– d—–w- c:\program files\Rockstar Games
2009-07-31 17:07 . 2009-07-31 17:07 ——– d—–w- c:\documents and settings\All Users\Application Data\GoBit Games
2009-07-31 16:51 . 2009-07-28 18:57 ——– d—–w- c:\documents and settings\Family\Application Data\DMCache
2009-07-31 11:16 . 2009-07-10 16:55 ——– d—–w- c:\documents and settings\All Users\Application Data\Electronic Arts
2009-07-28 16:21 . 2009-07-28 16:21 ——– d—–w- c:\program files\CCleaner
2009-07-28 15:54 . 2009-06-11 17:45 ——– d—–w- c:\documents and settings\Family\Application Data\PlayFirst
2009-07-28 15:54 . 2009-06-11 17:45 ——– d—–w- c:\documents and settings\All Users\Application Data\PlayFirst
2009-07-28 15:00 . 2009-07-28 14:59 ——– d—–w- c:\program files\DinerTown Tycoon
2009-07-26 22:48 . 2009-07-26 22:48 ——– d—–w- c:\documents and settings\All Users\Application Data\Sandlot Games
2009-07-26 22:47 . 2009-07-26 22:47 ——– d—–w- c:\documents and settings\Family\Application Data\Sandlot Games
2009-07-26 21:46 . 2009-07-26 21:46 ——– d—–w- c:\documents and settings\Family\Application Data\EleFun Games
2009-07-26 16:08 . 2009-07-26 16:08 ——– d—–w- c:\documents and settings\All Users\Application Data\Fugazo
2009-07-26 16:07 . 2009-07-26 14:44 ——– d—–w- c:\program files\Cooking Academy 2 - World Cuisine
2009-07-26 13:36 . 2009-07-26 13:36 ——– d—–w- c:\documents and settings\Family\Application Data\CupcakeCafe
2009-07-26 13:07 . 2009-05-19 15:13 ——– d—–w- c:\program files\bfgclient
2009-07-24 20:45 . 2009-07-24 20:45 ——– d—–w- c:\documents and settings\All Users\Application Data\FLEXnet
2009-07-24 12:48 . 2009-07-24 12:48 ——– d—–w- c:\program files\SEGA
2009-07-23 15:33 . 2009-07-23 15:33 ——– d—–w- c:\program files\GFI
2009-07-19 11:38 . 2009-07-19 11:38 ——– d—–w- c:\documents and settings\All Users\Application Data\Activision
2009-07-18 00:42 . 2009-05-07 16:07 ——– d—–w- c:\program files\PartyGaming
2009-07-17 19:01 . 2004-09-10 13:56 58880 —-a-w- c:\windows\system32\atl.dll
2009-07-16 13:08 . 2009-05-22 12:46 510 —-a-w- c:\documents and settings\Family\Application Data\wklnhst.dat
2009-07-13 22:43 . 2004-09-10 13:58 286208 —-a-w- c:\windows\system32\wmpdxm.dll
2009-07-10 16:29 . 2009-07-10 16:29 ——– d—–w- c:\program files\AGEIA Technologies
2009-07-10 16:29 . 2009-05-22 11:41 ——– d—–w- c:\program files\Common Files\Wise Installation Wizard
2009-07-05 11:23 . 2009-07-05 11:23 ——– d—–w- c:\program files\THQ
2009-06-26 11:12 . 2009-06-26 11:12 107888 —-a-w- c:\windows\system32\CmdLineExt.dll
2009-06-26 11:10 . 2009-05-07 17:32 22328 —-a-w- c:\documents and settings\Family\Application Data\PnkBstrK.sys
2009-06-26 11:10 . 2009-05-07 17:32 22328 —-a-w- c:\documents and settings\Family\Application Data\PnkBstrK.sys
2009-06-26 11:10 . 2009-06-26 11:10 2250024 —-a-w- c:\windows\system32\pbsvc.exe
2009-06-25 08:25 . 2004-09-10 13:57 54272 —-a-w- c:\windows\system32\wdigest.dll
2009-06-25 08:25 . 2004-09-10 13:57 56832 —-a-w- c:\windows\system32\secur32.dll
2009-06-25 08:25 . 2004-09-10 13:57 147456 —-a-w- c:\windows\system32\schannel.dll
2009-06-25 08:25 . 2004-09-10 13:57 136192 —-a-w- c:\windows\system32\msv1_0.dll
2009-06-25 08:25 . 2004-09-10 13:57 730112 —-a-w- c:\windows\system32\lsasrv.dll
2009-06-25 08:25 . 2004-09-10 13:57 301568 —-a-w- c:\windows\system32\kerberos.dll
2009-06-24 11:18 . 2004-09-10 13:57 92928 —-a-w- c:\windows\system32\drivers\ksecdd.sys
2009-06-16 14:36 . 2004-09-10 13:57 119808 —-a-w- c:\windows\system32\t2embed.dll
2009-06-16 14:36 . 2004-09-10 13:57 81920 —-a-w- c:\windows\system32\fontsub.dll
2009-06-12 15:35 . 2009-06-12 15:35 24192 —-a-w- c:\documents and settings\Family\usbsermptxp.sys
2009-06-12 15:35 . 2009-06-12 15:35 22768 —-a-w- c:\documents and settings\Family\usbsermpt.sys
2009-06-12 12:31 . 2004-09-10 13:57 80896 —-a-w- c:\windows\system32\tlntsess.exe
2009-06-12 12:31 . 2004-09-10 13:57 76288 —-a-w- c:\windows\system32\telnet.exe
2009-06-10 14:13 . 2004-09-10 13:56 84992 —-a-w- c:\windows\system32\avifil32.dll
2009-06-10 08:19 . 2004-09-10 14:30 2066432 —-a-w- c:\windows\system32\mstscax.dll
2009-06-10 06:14 . 2004-09-10 13:57 132096 —-a-w- c:\windows\system32\wkssvc.dll
2009-06-03 19:09 . 2004-09-10 13:57 1291264 —-a-w- c:\windows\system32\quartz.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
2009-04-02 11:47 333192 —-a-w- c:\program files\AskBarDis\bar\bin\askBar.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{74322BF9-DF26-493f-B0DA-6D2FC5E6429E}]
2009-05-04 10:56 398776 —-a-w- c:\program files\BearShare Applications\BearShare\BearShareIEHelper.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2009-04-02 333192]

[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RocketDock"="c:\windows\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe" [2007-03-18 630784]
"Anders Kjersem: TransBar"="c:\program files\Anders Kjersem\TransBar\TransBar.exe" [2002-05-18 29696]
"Steam"="c:\program files\steam\steam.exe" [2009-08-28 1217784]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-10 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-10 455168]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-09-29 67584]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-08-22 2007832]
"LXCECATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\LXCEtime.dll" [2005-07-20 73728]
"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\Family\Start Menu\Programs\Startup\
RocketDock.lnk - c:\windows\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe [2007-3-18 630784]
WinFlip.lnk - c:\program files\Winflip\WinFlip.exe [2009-8-26 483328]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-08-22 09:00 11952 —-a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\startupfolder\C:^Documents and Settings^Family^Start Menu^Programs^Startup^TransBar.lnk]

[HKLM\~\startupfolder\C:^Documents and Settings^Family^Start Menu^Programs^Startup^UberIcon.lnk]

[HKLM\~\startupfolder\C:^Documents and Settings^Family^Start Menu^Programs^Startup^WinFlip.lnk]

[HKLM\~\startupfolder\C:^Documents and Settings^Family^Start Menu^Programs^Startup^Y'z Shadow.lnk]
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Advanced SystemCare 3
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATICCC
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IDMan
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"UleadBurningHelper"=2 (0x2)
"gupdate1c9d3c98a12cbc"=2 (0x2)
"AOL ACS"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Vuze\\Azureus.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\AOL 9.0\\aol.exe"=
"c:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"c:\\WINDOWS\\system32\\ftp.exe"=
"c:\\Program Files\\BearShare Applications\\BearShare\\BearShare.exe"=
"c:\\Program Files\\TmNationsForever\\TmForever.exe"=
"c:\\Program Files\\Steam\\SteamApps\\destroyer59771\\half-life 2 deathmatch\\hl2.exe"=
"c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"15739:TCP"= 15739:TCP:azureus
"15739:UDP"= 15739:UDP:azureus
"5353:TCP"= 5353:TCP:*:Disabled:Adobe CSI CS4

R0 xfilt;VIA SATA IDE Hot-plug Driver;c:\windows\system32\drivers\xfilt.sys [26/05/2009 21:30 21144]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [07/05/2009 17:10 335240]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [07/05/2009 17:10 108552]
R2 ASKService;ASKService;c:\program files\AskBarDis\bar\bin\AskService.exe [29/08/2009 13:08 464264]
R2 ASKUpgrade;ASKUpgrade;c:\program files\AskBarDis\bar\bin\ASKUpgrade.exe [29/08/2009 13:08 234888]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [07/05/2009 17:10 908056]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [07/05/2009 17:10 297752]
R2 GS In-Game Service;GS In-Game Service;c:\program files\GameTracker\GSInGameService.exe [01/09/2009 13:51 1612128]
R3 3xHybrid;ASUSTek SAA713x PCI Card;c:\windows\system32\drivers\3xHybrid.sys [06/05/2009 23:15 882688]
R3 RTLWUSB;Realtek RTL8187 Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\drivers\RTL8187.sys [06/05/2009 23:59 332928]
R3 X10Hid;X10 Hid Device;c:\windows\system32\drivers\x10hid.sys [06/05/2009 23:17 7040]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [15/05/2009 19:20 1684736]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service –> c:\windows\system32\GameMon.des -service [?]
S4 gupdate1c9d3c98a12cbc;Google Update Service (gupdate1c9d3c98a12cbc);c:\program files\Google\Update\GoogleUpdate.exe [13/05/2009 13:47 133104]
.
Contents of the 'Scheduled Tasks' folder

2009-09-01 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-05-13 12:47]

2009-09-01 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-05-13 12:47]
.
- - - - ORPHANS REMOVED - - - -

URLSearchHooks-{ecdee021-0d17-467f-a1ff-c7a115230949} - (no file)
BHO-{d56d7a88-9574-4acc-8ac8-dd7d34f4a1c1} - (no file)
BHO-{ecdee021-0d17-467f-a1ff-c7a115230949} - (no file)
Toolbar-{ecdee021-0d17-467f-a1ff-c7a115230949} - (no file)
HKLM-Run-Windows Center - iexplorer.exe
MSConfigStartUp-2 - (no file)

.
——- Supplementary Scan ——-
.
uStart Page = hxxp://search.bearshare.com/
uInternet Connection Wizard,ShellNext = hxxp://www1.partypoker.com/pam_images/installer/omn.htm?pid=Poker&bid;=Party&lid;=en&sid;=1
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
FF - ProfilePath - c:\documents and settings\Family\Application Data\Mozilla\Firefox\Profiles\905ajkym.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie;=UTF-8&oe;=UTF-8&q;=
FF - prefs.js: browser.startup.homepage - hxxp://www.google.co.uk/firefox
FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
FF - plugin: c:\program files\Google\Update\1.2.183.7\npGoogleOneClick8.dll
FF - plugin: c:\program files\Java\jre1.5.0_04\bin\NPJava11.dll
FF - plugin: c:\program files\Java\jre1.5.0_04\bin\NPJava12.dll
FF - plugin: c:\program files\Java\jre1.5.0_04\bin\NPJava13.dll
FF - plugin: c:\program files\Java\jre1.5.0_04\bin\NPJava14.dll
FF - plugin: c:\program files\Java\jre1.5.0_04\bin\NPJava32.dll
FF - plugin: c:\program files\Java\jre1.5.0_04\bin\NPJPI150_04.dll
FF - plugin: c:\program files\Java\jre1.5.0_04\bin\NPOJI610.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npLegitCheckPlugin.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npnul32.dll
FF - plugin: c:\program files\Veetle\Player\npvlc.dll
FF - plugin: c:\program files\Veetle\plugins\npVeetle.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-01 18:39
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
LXCECATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\LXCEtime.dll,_RunDLLEntry@16???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\kbiwkmparmyyxr]
"imagepath"="\systemroot\system32\drivers\kbiwkmmqlhxlxu.sys"
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\.Default\Software\Stardock\WindowBlinds]
@DACL=(02 0000)

[HKEY_USERS\.Default\Software\Stardock\WindowBlinds\WB5.ini\WBLiteFX]
@DACL=(02 0000)

[HKEY_USERS\S-1-5-21-1065087527-3504542235-3153624688-1005\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{42D710F1-6427-E855-8F16-9103CC5EB3BA}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"hanaeoeomgiknhhg"=hex:61,61,00,7c
"janaeoeomgiknhhgippb"=hex:63,61,6f,63,61,69,00,7c
"pafabmhplddiaockilgnldmngioapcai"=hex:64,61,63,64,6d,6f,6f,6a,00,00

[HKEY_USERS\S-1-5-21-1065087527-3504542235-3153624688-1005\Software\Skype\Phone\UI]
@DACL=(02 0000)
@SACL=
"Installed"=dword:00000001

[HKEY_LOCAL_MACHINE\software\America Online\ACS\Clients]
@DACL=(02 0000)
@SACL=
"1"="c:\\Program Files\\AOL 9.0"

[HKEY_LOCAL_MACHINE\software\America Online\ACS\Languages]
@DACL=(02 0000)
@SACL=

[HKEY_LOCAL_MACHINE\software\ATI Technologies Inc.\ATI Drivers]
@DACL=(02 0000)
@SACL=

[HKEY_LOCAL_MACHINE\software\British Telecom Plc\Internet from BT]
@DACL=(02 0000)
@SACL=

[HKEY_LOCAL_MACHINE\software\CyberLink\PowerDVD\6.0]
@DACL=(02 0000)
@SACL=

[HKEY_LOCAL_MACHINE\software\CyberLink\PowerDVD\BuildInfo]
@DACL=(02 0000)
@SACL=
"SR_No"="DVD060502-01"
"Setup"="060407"
"RC"="050802(GM)"
"Help"="050824(GM)"
"Readme"="050630(GM)"
"Skin"="041220"
"OlReg"="050621v2"
"RegRC"="050810v2"
"TrialDialog RC"="050908"
"Ver"="6.00.2003e"
"Utility"="1905"
"UI"="2003e_NP"
"UI98"="2003e_NP"
"DShow"="2003c"
"AVSetting"="3128"
"CPXM"="2207"
"Other"="1328"
"CL264"="-"
"Pou"="1423b"
"TrialDialog"="050906_PowerDVD"

[HKEY_LOCAL_MACHINE\software\CyberLink\PowerDVD\UserReg]
@DACL=(02 0000)
@SACL=
"SR_No"="DVD060502-01"
"Prod_Name"="PowerDVD"
"Prod_Ver"="6.0"
"CustomerNO"="300"
"Hardware"="Desktop PC"
"Channel"="OEM"
"RegVType"="OEM 2CH"

[HKEY_LOCAL_MACHINE\software\Microsoft\Advanced INF Setup\IEHomePageInfo\RegBackup]
@DACL=(02 0000)
@SACL=

[HKEY_LOCAL_MACHINE\software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_IMAGING_USE_ART]
@DACL=(02 0000)
@SACL=
@=""
"waol.exe"=dword:00000001
"cs.exe"=dword:00000001
"wm.exe"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\services]
@DACL=(02 0000)
@SACL=
"NoServices"=dword:00000000

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\ShimInclusionList\firefox.exe]
@DACL=(02 0000)
@SACL=

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\UIPlugins\{875FD3CE-E284-467B-BDF4-00D1007C4F08}]
@DACL=(02 0000)
@SACL=
"FriendlyName"="res://Od2QueueListManager.dll/RT_STRING/#102"
"Description"="res://Od2QueueListManager.dll/RT_STRING/#103"
"Capabilities"=dword:40000001

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows Media Device Manager\KnownDeviceClasses]
@DACL=(02 0000)
@SACL=

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows Media Device Manager\KnownDevices]
@DACL=(02 0000)
@SACL=

[HKEY_LOCAL_MACHINE\software\On Demand Distribution\Music Manager]
@DACL=(02 0000)
@SACL=

[HKEY_LOCAL_MACHINE\software\Realtek Semiconductor Corp.\Realtek High Definition Audio Driver]
@DACL=(02 0000)
@SACL=

[HKEY_LOCAL_MACHINE\software\Symantec\CCPD-LC]
@DACL=(02 0000)
@SACL=

[HKEY_LOCAL_MACHINE\software\Symantec\Shared Technology]
@DACL=(02 0000)
@SACL=

[HKEY_LOCAL_MACHINE\software\Ulead Systems\Ulead VideoStudio SE\9.0\Installer]
@DACL=(02 0000)
@SACL=
"ProductName"="Ulead VideoStudio %s"
"ProgramGroupName"="Ulead VideoStudio 9.0 SE DVD"
"Specially"="SE DVD"
"ProductVersion"="9.00.0100"
"Product Version"="9.00.0100"
"Product Build"="SE DVD"
"snLanguage"="11"
"szLanguage"="English"
"Serial Number"="781A2-89000-99933113"
"Path"="c:\\Program Files\\Ulead Systems\\Ulead VideoStudio 9.0 SE DVD"
"DDR_Path"="c:\\Program Files\\Ulead Systems\\Ulead VideoStudio 9.0 SE DVD\\DDR21"
"ProjectNumber"="130202890.510100000"

[HKEY_LOCAL_MACHINE\software\Ulead Systems\Ulead VideoStudio SE\9.0\Preference]
@DACL=(02 0000)
@SACL=
"TV System"=dword:00000000

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\kbiwkmparmyyxr]
@DACL=(02 0000)
"start"=dword:00000001
"type"=dword:00000001
"group"="file system"
"imagepath"=expand:"\\systemroot\\system32\\drivers\\kbiwkmmqlhxlxu.sys"
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(1000)
c:\windows\system32\Ati2evxx.dll
c:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll

- - - - - - - > 'explorer.exe'(3796)
c:\windows\system32\SHDOCVW.dll
c:\windows\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.dll
c:\program files\Winflip\WFHook.dll
c:\windows\system32\ntshrui.dll
c:\windows\system32\msi.dll
c:\windows\system32\NETSHELL.dll
c:\windows\system32\credui.dll
c:\windows\system32\WPDShServiceObj.dll
c:\program files\Nokia\Nokia PC Suite 7\PhoneBrowser.dll
c:\program files\Nokia\Nokia PC Suite 7\NGSCM.DLL
c:\program files\Nokia\Nokia PC Suite 7\Lang\PhoneBrowser_eng.nlr
c:\program files\Nokia\Nokia PC Suite 7\Resource\PhoneBrowser_Nokia.ngr
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\ati2evxx.exe
c:\windows\ehome\ehrecvr.exe
c:\windows\ehome\ehSched.exe
c:\program files\AVG\AVG8\avgrsx.exe
c:\progra~1\AVG\AVG8\avgnsx.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\PnkBstrB.exe
c:\program files\Sonic\DigitalMedia LE v7\MyDVD LE\USBDeviceService.exe
c:\progra~1\COMMON~1\X10\Common\X10nets.exe
c:\windows\ehome\mcrdsvc.exe
c:\program files\AVG\AVG8\avgcsrvx.exe
c:\windows\system32\dllhost.exe
c:\windows\ehome\ehmsas.exe
.
**************************************************************************
.
Completion time: 2009-09-01 18:44 - machine was rebooted
ComboFix-quarantined-files.txt 2009-09-01 17:44

Pre-Run: 197,779,636,224 bytes free
Post-Run: 197,688,479,744 bytes free

519 — E O F — 2009-08-18 16:55

Raktor

Post #7September 2, 2009, 12:36 AM UTC

Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:
```
RegLockDel::
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\kbiwkmparmyyxr]
```
Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

[external image: Posted Image]
Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
If you need help to disable your protection programs see here.
Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

lisa597

Post #8September 2, 2009, 12:50 PM UTC

Hi there again here is the log you requested,

ComboFix 09-09-01.04 - Family 02/09/2009 13:30.2.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.44.1033.18.2046.1461 [GMT 1:00]
Running from: c:\documents and settings\[removed]\Desktop\Combo-Fix.exe.exe
Command switches used :: c:\documents and settings\Family\Desktop\CFScript.txt
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_kbiwkmparmyyxr
——-\Service_kbiwkmparmyyxr

((((((((((((((((((((((((( Files Created from 2009-08-02 to 2009-09-02 )))))))))))))))))))))))))))))))
.

2009-09-01 17:19 . 2009-09-01 17:24 ——– d-s—w- C:\ComboFix
2009-09-01 14:43 . 2009-09-01 14:43 0 —-a-w- c:\documents and settings\Family\settings.dat
2009-09-01 14:27 . 2009-09-01 14:29 ——– d—–w- c:\program files\Common Files\ParetoLogic
2009-09-01 12:51 . 2009-09-01 12:51 ——– d—–w- c:\program files\GameTracker
2009-09-01 12:51 . 2009-09-01 13:30 ——– d—–w- c:\documents and settings\Family\Application Data\GameTracker
2009-09-01 12:36 . 2009-09-01 12:36 ——– d—–w- c:\program files\ERUNT
2009-08-31 21:22 . 2009-08-31 21:22 ——– d—–w- c:\program files\Trend Micro
2009-08-31 11:14 . 2009-08-31 11:14 ——– d—–w- c:\documents and settings\All Users\Application Data\F-Secure
2009-08-31 10:42 . 2009-08-31 10:42 3942047 —-a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2009-08-30 11:22 . 2001-05-16 16:54 309616 —-a-w- c:\windows\system32\wmv8dmod.dll
2009-08-30 11:22 . 2001-05-11 12:18 420240 —-a-w- c:\windows\system32\mpg4c32.dll
2009-08-29 15:13 . 2009-08-29 15:13 ——– d—–w- c:\windows\Google Earth Pro 4.2
2009-08-29 12:08 . 2009-08-29 12:08 ——– d—–w- c:\program files\AskBarDis
2009-08-28 15:50 . 2009-08-28 15:50 ——– d—–w- c:\program files\NVIDIA Corporation
2009-08-28 15:49 . 2009-08-28 15:49 151552 —-a-w- c:\windows\system32\nvRegDev.dll
2009-08-28 12:13 . 2009-08-28 12:13 15872 —-a-r- c:\documents and settings\Family\Application Data\Microsoft\Installer\{048298C9-A4D3-490B-9FF9-AB023A9238F3}\Icon048298C9.exe
2009-08-28 12:13 . 2009-09-02 12:08 ——– d—–w- c:\program files\Steam
2009-08-27 13:47 . 2009-08-27 13:47 ——– d—–w- c:\program files\Common Files\Macrovision Shared
2009-08-26 21:07 . 2009-09-02 12:07 ——– d—–w- c:\program files\Winflip
2009-08-26 15:01 . 2009-08-26 15:01 ——– d—–w- c:\program files\Adobe Media Player
2009-08-26 11:06 . 2009-08-30 11:29 ——– d–h–w- C:\$AVG8.VAULT$
2009-08-25 17:30 . 2009-08-25 17:30 ——– d—–w- c:\documents and settings\Family\Library
2009-08-25 17:30 . 2009-08-25 17:30 ——– d—–w- c:\documents and settings\Family\Application Data\com.adobe.ExMan
2009-08-25 17:09 . 2009-08-25 17:09 ——– d—–w- c:\program files\Common Files\Adobe AIR
2009-08-25 16:09 . 2009-08-25 16:09 ——– d—–w- c:\program files\Belarc
2009-08-25 16:09 . 2008-03-06 10:51 3840 —-a-w- c:\windows\system32\drivers\BANTExt.sys
2009-08-21 15:05 . 2009-08-25 21:19 ——– d—–w- c:\documents and settings\All Users\Application Data\TrackMania
2009-08-21 15:02 . 2009-08-21 15:03 ——– d—–w- c:\program files\TmNationsForever
2009-08-20 13:41 . 2009-08-20 15:37 ——– d—–w- c:\documents and settings\Family\Application Data\MegaplexMadnessSummerBlockbuster
2009-08-19 21:20 . 2009-08-30 11:14 ——– d—–w- c:\program files\Codemasters
2009-08-19 21:20 . 1999-04-23 21:22 151552 —-a-w- c:\windows\system32\MSOSS.DLL
2009-08-19 21:18 . 2009-08-19 21:18 ——– d—–w- C:\Colin Mcrae Rally
2009-08-19 13:36 . 2009-08-19 13:36 ——– d—–w- c:\program files\Common Files\EasyInfo
2009-08-18 20:36 . 2008-03-21 12:57 14640 ——w- c:\windows\system32\spmsgXP_2k3.dll
2009-08-18 20:35 . 2009-08-21 13:22 ——– d-sh–w- c:\documents and settings\Family\Phone Browser
2009-08-18 20:33 . 2009-08-18 20:05 33773208 —-a-w- c:\documents and settings\All Users\Application Data\Installations\{3D39E775-DDDA-4327-B747-0BDC5F191331}\Nokia_PC_Suite_7_1_30_9_eng_web.exe
2009-08-18 20:33 . 2009-08-18 20:33 95232 —-a-w- c:\documents and settings\All Users\Application Data\Installations\{3D39E775-DDDA-4327-B747-0BDC5F191331}\Installer\CommonCustomActions\pcswpcsi.exe
2009-08-18 20:33 . 2009-08-18 20:33 8192 —-a-w- c:\documents and settings\All Users\Application Data\Installations\{3D39E775-DDDA-4327-B747-0BDC5F191331}\Installer\CommonCustomActions\UninstCCD.exe
2009-08-18 20:33 . 2009-08-18 20:33 61440 —-a-w- c:\documents and settings\All Users\Application Data\Installations\{3D39E775-DDDA-4327-B747-0BDC5F191331}\Installer\CommonCustomActions\UninstPCSFEMsi.exe
2009-08-18 20:33 . 2009-08-18 20:33 10240 —-a-w- c:\documents and settings\All Users\Application Data\Installations\{3D39E775-DDDA-4327-B747-0BDC5F191331}\Installer\CommonCustomActions\UninstPCS.exe
2009-08-18 20:33 . 2009-08-18 20:33 ——– d—–w- c:\documents and settings\All Users\Application Data\Installations
2009-08-18 17:30 . 2009-08-18 17:30 ——– d—–w- c:\documents and settings\All Users\Application Data\FreshGames
2009-08-18 17:29 . 2009-08-18 17:29 ——– d—–w- c:\program files\Ranch Rush
2009-08-18 17:29 . 2009-08-18 17:29 ——– d—–w- c:\windows\Ranch Rush
2009-08-17 20:19 . 2009-08-17 20:25 ——– d—–w- c:\documents and settings\Family\Application Data\Peace Craft
2009-08-17 16:32 . 2009-08-17 16:32 ——– d—–w- c:\program files\Regseeker
2009-08-16 20:36 . 2009-08-28 11:59 ——– d—–w- c:\documents and settings\Family\Application Data\vlc
2009-08-16 20:33 . 2009-08-16 20:33 ——– d—–w- c:\program files\VideoLAN
2009-08-13 16:58 . 2006-11-02 11:16 1268224 —-a-w- c:\windows\d3d10.dll
2009-08-13 12:34 . 2009-07-10 13:27 1315328 ——w- c:\windows\system32\dllcache\msoe.dll
2009-08-11 15:04 . 2009-08-11 15:04 ——– d—–w- c:\program files\EA GAMES
2009-08-11 12:34 . 2009-08-11 12:37 ——– d—–w- c:\program files\DAEMON Tools Pro
2009-08-11 12:34 . 2009-08-11 12:34 ——– d—–w- c:\documents and settings\All Users\Application Data\DAEMON Tools Pro
2009-08-11 12:18 . 2009-08-11 12:18 ——– d—–w- c:\documents and settings\Family\Application Data\DAEMON Tools Pro
2009-08-11 12:08 . 2009-08-11 12:08 ——– d—–w- c:\program files\Conduit
2009-08-11 12:08 . 2009-08-11 12:08 ——– d—–w- c:\documents and settings\Family\Local Settings\Application Data\free-downloads.net
2009-08-11 12:08 . 2009-08-11 12:08 ——– d—–w- c:\documents and settings\Family\Local Settings\Application Data\Conduit
2009-08-11 12:08 . 2009-08-11 12:08 ——– d—–w- c:\program files\Alcohol Soft
2009-08-09 19:56 . 2009-08-09 19:56 2560 —-a-w- c:\windows\_MSRSTRT.EXE
2009-08-09 19:45 . 2007-07-11 13:06 42672 ——w- c:\windows\system32\wbsys.dll
2009-08-09 19:45 . 2009-08-09 19:45 ——– d—–w- c:\program files\Stardock
2009-08-09 13:31 . 2009-08-09 13:31 ——– d—–w- c:\program files\Veetle
2009-08-05 20:25 . 2009-08-05 20:25 ——– d—–w- c:\documents and settings\All Users\Application Data\Trymedia
2009-08-05 20:23 . 2009-08-05 20:23 ——– d—–w- c:\program files\BFG
2009-08-05 19:21 . 2009-08-05 19:21 ——– d—–w- c:\program files\Anders Kjersem
2009-08-04 20:55 . 2009-08-04 20:55 ——– d—–w- c:\program files\Burger Shop 2
2009-08-04 00:19 . 2009-08-04 00:19 ——– d—–w- c:\documents and settings\Family\Local Settings\Application Data\Aspyr
2009-08-04 00:15 . 2009-08-04 00:15 ——– d—–w- c:\program files\MSXML 6.0
2009-08-04 00:04 . 2009-08-04 00:04 ——– d—–w- c:\program files\Aspyr
2009-08-03 23:48 . 2009-08-03 23:49 ——– d—–w- C:\guitar hero iso
2009-08-03 19:34 . 2009-08-03 19:34 ——– d–h–w- c:\windows\PIF
2009-08-03 15:45 . 2008-09-04 20:17 447752 —-a-w- c:\windows\system32\vp6vfw.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-02 12:37 . 2009-06-04 20:41 ——– d—–w- c:\documents and settings\LocalService\Application Data\GameTracker
2009-09-01 21:11 . 2009-05-07 17:31 189104 —-a-w- c:\windows\system32\PnkBstrB.exe
2009-09-01 20:36 . 2009-05-07 17:32 139584 —-a-w- c:\windows\system32\drivers\PnkBstrK.sys
2009-09-01 12:15 . 2009-05-15 18:52 1324 —-a-w- c:\windows\system32\d3d9caps.dat
2009-08-31 10:43 . 2009-05-29 16:42 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2009-08-30 18:07 . 2009-05-26 15:52 ——– d—–w- c:\program files\Spybot - Search & Destroy
2009-08-30 17:55 . 2009-05-08 17:41 ——– d—–w- c:\documents and settings\Family\Application Data\Azureus
2009-08-30 14:56 . 2009-05-26 15:52 ——– d—–w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-08-30 11:14 . 2009-06-12 15:35 ——– d–h–w- c:\program files\InstallShield Installation Information
2009-08-29 15:05 . 2009-08-29 15:05 889809 —-a-w- c:\windows\system32\xa.tmp
2009-08-29 12:08 . 2009-05-08 17:40 ——– d—–w- c:\program files\Vuze
2009-08-28 19:12 . 2009-05-09 13:18 ——– d—–w- c:\documents and settings\Family\Application Data\Vso
2009-08-27 23:16 . 2009-07-25 19:42 ——– d—–w- c:\program files\PKR
2009-08-27 14:03 . 2009-05-06 22:19 74120 —-a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-27 13:56 . 2009-05-06 22:33 ——– d—–w- c:\program files\Common Files\Adobe
2009-08-22 09:00 . 2009-05-07 16:10 11952 —-a-w- c:\windows\system32\avgrsstx.dll
2009-08-22 09:00 . 2009-05-07 16:10 335240 —-a-w- c:\windows\system32\drivers\avgldx86.sys
2009-08-22 09:00 . 2009-05-07 16:10 27784 —-a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-08-21 15:00 . 2009-06-11 17:42 ——– d—–w- c:\program files\Games
2009-08-21 13:24 . 2009-08-21 13:24 4548 —-a-w- c:\windows\system32\PerfStringBackup.TMP
2009-08-21 13:23 . 2009-08-21 13:23 0 —ha-w- c:\windows\system32\drivers\Msft_User_PCCSWpdDriver_01_07_00.Wdf
2009-08-21 13:23 . 2009-08-21 13:23 0 —ha-w- c:\windows\system32\drivers\MsftWdf_user_01_07_00.Wdf
2009-08-21 13:23 . 2009-08-18 20:34 ——– d—–w- c:\documents and settings\Family\Application Data\PC Suite
2009-08-21 13:22 . 2009-08-18 20:34 ——– d—–w- c:\documents and settings\Family\Application Data\Nokia
2009-08-21 13:22 . 2009-08-18 20:34 ——– d—–w- c:\documents and settings\All Users\Application Data\PC Suite
2009-08-20 15:40 . 2009-05-19 15:28 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-08-20 12:40 . 2009-05-19 15:12 ——– d—–w- c:\documents and settings\All Users\Application Data\BigFishGamesCache
2009-08-20 10:36 . 2009-05-19 17:01 ——– d—–w- c:\program files\Nanny Mania 2 - Goes to Hollywood
2009-08-19 16:21 . 2009-06-12 15:35 ——– d—–w- c:\documents and settings\All Users\Application Data\BVRP Software
2009-08-18 20:36 . 2009-08-18 20:36 0 —ha-w- c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01007.Wdf
2009-08-18 20:36 . 2009-08-18 20:36 0 —ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf
2009-08-18 20:34 . 2009-08-18 20:34 ——– d—–w- c:\program files\DIFX
2009-08-18 20:34 . 2009-08-18 20:34 ——– d—–w- c:\program files\Common Files\PCSuite
2009-08-18 20:34 . 2009-08-18 20:34 ——– d—–w- c:\program files\Common Files\Nokia
2009-08-18 20:34 . 2009-08-18 20:34 ——– d—–w- c:\program files\Nokia
2009-08-18 20:34 . 2009-08-18 20:34 ——– d—–w- c:\program files\PC Connectivity Solution
2009-08-11 12:19 . 2009-05-23 15:10 722416 —-a-w- c:\windows\system32\drivers\sptd.sys
2009-08-09 19:35 . 2009-05-13 18:09 ——– d—–w- c:\program files\PeerGuardian2
2009-08-08 19:30 . 2009-05-07 17:21 ——– d—–w- c:\program files\Activision
2009-08-08 19:10 . 2009-07-18 15:28 ——– d—–w- c:\program files\Microsoft Games for Windows - LIVE
2009-08-05 09:01 . 2004-09-10 13:57 204800 —-a-w- c:\windows\system32\mswebdvd.dll
2009-08-03 12:36 . 2009-05-29 16:42 38160 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-03 12:36 . 2009-05-29 16:42 19096 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-08-01 19:43 . 2009-08-01 19:42 ——– d—–w- c:\program files\Farmer Jane
2009-08-01 09:37 . 2009-08-01 09:37 ——– d—–w- c:\program files\My Kingdom for the Princess
2009-08-01 09:10 . 2009-07-28 18:57 ——– d—–w- c:\documents and settings\Family\Application Data\IDM
2009-07-31 19:10 . 2009-07-31 19:10 ——– d—–w- c:\program files\Rockstar Games
2009-07-31 17:07 . 2009-07-31 17:07 ——– d—–w- c:\documents and settings\All Users\Application Data\GoBit Games
2009-07-31 16:51 . 2009-07-28 18:57 ——– d—–w- c:\documents and settings\Family\Application Data\DMCache
2009-07-31 11:16 . 2009-07-10 16:55 ——– d—–w- c:\documents and settings\All Users\Application Data\Electronic Arts
2009-07-28 16:21 . 2009-07-28 16:21 ——– d—–w- c:\program files\CCleaner
2009-07-28 15:54 . 2009-06-11 17:45 ——– d—–w- c:\documents and settings\Family\Application Data\PlayFirst
2009-07-28 15:54 . 2009-06-11 17:45 ——– d—–w- c:\documents and settings\All Users\Application Data\PlayFirst
2009-07-28 15:00 . 2009-07-28 14:59 ——– d—–w- c:\program files\DinerTown Tycoon
2009-07-26 22:48 . 2009-07-26 22:48 ——– d—–w- c:\documents and settings\All Users\Application Data\Sandlot Games
2009-07-26 22:47 . 2009-07-26 22:47 ——– d—–w- c:\documents and settings\Family\Application Data\Sandlot Games
2009-07-26 21:46 . 2009-07-26 21:46 ——– d—–w- c:\documents and settings\Family\Application Data\EleFun Games
2009-07-26 16:08 . 2009-07-26 16:08 ——– d—–w- c:\documents and settings\All Users\Application Data\Fugazo
2009-07-26 16:07 . 2009-07-26 14:44 ——– d—–w- c:\program files\Cooking Academy 2 - World Cuisine
2009-07-26 13:36 . 2009-07-26 13:36 ——– d—–w- c:\documents and settings\Family\Application Data\CupcakeCafe
2009-07-26 13:07 . 2009-05-19 15:13 ——– d—–w- c:\program files\bfgclient
2009-07-24 20:45 . 2009-07-24 20:45 ——– d—–w- c:\documents and settings\All Users\Application Data\FLEXnet
2009-07-24 12:48 . 2009-07-24 12:48 ——– d—–w- c:\program files\SEGA
2009-07-23 15:33 . 2009-07-23 15:33 ——– d—–w- c:\program files\GFI
2009-07-19 11:38 . 2009-07-19 11:38 ——– d—–w- c:\documents and settings\All Users\Application Data\Activision
2009-07-18 00:42 . 2009-05-07 16:07 ——– d—–w- c:\program files\PartyGaming
2009-07-17 19:01 . 2004-09-10 13:56 58880 —-a-w- c:\windows\system32\atl.dll
2009-07-16 13:08 . 2009-05-22 12:46 510 —-a-w- c:\documents and settings\Family\Application Data\wklnhst.dat
2009-07-13 22:43 . 2004-09-10 13:58 286208 —-a-w- c:\windows\system32\wmpdxm.dll
2009-07-10 16:29 . 2009-07-10 16:29 ——– d—–w- c:\program files\AGEIA Technologies
2009-07-10 16:29 . 2009-05-22 11:41 ——– d—–w- c:\program files\Common Files\Wise Installation Wizard
2009-07-05 11:23 . 2009-07-05 11:23 ——– d—–w- c:\program files\THQ
2009-06-26 11:12 . 2009-06-26 11:12 107888 —-a-w- c:\windows\system32\CmdLineExt.dll
2009-06-26 11:10 . 2009-05-07 17:32 22328 —-a-w- c:\documents and settings\Family\Application Data\PnkBstrK.sys
2009-06-26 11:10 . 2009-05-07 17:32 22328 —-a-w- c:\documents and settings\Family\Application Data\PnkBstrK.sys
2009-06-26 11:10 . 2009-06-26 11:10 2250024 —-a-w- c:\windows\system32\pbsvc.exe
2009-06-25 08:25 . 2004-09-10 13:57 54272 —-a-w- c:\windows\system32\wdigest.dll
2009-06-25 08:25 . 2004-09-10 13:57 56832 —-a-w- c:\windows\system32\secur32.dll
2009-06-25 08:25 . 2004-09-10 13:57 147456 —-a-w- c:\windows\system32\schannel.dll
2009-06-25 08:25 . 2004-09-10 13:57 136192 —-a-w- c:\windows\system32\msv1_0.dll
2009-06-25 08:25 . 2004-09-10 13:57 730112 —-a-w- c:\windows\system32\lsasrv.dll
2009-06-25 08:25 . 2004-09-10 13:57 301568 —-a-w- c:\windows\system32\kerberos.dll
2009-06-24 11:18 . 2004-09-10 13:57 92928 —-a-w- c:\windows\system32\drivers\ksecdd.sys
2009-06-16 14:36 . 2004-09-10 13:57 119808 —-a-w- c:\windows\system32\t2embed.dll
2009-06-16 14:36 . 2004-09-10 13:57 81920 —-a-w- c:\windows\system32\fontsub.dll
2009-06-12 15:35 . 2009-06-12 15:35 24192 —-a-w- c:\documents and settings\Family\usbsermptxp.sys
2009-06-12 15:35 . 2009-06-12 15:35 22768 —-a-w- c:\documents and settings\Family\usbsermpt.sys
2009-06-12 12:31 . 2004-09-10 13:57 80896 —-a-w- c:\windows\system32\tlntsess.exe
2009-06-12 12:31 . 2004-09-10 13:57 76288 —-a-w- c:\windows\system32\telnet.exe
2009-06-10 14:13 . 2004-09-10 13:56 84992 —-a-w- c:\windows\system32\avifil32.dll
2009-06-10 08:19 . 2004-09-10 14:30 2066432 —-a-w- c:\windows\system32\mstscax.dll
2009-06-10 06:14 . 2004-09-10 13:57 132096 —-a-w- c:\windows\system32\wkssvc.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-09-01_17.39.10 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-09-02 12:25 . 2009-09-02 12:25 16384 c:\windows\temp\Perflib_Perfdata_c04.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
2009-04-02 11:47 333192 —-a-w- c:\program files\AskBarDis\bar\bin\askBar.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{74322BF9-DF26-493f-B0DA-6D2FC5E6429E}]
2009-05-04 10:56 398776 —-a-w- c:\program files\BearShare Applications\BearShare\BearShareIEHelper.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2009-04-02 333192]

[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RocketDock"="c:\windows\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe" [2007-03-18 630784]
"Anders Kjersem: TransBar"="c:\program files\Anders Kjersem\TransBar\TransBar.exe" [2002-05-18 29696]
"Steam"="c:\program files\steam\steam.exe" [2009-08-28 1217784]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-10 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-10 455168]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-09-29 67584]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-08-22 2007832]
"LXCECATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\LXCEtime.dll" [2005-07-20 73728]
"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\Family\Start Menu\Programs\Startup\
RocketDock.lnk - c:\windows\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe [2007-3-18 630784]
WinFlip.lnk - c:\program files\Winflip\WinFlip.exe [2009-8-26 483328]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-08-22 09:00 11952 —-a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\startupfolder\C:^Documents and Settings^Family^Start Menu^Programs^Startup^TransBar.lnk]

[HKLM\~\startupfolder\C:^Documents and Settings^Family^Start Menu^Programs^Startup^UberIcon.lnk]

[HKLM\~\startupfolder\C:^Documents and Settings^Family^Start Menu^Programs^Startup^WinFlip.lnk]

[HKLM\~\startupfolder\C:^Documents and Settings^Family^Start Menu^Programs^Startup^Y'z Shadow.lnk]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"UleadBurningHelper"=2 (0x2)
"gupdate1c9d3c98a12cbc"=2 (0x2)
"AOL ACS"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Vuze\\Azureus.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\AOL 9.0\\aol.exe"=
"c:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"c:\\WINDOWS\\system32\\ftp.exe"=
"c:\\Program Files\\BearShare Applications\\BearShare\\BearShare.exe"=
"c:\\Program Files\\TmNationsForever\\TmForever.exe"=
"c:\\Program Files\\Steam\\SteamApps\\destroyer59771\\half-life 2 deathmatch\\hl2.exe"=
"c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"15739:TCP"= 15739:TCP:azureus
"15739:UDP"= 15739:UDP:azureus
"5353:TCP"= 5353:TCP:*:Disabled:Adobe CSI CS4

R0 xfilt;VIA SATA IDE Hot-plug Driver;c:\windows\system32\drivers\xfilt.sys [26/05/2009 21:30 21144]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [07/05/2009 17:10 335240]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [07/05/2009 17:10 108552]
R2 ASKService;ASKService;c:\program files\AskBarDis\bar\bin\AskService.exe [29/08/2009 13:08 464264]
R2 ASKUpgrade;ASKUpgrade;c:\program files\AskBarDis\bar\bin\ASKUpgrade.exe [29/08/2009 13:08 234888]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [07/05/2009 17:10 908056]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [07/05/2009 17:10 297752]
R2 GS In-Game Service;GS In-Game Service;c:\program files\GameTracker\GSInGameService.exe [01/09/2009 13:51 1612128]
R3 3xHybrid;ASUSTek SAA713x PCI Card;c:\windows\system32\drivers\3xHybrid.sys [06/05/2009 23:15 882688]
R3 RTLWUSB;Realtek RTL8187 Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\drivers\RTL8187.sys [06/05/2009 23:59 332928]
R3 X10Hid;X10 Hid Device;c:\windows\system32\drivers\x10hid.sys [06/05/2009 23:17 7040]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [15/05/2009 19:20 1684736]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service –> c:\windows\system32\GameMon.des -service [?]
S4 gupdate1c9d3c98a12cbc;Google Update Service (gupdate1c9d3c98a12cbc);c:\program files\Google\Update\GoogleUpdate.exe [13/05/2009 13:47 133104]
.
Contents of the 'Scheduled Tasks' folder

2009-09-02 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-05-13 12:47]

2009-09-02 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-05-13 12:47]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://search.bearshare.com/
uInternet Connection Wizard,ShellNext = hxxp://www1.partypoker.com/pam_images/installer/omn.htm?pid=Poker&bid;=Party&lid;=en&sid;=1
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
FF - ProfilePath - c:\documents and settings\Family\Application Data\Mozilla\Firefox\Profiles\905ajkym.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie;=UTF-8&oe;=UTF-8&q;=
FF - prefs.js: browser.startup.homepage - hxxp://www.google.co.uk/firefox
FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
FF - plugin: c:\program files\Google\Update\1.2.183.7\npGoogleOneClick8.dll
FF - plugin: c:\program files\Java\jre1.5.0_04\bin\NPJava11.dll
FF - plugin: c:\program files\Java\jre1.5.0_04\bin\NPJava12.dll
FF - plugin: c:\program files\Java\jre1.5.0_04\bin\NPJava13.dll
FF - plugin: c:\program files\Java\jre1.5.0_04\bin\NPJava14.dll
FF - plugin: c:\program files\Java\jre1.5.0_04\bin\NPJava32.dll
FF - plugin: c:\program files\Java\jre1.5.0_04\bin\NPJPI150_04.dll
FF - plugin: c:\program files\Java\jre1.5.0_04\bin\NPOJI610.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npLegitCheckPlugin.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npnul32.dll
FF - plugin: c:\program files\Veetle\Player\npvlc.dll
FF - plugin: c:\program files\Veetle\plugins\npVeetle.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-02 13:37
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
LXCECATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\LXCEtime.dll,_RunDLLEntry@16???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\.Default\Software\Stardock\WindowBlinds]
@DACL=(02 0000)

[HKEY_USERS\.Default\Software\Stardock\WindowBlinds\WB5.ini\WBLiteFX]
@DACL=(02 0000)

[HKEY_USERS\S-1-5-21-1065087527-3504542235-3153624688-1005\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{42D710F1-6427-E855-8F16-9103CC5EB3BA}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"hanaeoeomgiknhhg"=hex:61,61,00,7c
"janaeoeomgiknhhgippb"=hex:63,61,6f,63,61,69,00,7c
"pafabmhplddiaockilgnldmngioapcai"=hex:64,61,63,64,6d,6f,6f,6a,00,00

[HKEY_USERS\S-1-5-21-1065087527-3504542235-3153624688-1005\Software\Skype\Phone\UI]
@DACL=(02 0000)
@SACL=
"Installed"=dword:00000001

[HKEY_LOCAL_MACHINE\software\America Online\ACS\Clients]
@DACL=(02 0000)
@SACL=
"1"="c:\\Program Files\\AOL 9.0"

[HKEY_LOCAL_MACHINE\software\America Online\ACS\Languages]
@DACL=(02 0000)
@SACL=

[HKEY_LOCAL_MACHINE\software\ATI Technologies Inc.\ATI Drivers]
@DACL=(02 0000)
@SACL=

[HKEY_LOCAL_MACHINE\software\British Telecom Plc\Internet from BT]
@DACL=(02 0000)
@SACL=

[HKEY_LOCAL_MACHINE\software\CyberLink\PowerDVD\6.0]
@DACL=(02 0000)
@SACL=

[HKEY_LOCAL_MACHINE\software\CyberLink\PowerDVD\BuildInfo]
@DACL=(02 0000)
@SACL=
"SR_No"="DVD060502-01"
"Setup"="060407"
"RC"="050802(GM)"
"Help"="050824(GM)"
"Readme"="050630(GM)"
"Skin"="041220"
"OlReg"="050621v2"
"RegRC"="050810v2"
"TrialDialog RC"="050908"
"Ver"="6.00.2003e"
"Utility"="1905"
"UI"="2003e_NP"
"UI98"="2003e_NP"
"DShow"="2003c"
"AVSetting"="3128"
"CPXM"="2207"
"Other"="1328"
"CL264"="-"
"Pou"="1423b"
"TrialDialog"="050906_PowerDVD"

[HKEY_LOCAL_MACHINE\software\CyberLink\PowerDVD\UserReg]
@DACL=(02 0000)
@SACL=
"SR_No"="DVD060502-01"
"Prod_Name"="PowerDVD"
"Prod_Ver"="6.0"
"CustomerNO"="300"
"Hardware"="Desktop PC"
"Channel"="OEM"
"RegVType"="OEM 2CH"

[HKEY_LOCAL_MACHINE\software\Microsoft\Advanced INF Setup\IEHomePageInfo\RegBackup]
@DACL=(02 0000)
@SACL=

[HKEY_LOCAL_MACHINE\software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_IMAGING_USE_ART]
@DACL=(02 0000)
@SACL=
@=""
"waol.exe"=dword:00000001
"cs.exe"=dword:00000001
"wm.exe"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\services]
@DACL=(02 0000)
@SACL=
"NoServices"=dword:00000000

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\ShimInclusionList\firefox.exe]
@DACL=(02 0000)
@SACL=

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\UIPlugins\{875FD3CE-E284-467B-BDF4-00D1007C4F08}]
@DACL=(02 0000)
@SACL=
"FriendlyName"="res://Od2QueueListManager.dll/RT_STRING/#102"
"Description"="res://Od2QueueListManager.dll/RT_STRING/#103"
"Capabilities"=dword:40000001

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows Media Device Manager\KnownDeviceClasses]
@DACL=(02 0000)
@SACL=

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows Media Device Manager\KnownDevices]
@DACL=(02 0000)
@SACL=

[HKEY_LOCAL_MACHINE\software\On Demand Distribution\Music Manager]
@DACL=(02 0000)
@SACL=

[HKEY_LOCAL_MACHINE\software\Realtek Semiconductor Corp.\Realtek High Definition Audio Driver]
@DACL=(02 0000)
@SACL=

[HKEY_LOCAL_MACHINE\software\Symantec\CCPD-LC]
@DACL=(02 0000)
@SACL=

[HKEY_LOCAL_MACHINE\software\Symantec\Shared Technology]
@DACL=(02 0000)
@SACL=

[HKEY_LOCAL_MACHINE\software\Ulead Systems\Ulead VideoStudio SE\9.0\Installer]
@DACL=(02 0000)
@SACL=
"ProductName"="Ulead VideoStudio %s"
"ProgramGroupName"="Ulead VideoStudio 9.0 SE DVD"
"Specially"="SE DVD"
"ProductVersion"="9.00.0100"
"Product Version"="9.00.0100"
"Product Build"="SE DVD"
"snLanguage"="11"
"szLanguage"="English"
"Serial Number"="781A2-89000-99933113"
"Path"="c:\\Program Files\\Ulead Systems\\Ulead VideoStudio 9.0 SE DVD"
"DDR_Path"="c:\\Program Files\\Ulead Systems\\Ulead VideoStudio 9.0 SE DVD\\DDR21"
"ProjectNumber"="130202890.510100000"

[HKEY_LOCAL_MACHINE\software\Ulead Systems\Ulead VideoStudio SE\9.0\Preference]
@DACL=(02 0000)
@SACL=
"TV System"=dword:00000000
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(1000)
c:\windows\system32\Ati2evxx.dll
c:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll

- - - - - - - > 'explorer.exe'(2820)
c:\windows\system32\SHDOCVW.dll
c:\windows\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.dll
c:\program files\Winflip\WFHook.dll
c:\windows\system32\ntshrui.dll
c:\windows\system32\msi.dll
c:\windows\system32\NETSHELL.dll
c:\windows\system32\credui.dll
c:\windows\system32\WPDShServiceObj.dll
c:\program files\Nokia\Nokia PC Suite 7\PhoneBrowser.dll
c:\program files\Nokia\Nokia PC Suite 7\NGSCM.DLL
c:\program files\Nokia\Nokia PC Suite 7\Lang\PhoneBrowser_eng.nlr
c:\program files\Nokia\Nokia PC Suite 7\Resource\PhoneBrowser_Nokia.ngr
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\ati2evxx.exe
c:\windows\ehome\ehrecvr.exe
c:\program files\AVG\AVG8\avgrsx.exe
c:\progra~1\AVG\AVG8\avgnsx.exe
c:\windows\ehome\ehSched.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\PnkBstrB.exe
c:\program files\Sonic\DigitalMedia LE v7\MyDVD LE\USBDeviceService.exe
c:\progra~1\COMMON~1\X10\Common\X10nets.exe
c:\windows\ehome\mcrdsvc.exe
c:\program files\AVG\AVG8\avgcsrvx.exe
c:\windows\system32\dllhost.exe
c:\windows\ehome\ehmsas.exe
.
**************************************************************************
.
Completion time: 2009-09-02 13:42 - machine was rebooted
ComboFix-quarantined-files.txt 2009-09-02 12:42
ComboFix2.txt 2009-09-01 17:44

Pre-Run: 197,720,465,408 bytes free
Post-Run: 197,704,294,400 bytes free

484 — E O F — 2009-08-18 16:55

Hope this helps and your advice is much appreciated. Lisa

Raktor

Post #9September 2, 2009, 12:59 PM UTC

Good job, Lisa.

1) P2P Warning
P2P - I see you have P2P software (BearShare, Vuze/Azureus) installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It likely contributed to your current situation. This page will give you further information.
Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares.
Please see this topic for more information:
Perils of P2P File Sharing.
I would strongly recommend that you uninstall these now. You can do so via Control Panel >> Add or Remove Programs.

2) Update Java
Your version of Java is outdated.

Please download JavaRa to your desktop and unzip it to its own folder

Run JavaRa.exe, pick the language of your choice and click Select. Then click Remove Older Versions.
Accept any prompts.
Open JavaRa.exe again and select Search For Updates.
Select Update Using Sun Java's Website then click Search and click on the Open Webpage button. Download and install the latest Java Runtime Environment (JRE) version for your computer.

3) Update Adobe Reader
Your current version of Adobe Reader is out of date, and may contain security issues. Please uninstall the version you have now from Add/Remove programs, and then download and install the latest Adobe Reader.

4) MBAM
You already have Malwarebytes' Anti-Malware installed. Open it, and update it via the updates tab to the latest version.

Once the program has updated, select Perform quick scan, then click Scan.
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected .
When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot.

5) ESET
You can use either Internet Explorer or Mozilla FireFox for this scan.

Please go here then click on: [external image: Posted Image]

Note: If using Mozilla Firefox you will need to download esetsmartinstaller_enu.exe when prompted then double click on it to install.
All of the below instructions are compatible with either Internet Explorer or Mozilla FireFox.
Select the option YES, I accept the Terms of Use then click on: [external image: Posted Image]
When prompted allow the Add-On/Active X to install.
Make sure that the option Remove found threats is NOT checked, and the option Scan archives is checked.
Now click on Advanced Settings and select the following:

- Scan for potentially unwanted applications
- Scan for potentially unsafe applications
- Enable Anti-Stealth Technology
Now click on: [external image: Posted Image]
The virus signature database… will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
When completed the Online Scan will begin automatically.
Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
When completed select Uninstall application on close if you so wish, make sure you copy the logfile first!
Now click on: [external image: Posted Image]
Use notepad to open the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt.
Copy and paste that log as a reply to this topic.

6) What You Will Need To Post:

MBAM log
ESET log

lisa597

Post #10September 2, 2009, 4:36 PM UTC

This is the rest of the logs as requested, Malwarebytes' Anti-Malware 1.40 Database version: 2730 Windows 5.1.2600 Service Pack 3 02/09/2009 14:56:27 mbam-log-2009-09-02 (14-56-27).txt Scan type: Quick Scan Objects scanned: 99024 Time elapsed: 5 minute(s), 0 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 2 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: C:\RECYCLER\S-1-5-21-1065087527-3504542235-3153624688-1005\Dc2\Adobe CS4 Keygen.exe (Trojan.Downloader) -> Quarantined and deleted successfully. C:\WINDOWS\system32\xa.tmp (Trojan.Downloader) -> Quarantined and deleted successfully. And the other C:\Documents and Settings\Family\My Documents\Azureus Downloads\Adobe Photoshop CS4 Extended - NLT RELEASE - Hunter17.7z probably a variant of Win32/Agent trojan C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\_kbiwkmmqlhxlxu_.sys.zip a variant of Win32/Rootkit.Kryptik.I trojan C:\System Volume Information\_restore{5FED904E-6E1E-4B49-8681-D5C017BB5784}\RP111\A0042043.exe probably a variant of Win32/VB.NQQ trojan C:\System Volume Information\_restore{5FED904E-6E1E-4B49-8681-D5C017BB5784}\RP141\A0045205.exe probably a variant of Win32/HackTool.Patcher.A application C:\System Volume Information\_restore{5FED904E-6E1E-4B49-8681-D5C017BB5784}\RP141\A0045206.exe probably a variant of Win32/Agent trojan C:\System Volume Information\_restore{5FED904E-6E1E-4B49-8681-D5C017BB5784}\RP154\A0046093.exe a variant of Win32/HackTool.Patcher.A application C:\System Volume Information\_restore{5FED904E-6E1E-4B49-8681-D5C017BB5784}\RP194\A0052967.exe probably a variant of Win32/VB.NQQ trojan C:\System Volume Information\_restore{5FED904E-6E1E-4B49-8681-D5C017BB5784}\RP195\A0056811.exe probably a variant of Win32/Agent trojan Have just realised that i for got to remove azureus and bearshare to going to do it now hop this doesnt affect this fix!!

Raktor

Post #11September 2, 2009, 10:24 PM UTC

C:\Documents and Settings\Family\My Documents\Azureus Downloads\Adobe Photoshop CS4 Extended - NLT RELEASE - Hunter17.7z probably a variant of Win32/Agent trojan

We've found the source of your infection. Please delete this file. Hopefully this is a good enough warning to prevent you from downloading cracks and pirated applications again, I don't think I need to say anymore.

How is the computer performing now; any symptoms still remaining?

lisa597

Post #12September 4, 2009, 7:34 AM UTC

Sorry for late reply my son has done this and wont be doing it again my isp was having problems. Thanks for your help

Raktor

Post #13September 4, 2009, 7:37 AM UTC

Good job.

Time for some housekeeping

Click START then RUN
Now type Combofix /u in the runbox and click OK
[external image: Posted Image]

The above procedure will reset your System Restore and clear out the backups and quarantines created during the course of this fix.

You can remove the rest of the tools we used, except MBAM. Keep that, update it once a week and perform a quick scan.

Here are some tips to reduce the potential for spyware infection in the future:

1. Make your Internet Explorer More Secure

From within Internet Explorer click on the Tools menu and then click on Options.
Click once on the Security tab.
Click once on the Internet icon so it becomes highlighted.
Click once on the Custom Level button.
- Change the Download signed ActiveX controls to Prompt.
- Change the Download unsigned ActiveX controls to Disable.
- Change the Initialise and script ActiveX controls not marked as safe to Disable.
- Change the Installation of desktop items to Prompt.
- Change the Launching programs and files in an IFRAME to Prompt.
- Change the Navigate sub-frames across different domains to Prompt.
- When all these settings have been made, click on the OK button.
- If it prompts you as to whether or not you want to save the settings, press the Yes button.
Next press the Apply button and then the OK to exit the Internet Properties page.

2. Update your Anti-Virus Software - I can not overemphasize the need for you to update your Anti-virus application on a regular basis. With the ever increasing number of new variants of malware arriving on the scene daily, you become very susceptible to an attack without updated protection.

3. Make sure you keep your Windows OS current by visiting Windows update regularly to download and install any critical updates and service packs. Without these you are leaving the back door open.

4. Consider a custom hosts file such as MVPS HOSTS. This custom hosts file effectively blocks a wide range of unwanted ads, banners, 3rd party Cookies, 3rd party page counters, web bugs, and many hijackers.
For information on how to download and install, please read this tutorial by WinHelp2002
Note: Be sure to follow the instructions to disable the DNS Client service before installing a custom hosts file.

5. Download and install the free version of WinPatrol. This program protects your computer in a variety of ways and will work well with your existing security software. Have a look at this tutorial to help you get started with the program.

6. Protect your computer from internet threats with SandboxIE. This program isolates Internet Explorer from the rest of your operating system, 'sandboxing' it away - so malicious websites can't do damage to the rest of your system. There is a Getting Started guide on their website.

7. Finally, I strongly recommend that you read Miekiemoses' good advice - How to prevent Malware

Please reply to this thread once more if you are satisfied so that we can mark the problem as resolved.

Raktor

Post #14September 8, 2009, 8:49 AM UTC

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] browser keeps redirecting

✨ Ask AI

Ask AI