Spyware / Malware / Virus Removal

Trojans and Annoyances

24 min read

Looking for the outcome? Ask AI

billiesdead Topic Starter

Post #1January 20, 2010, 7:06 AM UTC last edited January 20, 2010, 2:51 PM UTC

Hello, I followed the steps for infection and attached dds, mbam, gmer, and hijack this and attach. I cannot access task manager, and cannot delete some programs (AVG, Zone Alarm, VirtuaGuy that I know of) plus I just feel like my laptop is way bogged down. I also could not get some programs to run (spybot, Zone Alarm) Help is appreciated. Stefven p.s. gpedit.misc and regedit commands are fruitless

Attachments:

LDTate

Post #2January 21, 2010, 11:50 PM UTC

[external image: Posted Image]

DO NOT use any TOOLS such as Combofix, Vundofix, or HijackThis fixes without supervision.

Doing so could make your pc inoperatible and could require a full reinstall of your OS, losing all your programs and data.

Stay with this topic until I give you the all clean post.

You might want to print these instructions out.

I suggest you do this:

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Uncheck "Hide file extensions for known file types."
Under the "Hidden files" folder, select "Show hidden files and folders."
Uncheck "Hide protected operating system files."
Click Apply, and then click OK.

Please do not delete anything unless instructed to.

Next:

Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»

Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

(If you use FireFox or the Opera browser
To keep saved passwords, click No at the prompt.)

It's normal after running ATF cleaner that the PC will be slower to boot the first time.

Next:

Download ComboFix from one of these locations:

Link 1
Link 2 If using this link, Right Click and select Save As.

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : Protective Programs
Double click on ComboFix.exe & follow the prompts.

Note: Combofix will run without the Recovery Console installed.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
"copy/paste" a new HijackThis log file into this thread as well.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Give it atleast 20-30 minutes to finish if needed.

Also please describe how your computer behaves at the moment.

billiesdead

Post #3January 23, 2010, 1:56 PM UTC last edited January 23, 2010, 1:56 PM UTC

I appeciate your help. Attached are the txt documents as you've instructed. Currecntly my computer is behaving in a bogged down manner, I am still unable to access task manager, and I still cannot completely remove avg nor a couple other programs. Stefven

Attachments:

[attachment removed: ComboFix.zip]
📎hijackthisJAN23.zip

LDTate

Post #4January 23, 2010, 2:11 PM UTC

Please do not attach the scans unless requested to. Use Copy/Paste and post them. When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply. "copy/paste" a new HijackThis log file into this thread as well.

LDTate

Post #5January 23, 2010, 2:56 PM UTC

ComboFix 10-01-22.03 - Stefven Eiffel Poet 01/23/2010 7:15.1.1 - x86
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
AV: Lavasoft Ad-Watch Live! Anti-Virus *On-access scanning enabled* (Updated) {A1C4F2E0-7FDE-4917-AFAE-013EFC3EDE33}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\LOG.TXT
c:\windows\EventSystem.log
c:\windows\system32\reboot.txt
c:\windows\system32\taskngr.exe
c:\windows\system32\Thumbs.db

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_ASC3360PR
——-\Service_asc3360pr

((((((((((((((((((((((((( Files Created from 2009-12-23 to 2010-01-23 )))))))))))))))))))))))))))))))
.

2010-01-20 03:29 . 2010-01-20 03:29 ——– d—–w- c:\documents and settings\Stefven Eiffel Poet\Application Data\Malwarebytes
2010-01-20 03:28 . 2010-01-07 21:07 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-20 03:28 . 2010-01-20 03:28 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-01-20 03:28 . 2010-01-20 03:29 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-01-20 03:28 . 2010-01-07 21:07 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-01-20 03:23 . 2010-01-20 03:23 ——– d—–w- c:\program files\ERUNT
2010-01-20 03:09 . 2010-01-20 03:09 ——– d—–w- c:\documents and settings\Stefven Eiffel Poet\Local Settings\Application Data\PCHealth
2010-01-20 02:43 . 2010-01-20 02:43 21504 —-a-w- C:\SysRestorePoint.exe
2010-01-20 01:59 . 2010-01-20 01:59 ——– d—–w- c:\program files\Trend Micro
2010-01-19 15:11 . 2010-01-19 15:11 2029800 —-a-w- c:\documents and settings\Stefven Eiffel Poet\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\fpupdateax\fpupdateax.exe
2010-01-18 22:46 . 2009-12-02 13:19 15880 —-a-w- c:\windows\system32\lsdelete.exe
2010-01-18 19:34 . 2009-12-02 13:19 64288 —-a-w- c:\windows\system32\drivers\Lbd.sys
2010-01-18 19:10 . 2010-01-18 19:33 ——– d—–w- c:\documents and settings\All Users\Application Data\Lavasoft
2010-01-18 19:10 . 2010-01-18 19:10 ——– d—–w- c:\program files\Lavasoft
2010-01-17 17:40 . 2010-01-17 17:40 128 —-a-w- c:\windows\system32\pdfl.dat
2010-01-17 17:40 . 2010-01-17 17:40 80 —-a-w- c:\windows\system32\ibfl.dat
2010-01-17 17:39 . 2009-10-17 05:39 72584 —-a-w- c:\windows\zllsputility.exe
2010-01-17 17:39 . 2009-10-12 23:15 128016 —-a-w- c:\windows\system32\drivers\kl1.sys
2010-01-17 17:32 . 2009-10-17 05:39 103816 —-a-w- c:\windows\system32\zlcommdb.dll
2010-01-17 17:32 . 2009-10-17 05:39 69000 —-a-w- c:\windows\system32\zlcomm.dll
2010-01-17 17:28 . 2009-10-17 05:39 1238408 —-a-w- c:\windows\system32\zpeng25.dll
2010-01-17 17:28 . 2010-01-17 17:40 ——– d—–w- c:\windows\system32\ZoneLabs
2010-01-17 17:27 . 2010-01-17 17:27 ——– d—–w- c:\program files\Zone Labs
2010-01-17 17:23 . 2010-01-19 02:05 ——– d—–w- c:\windows\Internet Logs
2010-01-17 16:48 . 2010-01-17 16:48 ——– d—–w- c:\documents and settings\All Users\Application Data\ZA_PreservedFiles
2010-01-17 03:17 . 2010-01-17 03:17 144 —-a-w- c:\windows\system32\lkfl.dat
2010-01-17 03:17 . 2010-01-17 17:40 ——– d—–w- c:\program files\CheckPoint
2010-01-17 03:16 . 2010-01-17 17:39 4212 —ha-w- c:\windows\system32\zllictbl.dat
2010-01-16 17:55 . 2010-01-18 14:41 ——– d—–w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-01-16 15:30 . 2010-01-17 22:33 ——– d—–w- c:\program files\CA Yahoo! Anti-Spy
2010-01-14 23:57 . 2010-01-14 23:57 50968 —-a-w- c:\windows\system32\avgfwdx.dll
2010-01-14 23:57 . 2010-01-14 23:57 30104 —-a-w- c:\windows\system32\drivers\avgfwdx.sys
2010-01-14 23:56 . 2010-01-15 00:07 ——– d—–w- c:\windows\SxsCaPendDel
2010-01-14 23:06 . 2010-01-14 23:06 ——– d—–w- c:\documents and settings\Stefven Eiffel Poet\Application Data\AVG8
2010-01-12 02:49 . 2010-01-12 02:49 ——– d—–w- c:\documents and settings\Stefven Eiffel Poet\Local Settings\Application Data\Broderbund Software
2010-01-12 02:49 . 2010-01-12 02:49 ——– d—–w- c:\documents and settings\All Users\Application Data\Broderbund Software
2010-01-12 02:47 . 2010-01-15 00:46 ——– d—–w- c:\program files\Web Publish
2010-01-12 02:46 . 2008-05-15 19:19 3715072 —-a-w- c:\windows\system32\cdintf300.dll
2010-01-12 02:38 . 2010-01-12 02:40 ——– d—–w- c:\program files\Common Files\Broderbund
2010-01-12 02:38 . 2010-01-12 02:49 ——– d—–w- c:\program files\The Print Shop 23
2009-12-29 04:04 . 2009-12-29 04:04 ——– d—–w- c:\documents and settings\All Users\Application Data\McAfee
2009-12-27 04:03 . 2009-12-27 04:03 ——– d—–w- c:\documents and settings\All Users\Application Data\McAfee Security Scan
2009-12-27 04:03 . 2010-01-03 16:44 ——– d—–w- c:\program files\McAfee Security Scan
2009-12-24 15:22 . 2005-05-17 20:48 24576 —-a-w- c:\documents and settings\Stefven Eiffel Poet\Application Data\Mozilla\Firefox\Profiles\eaten3dd.default\extensions\{7E7165E2-0767-448c-852F-5FA8714F2C37}\components\PlainOldFavorites.dll
2009-12-24 15:22 . 2009-12-24 01:17 52224 —-a-w- c:\documents and settings\Stefven Eiffel Poet\Application Data\Mozilla\Firefox\Profiles\eaten3dd.default\extensions\{90c39cb5-4269-45fb-9e41-7a2e5c34995b}\components\FFExternalAlert.dll
2009-12-24 15:22 . 2009-12-24 01:17 101376 —-a-w- c:\documents and settings\Stefven Eiffel Poet\Application Data\Mozilla\Firefox\Profiles\eaten3dd.default\extensions\{90c39cb5-4269-45fb-9e41-7a2e5c34995b}\components\RadioWMPCore.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-23 12:52 . 2009-09-12 21:06 7 —-a-w- c:\windows\sbacknt.bin
2010-01-20 04:14 . 2007-02-06 21:39 349232 -c–a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.3\inst.exe
2010-01-19 13:43 . 2009-06-15 11:39 ——– d—–w- c:\documents and settings\All Users\Application Data\avg8
2010-01-18 20:22 . 2009-10-01 15:09 12521888 —-a-w- c:\documents and settings\Stefven Eiffel Poet\Application Data\vghd\Data\update\updater.exe
2010-01-17 22:33 . 2005-04-09 01:07 ——– d—–w- c:\program files\55lt3stm
2010-01-17 16:33 . 2005-06-03 04:58 ——– d—–w- c:\documents and settings\All Users\Application Data\Viewpoint
2010-01-17 16:33 . 2005-06-03 04:58 ——– d—–w- c:\program files\Viewpoint
2010-01-17 16:33 . 2007-04-09 00:34 ——– d—–w- c:\program files\Free Internet Window Washer
2010-01-16 15:30 . 2005-04-23 01:59 ——– d—–w- c:\program files\Common Files\Scanner
2010-01-16 15:27 . 2005-08-08 01:52 ——– d—–w- c:\documents and settings\All Users\Application Data\Yahoo! Companion
2010-01-16 15:27 . 2005-04-30 13:39 ——– d–h–r- c:\documents and settings\All Users\Application Data\yahoo!
2010-01-16 15:27 . 2005-03-17 02:04 ——– d—–w- c:\program files\Yahoo!
2010-01-16 15:26 . 2005-03-30 13:32 ——– d—–w- c:\documents and settings\Stefven Eiffel Poet\Application Data\Yahoo!
2010-01-14 23:59 . 2009-06-15 11:39 ——– d—–w- c:\program files\AVG
2010-01-12 02:51 . 2005-03-17 01:03 365952 -c–a-w- c:\documents and settings\Stefven Eiffel Poet\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-01-03 16:41 . 2009-02-23 00:16 ——– d—–w- c:\program files\Creative
2009-12-29 15:54 . 2009-05-27 19:47 ——– d—–w- c:\program files\Microsoft Silverlight
2009-02-28 02:45 . 2009-02-28 02:45 0 -c–a-w- c:\program files\temp01
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"Motive SmartBridge"="c:\progra~1\VERIZO~1\SMARTB~1\MotiveSB.exe" [2002-05-18 401408]
"HP Component Manager"="c:\program files\HP\hpcoretech\hpcmpmgr.exe" [2010-01-19 315392]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2003-10-30 225280]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2003-10-30 188416]
"Show missed alarms"="c:\program files\Alarm\Alarm.exe" [2010-01-19 307624]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-03-04 225280]
"SunJavaUpdateSched"="c:\program files\Java\jre1.5.0_06\bin\jusched.exe" [2005-11-10 36975]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2005-02-17 49152]
"Sprint SmartView"="c:\program files\Sprint\Sprint SmartView\SprintSV.exe" [2008-08-04 18968]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-01-19 137072]
"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2009-10-17 1106824]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2010-01-19 504160]

c:\documents and settings\Stefven Eiffel Poet\Start Menu\Programs\Startup\
DesktopVideoPlayer.LNK - c:\program files\vghd\vghd.exe [2009-9-12 476496]
ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Event Reminder.lnk - c:\program files\The Print Shop 23\Remind.exe [2008-7-16 421888]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2003-9-16 237568]
Verizon Online Support Center.lnk - c:\program files\Verizon Online\bin\matcli.exe [2005-3-16 282624]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"= 1 (0x1)
"DisableRegistryTools"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-06-15 11:41 11952 —-a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001
"FirewallDisableNotify"=dword:00000001
"FirewallOverride"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"UacDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Alarm\\Alarm Tray.exe"=
"c:\\Program Files\\Yahoo!\\Widgets\\YahooWidgets.exe"=
"c:\\Program Files\\Sprint\\Sprint SmartView\\SprintSV.exe"=
"c:\\Program Files\\Alarm\\Alarm.exe"=
"c:\\Program Files\\HP\\hpcoretech\\hpcmpmgr.exe"=
"c:\\Program Files\\Common Files\\Adobe\\Updater6\\Adobe_Updater.exe"=
"c:\\Program Files\\Verizon Online\\bin\\mpbtn.exe"=
"c:\\WINDOWS\\system32\\hkcmd.exe"=
"c:\\WINDOWS\\system32\\igfxtray.exe"=
"c:\\Program Files\\QuickTime\\qttask.exe"=
"c:\\Program Files\\vghd\\VirtuaGirl_downloader.exe"=
"c:\\PROGRA~1\\VERIZO~1\\SMARTB~1\\MotiveSB.exe"=
"c:\\DOCUME~1\\STEFVE~1\\LOCALS~1\\Temp\\winovkey.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [01/18/2010 2:34 PM 64288]
R2 ISWKL;ZoneAlarm ForceField ISWKL;c:\program files\CheckPoint\ZAForceField\ISWKL.sys [10/14/2009 8:30 AM 25208]
R3 Avgfwdx;Avgfwdx;c:\windows\system32\drivers\avgfwdx.sys [01/14/2010 6:57 PM 30104]
S1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [06/15/2009 6:41 AM 327688]
S3 Avgfwfd;AVG network filter service;c:\windows\system32\drivers\avgfwdx.sys [01/14/2010 6:57 PM 30104]

— Other Services/Drivers In Memory —

*NewlyCreated* - ASC3360PR
.
.
——- Supplementary Scan ——-
.
uLocal Page = \blank.htm
uStart Page = hxxp://my.yahoo.com/
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/wdgt3/*http://www.yahoo.com/ext/search/search.html
uInternet Connection Wizard,ShellNext = hxxp://cgi.verizon.net/bookmarks/bmredir.asp?region=all&bw=dsl&cd=6.1&bm=ms_welcome
uInternet Settings,ProxyOverride = 127.0.0.1;localhost
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/wdgt3/*http://www.yahoo.com
IE: &Yahoo! Search - file:///c:\program files\Yahoo!\Common/ycsrch.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: Yahoo! &Dictionary - file:///c:\program files\Yahoo!\Common/ycdict.htm
IE: Yahoo! &Maps - file:///c:\program files\Yahoo!\Common/ycmap.htm
IE: Yahoo! &SMS - file:///c:\program files\Yahoo!\Common/ycsms.htm
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
.
- - - - ORPHANS REMOVED - - - -

BHO-{28CAEFF3-0F18-4036-B504-51D73BD81ABC} - REG_SZ
BHO-{00000000-0000-4F0C-8338-A5047A4E1826} - c:\program files\55lt3stm\55lt3stm.dll
HKCU-Run-updateMgr - c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe
HKLM-Run-LogitechVideoRepair - c:\program files\Logitech\Video\ISStart.exe
HKLM-Run-rt93cj9n - c:\program files\rt93cj9n\rt93cj9n.exe
HKLM-Run-DXDllRegExe - dxdllreg.exe
HKLM-Run-AAAScreenSavers_WhenUSaveNow_Installer - c:\program files\AAAScreenSavers_WhenUSaveNow_Installer\AAAScreenSavers_WhenUSaveNow_Installer.exe
HKLM-Run-AVG8_TRAY - c:\progra~1\AVG\AVG8\avgtray.exe
AddRemove-AVG8Uninstall - c:\program files\AVG\AVG8\setup.exe
AddRemove-mIRC - c:\windows\temp\spoolsv\spoolsv.exe
AddRemove-ShockwaveFlash - c:\windows\system32\Macromed\Flash\UninstFl.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-23 07:51
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
———————— Other Running Processes ————————
.
c:\program files\CheckPoint\ZAForceField\IswSvc.exe
c:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exe
c:\program files\Alarm\Alarm Tray.exe
c:\program files\Alarm\AlarmMonitor.exe
c:\program files\Yahoo!\Widgets\YahooWidgets.exe
c:\program files\Verizon Online\bin\mpbtn.exe
c:\program files\vghd\VirtuaGirl_downloader.exe
c:\program files\Yahoo!\Widgets\YahooWidgets.exe
c:\docume~1\STEFVE~1\LOCALS~1\Temp\winovkey.exe
c:\program files\Java\jre1.5.0_06\bin\jucheck.exe
.
**************************************************************************
.
Completion time: 2010-01-23 08:07:30 - machine was rebooted
ComboFix-quarantined-files.txt 2010-01-23 13:07

Pre-Run: 36,271,206,400 bytes free
Post-Run: 36,395,884,544 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

- - End Of File - - BB25ECEB4AA02E0DBC8EEA997AAEC4CA

LDTate

Post #6January 23, 2010, 3:06 PM UTC

We've been seeing some Java infections lately.
Go here and follow the instructions to clear your Java Cache

Next:

Copy/paste the text in the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Take your mouse, and place your cursor at the beginning of the text in the box below, then click and hold the left mouse button, while pulling your mouse over the text. This should highlight the text. Now release the left mouse button. Now, with the cursor over the highlighted text, right click the mouse for options, and select 'copy'. Now over the empty Notepad box, right click your mouse again, and select 'paste' and you will have copied and pasted the text.

File::
c:\program files\vghd\vghd.exe
c:\\DOCUME~1\\STEFVE~1\\LOCALS~1\\Temp\\winovkey.exe


Folder::
c:\program files\vghd

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:
1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …

[external image: Posted Image]

Drag CFScript.txt into ComboFix.exe

Then post the results log and a new HijackThis log.

Also please describe how your computer behaves at the moment.

billiesdead

Post #7January 23, 2010, 5:27 PM UTC

Here is the resulting CF ang HJT log. Internet moving faster, still cannot access task manager. Zonelabs and AVG still with me, at least partially…I can't run the programs, nor can I uninstall them.

ComboFix 10-01-22.03 - Stefven Eiffel Poet 01/23/2010 10:25:20.2.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.222.87 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Stefven Eiffel Poet\Desktop\CFScript.txt
AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
AV: Lavasoft Ad-Watch Live! Anti-Virus *On-access scanning enabled* (Updated) {A1C4F2E0-7FDE-4917-AFAE-013EFC3EDE33}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_ASC3360PR

((((((((((((((((((((((((( Files Created from 2009-12-23 to 2010-01-23 )))))))))))))))))))))))))))))))
.

2010-01-20 03:29 . 2010-01-20 03:29 ——– d—–w- c:\documents and settings\Stefven Eiffel Poet\Application Data\Malwarebytes
2010-01-20 03:28 . 2010-01-07 21:07 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-20 03:28 . 2010-01-20 03:28 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-01-20 03:28 . 2010-01-20 03:29 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-01-20 03:28 . 2010-01-07 21:07 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-01-20 03:23 . 2010-01-20 03:23 ——– d—–w- c:\program files\ERUNT
2010-01-20 03:09 . 2010-01-20 03:09 ——– d—–w- c:\documents and settings\Stefven Eiffel Poet\Local Settings\Application Data\PCHealth
2010-01-20 02:43 . 2010-01-20 02:43 21504 —-a-w- C:\SysRestorePoint.exe
2010-01-20 01:59 . 2010-01-20 01:59 ——– d—–w- c:\program files\Trend Micro
2010-01-19 15:11 . 2010-01-19 15:11 2029800 —-a-w- c:\documents and settings\Stefven Eiffel Poet\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\fpupdateax\fpupdateax.exe
2010-01-18 22:46 . 2009-12-02 13:19 15880 —-a-w- c:\windows\system32\lsdelete.exe
2010-01-18 19:34 . 2009-12-02 13:19 64288 —-a-w- c:\windows\system32\drivers\Lbd.sys
2010-01-18 19:10 . 2010-01-18 19:33 ——– d—–w- c:\documents and settings\All Users\Application Data\Lavasoft
2010-01-18 19:10 . 2010-01-18 19:10 ——– d—–w- c:\program files\Lavasoft
2010-01-17 17:40 . 2010-01-17 17:40 128 —-a-w- c:\windows\system32\pdfl.dat
2010-01-17 17:40 . 2010-01-17 17:40 80 —-a-w- c:\windows\system32\ibfl.dat
2010-01-17 17:39 . 2009-10-17 05:39 72584 —-a-w- c:\windows\zllsputility.exe
2010-01-17 17:39 . 2009-10-12 23:15 128016 —-a-w- c:\windows\system32\drivers\kl1.sys
2010-01-17 17:32 . 2009-10-17 05:39 103816 —-a-w- c:\windows\system32\zlcommdb.dll
2010-01-17 17:32 . 2009-10-17 05:39 69000 —-a-w- c:\windows\system32\zlcomm.dll
2010-01-17 17:28 . 2009-10-17 05:39 1238408 —-a-w- c:\windows\system32\zpeng25.dll
2010-01-17 17:28 . 2010-01-17 17:40 ——– d—–w- c:\windows\system32\ZoneLabs
2010-01-17 17:27 . 2010-01-17 17:27 ——– d—–w- c:\program files\Zone Labs
2010-01-17 17:23 . 2010-01-19 02:05 ——– d—–w- c:\windows\Internet Logs
2010-01-17 16:48 . 2010-01-17 16:48 ——– d—–w- c:\documents and settings\All Users\Application Data\ZA_PreservedFiles
2010-01-17 03:17 . 2010-01-17 03:17 144 —-a-w- c:\windows\system32\lkfl.dat
2010-01-17 03:17 . 2010-01-17 17:40 ——– d—–w- c:\program files\CheckPoint
2010-01-17 03:16 . 2010-01-17 17:39 4212 —ha-w- c:\windows\system32\zllictbl.dat
2010-01-16 17:55 . 2010-01-18 14:41 ——– d—–w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-01-16 15:30 . 2010-01-17 22:33 ——– d—–w- c:\program files\CA Yahoo! Anti-Spy
2010-01-14 23:57 . 2010-01-14 23:57 50968 —-a-w- c:\windows\system32\avgfwdx.dll
2010-01-14 23:57 . 2010-01-14 23:57 30104 —-a-w- c:\windows\system32\drivers\avgfwdx.sys
2010-01-14 23:56 . 2010-01-15 00:07 ——– d—–w- c:\windows\SxsCaPendDel
2010-01-14 23:06 . 2010-01-14 23:06 ——– d—–w- c:\documents and settings\Stefven Eiffel Poet\Application Data\AVG8
2010-01-12 02:49 . 2010-01-12 02:49 ——– d—–w- c:\documents and settings\Stefven Eiffel Poet\Local Settings\Application Data\Broderbund Software
2010-01-12 02:49 . 2010-01-12 02:49 ——– d—–w- c:\documents and settings\All Users\Application Data\Broderbund Software
2010-01-12 02:47 . 2010-01-15 00:46 ——– d—–w- c:\program files\Web Publish
2010-01-12 02:46 . 2008-05-15 19:19 3715072 —-a-w- c:\windows\system32\cdintf300.dll
2010-01-12 02:38 . 2010-01-12 02:40 ——– d—–w- c:\program files\Common Files\Broderbund
2010-01-12 02:38 . 2010-01-12 02:49 ——– d—–w- c:\program files\The Print Shop 23
2009-12-29 04:04 . 2009-12-29 04:04 ——– d—–w- c:\documents and settings\All Users\Application Data\McAfee
2009-12-27 04:03 . 2009-12-27 04:03 ——– d—–w- c:\documents and settings\All Users\Application Data\McAfee Security Scan
2009-12-27 04:03 . 2010-01-03 16:44 ——– d—–w- c:\program files\McAfee Security Scan

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-23 17:02 . 2009-09-12 21:06 7 —-a-w- c:\windows\sbacknt.bin
2010-01-23 13:32 . 2009-06-15 11:39 ——– d—–w- c:\documents and settings\All Users\Application Data\avg8
2010-01-20 04:14 . 2007-02-06 21:39 349232 -c–a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.3\inst.exe
2010-01-18 20:22 . 2009-10-01 15:09 12521888 —-a-w- c:\documents and settings\Stefven Eiffel Poet\Application Data\vghd\Data\update\updater.exe
2010-01-17 22:33 . 2005-04-09 01:07 ——– d—–w- c:\program files\55lt3stm
2010-01-17 16:33 . 2005-06-03 04:58 ——– d—–w- c:\documents and settings\All Users\Application Data\Viewpoint
2010-01-17 16:33 . 2005-06-03 04:58 ——– d—–w- c:\program files\Viewpoint
2010-01-17 16:33 . 2007-04-09 00:34 ——– d—–w- c:\program files\Free Internet Window Washer
2010-01-16 15:30 . 2005-04-23 01:59 ——– d—–w- c:\program files\Common Files\Scanner
2010-01-16 15:27 . 2005-08-08 01:52 ——– d—–w- c:\documents and settings\All Users\Application Data\Yahoo! Companion
2010-01-16 15:27 . 2005-04-30 13:39 ——– d–h–r- c:\documents and settings\All Users\Application Data\yahoo!
2010-01-16 15:27 . 2005-03-17 02:04 ——– d—–w- c:\program files\Yahoo!
2010-01-16 15:26 . 2005-03-30 13:32 ——– d—–w- c:\documents and settings\Stefven Eiffel Poet\Application Data\Yahoo!
2010-01-14 23:59 . 2009-06-15 11:39 ——– d—–w- c:\program files\AVG
2010-01-12 02:51 . 2005-03-17 01:03 365952 -c–a-w- c:\documents and settings\Stefven Eiffel Poet\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-01-03 16:41 . 2009-02-23 00:16 ——– d—–w- c:\program files\Creative
2009-12-29 15:54 . 2009-05-27 19:47 ——– d—–w- c:\program files\Microsoft Silverlight
2009-12-24 01:17 . 2009-12-24 15:22 52224 —-a-w- c:\documents and settings\Stefven Eiffel Poet\Application Data\Mozilla\Firefox\Profiles\eaten3dd.default\extensions\{90c39cb5-4269-45fb-9e41-7a2e5c34995b}\components\FFExternalAlert.dll
2009-12-24 01:17 . 2009-12-24 15:22 101376 —-a-w- c:\documents and settings\Stefven Eiffel Poet\Application Data\Mozilla\Firefox\Profiles\eaten3dd.default\extensions\{90c39cb5-4269-45fb-9e41-7a2e5c34995b}\components\RadioWMPCore.dll
2009-02-28 02:45 . 2009-02-28 02:45 0 -c–a-w- c:\program files\temp01
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"Motive SmartBridge"="c:\progra~1\VERIZO~1\SMARTB~1\MotiveSB.exe" [2002-05-18 401408]
"HP Component Manager"="c:\program files\HP\hpcoretech\hpcmpmgr.exe" [2010-01-19 315392]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2003-10-30 225280]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2003-10-30 188416]
"Show missed alarms"="c:\program files\Alarm\Alarm.exe" [2010-01-19 307624]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-03-04 225280]
"SunJavaUpdateSched"="c:\program files\Java\jre1.5.0_06\bin\jusched.exe" [2005-11-10 36975]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2005-02-17 49152]
"Sprint SmartView"="c:\program files\Sprint\Sprint SmartView\SprintSV.exe" [2008-08-04 18968]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-01-19 137072]
"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2009-10-17 1106824]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2010-01-19 504160]

c:\documents and settings\Stefven Eiffel Poet\Start Menu\Programs\Startup\
DesktopVideoPlayer.LNK - c:\program files\vghd\vghd.exe [2009-9-12 476496]
ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Event Reminder.lnk - c:\program files\The Print Shop 23\Remind.exe [2008-7-16 421888]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2003-9-16 237568]
Verizon Online Support Center.lnk - c:\program files\Verizon Online\bin\matcli.exe [2005-3-16 282624]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"= 1 (0x1)
"DisableRegistryTools"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-06-15 11:41 11952 —-a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001
"FirewallDisableNotify"=dword:00000001
"FirewallOverride"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"UacDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Alarm\\Alarm Tray.exe"=
"c:\\Program Files\\Yahoo!\\Widgets\\YahooWidgets.exe"=
"c:\\Program Files\\Sprint\\Sprint SmartView\\SprintSV.exe"=
"c:\\Program Files\\Alarm\\Alarm.exe"=
"c:\\Program Files\\HP\\hpcoretech\\hpcmpmgr.exe"=
"c:\\Program Files\\Common Files\\Adobe\\Updater6\\Adobe_Updater.exe"=
"c:\\Program Files\\Verizon Online\\bin\\mpbtn.exe"=
"c:\\WINDOWS\\system32\\hkcmd.exe"=
"c:\\WINDOWS\\system32\\igfxtray.exe"=
"c:\\Program Files\\QuickTime\\qttask.exe"=
"c:\\Program Files\\vghd\\VirtuaGirl_downloader.exe"=
"c:\\PROGRA~1\\VERIZO~1\\SMARTB~1\\MotiveSB.exe"=
"c:\\DOCUME~1\\STEFVE~1\\LOCALS~1\\Temp\\oqqe.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [01/18/2010 2:34 PM 64288]
R2 ISWKL;ZoneAlarm ForceField ISWKL;c:\program files\CheckPoint\ZAForceField\ISWKL.sys [10/14/2009 8:30 AM 25208]
R2 IswSvc;ZoneAlarm ForceField IswSvc;c:\program files\CheckPoint\ZAForceField\ISWSVC.exe [10/14/2009 8:30 AM 476528]
R3 AlarmClockMonitor;Talking Alarm Clock user logon monitor;c:\program files\Alarm\AlarmMonitor.exe [09/15/2004 12:30 PM 246184]
R3 asc3360pr;asc3360pr;\??\c:\windows\system32\drivers\lkkphm.sys –> c:\windows\system32\drivers\lkkphm.sys [?]
R3 Avgfwdx;Avgfwdx;c:\windows\system32\drivers\avgfwdx.sys [01/14/2010 6:57 PM 30104]
S1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [06/15/2009 6:41 AM 327688]
S2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe –> c:\progra~1\AVG\AVG8\avgwdsvc.exe [?]
S3 Avgfwfd;AVG network filter service;c:\windows\system32\drivers\avgfwdx.sys [01/14/2010 6:57 PM 30104]
S4 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;"c:\program files\Lavasoft\Ad-Aware\AAWService.exe" –> c:\program files\Lavasoft\Ad-Aware\AAWService.exe [?]

— Other Services/Drivers In Memory —

*NewlyCreated* - ASC3360PR
.
.
——- Supplementary Scan ——-
.
uLocal Page = \blank.htm
uStart Page = hxxp://my.yahoo.com/
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/wdgt3/*http://www.yahoo.com/ext/search/search.html
uInternet Connection Wizard,ShellNext = hxxp://cgi.verizon.net/bookmarks/bmredir.asp?region=all&bw=dsl&cd=6.1&bm=ms_welcome
uInternet Settings,ProxyOverride = 127.0.0.1;localhost
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/wdgt3/*http://www.yahoo.com
IE: &Yahoo! Search - file:///c:\program files\Yahoo!\Common/ycsrch.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: Yahoo! &Dictionary - file:///c:\program files\Yahoo!\Common/ycdict.htm
IE: Yahoo! &Maps - file:///c:\program files\Yahoo!\Common/ycmap.htm
IE: Yahoo! &SMS - file:///c:\program files\Yahoo!\Common/ycsms.htm
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
.
- - - - ORPHANS REMOVED - - - -

BHO-{28CAEFF3-0F18-4036-B504-51D73BD81ABC} - REG_SZ

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-23 12:02
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
———————— Other Running Processes ————————
.
c:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exe
c:\program files\Alarm\Alarm Tray.exe
c:\program files\Yahoo!\Widgets\YahooWidgets.exe
c:\program files\vghd\VirtuaGirl_downloader.exe
c:\program files\Verizon Online\bin\mpbtn.exe
c:\program files\Yahoo!\Widgets\YahooWidgets.exe
c:\docume~1\STEFVE~1\LOCALS~1\Temp\oqqe.exe
c:\program files\Java\jre1.5.0_06\bin\jucheck.exe
.
**************************************************************************
.
Completion time: 2010-01-23 12:15:07 - machine was rebooted
ComboFix-quarantined-files.txt 2010-01-23 17:15

Pre-Run: 36,081,352,704 bytes free
Post-Run: 36,145,192,960 bytes free

- - End Of File - - 03B0809FDABE75F05F9742CF7D0EF5D9

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:22:36 PM, on 01/23/2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\VERIZO~1\SMARTB~1\MotiveSB.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Alarm\Alarm Tray.exe
C:\Program Files\Alarm\AlarmMonitor.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe
C:\Program Files\vghd\VirtuaGirl_downloader.exe
C:\Program Files\Verizon Online\bin\mpbtn.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe
C:\DOCUME~1\STEFVE~1\LOCALS~1\Temp\oqqe.exe
C:\Program Files\Java\jre1.5.0_06\bin\jucheck.exe
C:\WINDOWS\explorer.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://cgi.verizon.net/bookmarks/bmredir.a…p;bm=ms_welcome
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn7\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn7\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: ZoneAlarm Toolbar Registrar - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn7\YTSingleInstance.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn7\yt.dll
O3 - Toolbar: ZoneAlarm Toolbar - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\VERIZO~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Show missed alarms] C:\Program Files\Alarm\Alarm.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Sprint SmartView] "C:\Program Files\Sprint\Sprint SmartView\SprintSV.exe" -a
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - Startup: DesktopVideoPlayer.LNK = C:\Program Files\vghd\vghd.exe
O4 - Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE
O4 - Startup: PowerToChange.lnk = C:\Program Files\PowerToChange\PowerToChange.exe
O4 - Startup: Yahoo! Widgets.lnk = C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe
O4 - Global Startup: Event Reminder.lnk = C:\Program Files\The Print Shop 23\Remind.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Verizon Online Support Center.lnk = C:\Program Files\Verizon Online\bin\matcli.exe
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: Yahoo! Klondike Solitaire - http://presence.games.yahoo.com/yog/y/ks12_x.cab
O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} (Citrix ICA Client) - http://a516.g.akamai.net/f/516/25175/7d/ru…cat-no-eula.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1111030080892
O16 - DPF: {ED28050F-D713-43BA-A376-DCC5C35407D5} (MsnMusicAx Class) - https://music.msn.com/client/msnmusax3024.cab
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: Talking Alarm Clock user logon monitor (AlarmClockMonitor) - Cinnamon Software Inc. - C:\Program Files\Alarm\AlarmMonitor.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - Unknown owner - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: ZoneAlarm ForceField IswSvc (IswSvc) - Check Point Software Technologies - C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe
O23 - Service: Sprint RcAppSvc (SprintRcAppSvc) - PCTEL - C:\Program Files\Sprint\Sprint SmartView\RcAppSvc.exe
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
O24 - Desktop Component 0: (no name) - http://www.vanermengem.com/img/paris/kvefr0291s.jpg

–
End of file - 9355 bytes

LDTate

Post #8January 23, 2010, 5:33 PM UTC last edited January 23, 2010, 5:33 PM UTC

Copy/paste the text in the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Take your mouse, and place your cursor at the beginning of the text in the box below, then click and hold the left mouse button, while pulling your mouse over the text. This should highlight the text. Now release the left mouse button. Now, with the cursor over the highlighted text, right click the mouse for options, and select 'copy'. Now over the empty Notepad box, right click your mouse again, and select 'paste' and you will have copied and pasted the text.

File::
C:\DOCUME~1\STEFVE~1\LOCALS~1\Temp\[b]oqqe.exe
c:\program files\vghd\VirtuaGirl_downloader.exe

billiesdead

Post #9January 23, 2010, 6:47 PM UTC

Here they are:

ComboFix 10-01-23.02 - Stefven Eiffel Poet 01/23/2010 13:09:59.3.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.222.100 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Stefven Eiffel Poet\Desktop\CFScript.txt
AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
AV: Lavasoft Ad-Watch Live! Anti-Virus *On-access scanning enabled* (Updated) {A1C4F2E0-7FDE-4917-AFAE-013EFC3EDE33}

FILE ::
"c:\docume~1\STEFVE~1\LOCALS~1\Temp\oqqe.exe"
"c:\program files\vghd\VirtuaGirl_downloader.exe"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_ASC3360PR
——-\Service_asc3360pr

((((((((((((((((((((((((( Files Created from 2009-12-23 to 2010-01-23 )))))))))))))))))))))))))))))))
.

2010-01-20 03:29 . 2010-01-20 03:29 ——– d—–w- c:\documents and settings\Stefven Eiffel Poet\Application Data\Malwarebytes
2010-01-20 03:28 . 2010-01-07 21:07 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-20 03:28 . 2010-01-20 03:28 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-01-20 03:28 . 2010-01-20 03:29 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-01-20 03:28 . 2010-01-07 21:07 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-01-20 03:23 . 2010-01-20 03:23 ——– d—–w- c:\program files\ERUNT
2010-01-20 03:09 . 2010-01-20 03:09 ——– d—–w- c:\documents and settings\Stefven Eiffel Poet\Local Settings\Application Data\PCHealth
2010-01-20 02:43 . 2010-01-20 02:43 21504 —-a-w- C:\SysRestorePoint.exe
2010-01-20 01:59 . 2010-01-20 01:59 ——– d—–w- c:\program files\Trend Micro
2010-01-19 15:11 . 2010-01-19 15:11 2029800 —-a-w- c:\documents and settings\Stefven Eiffel Poet\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\fpupdateax\fpupdateax.exe
2010-01-18 22:46 . 2009-12-02 13:19 15880 —-a-w- c:\windows\system32\lsdelete.exe
2010-01-18 19:34 . 2009-12-02 13:19 64288 —-a-w- c:\windows\system32\drivers\Lbd.sys
2010-01-18 19:10 . 2010-01-18 19:33 ——– d—–w- c:\documents and settings\All Users\Application Data\Lavasoft
2010-01-18 19:10 . 2010-01-18 19:10 ——– d—–w- c:\program files\Lavasoft
2010-01-17 17:40 . 2010-01-17 17:40 128 —-a-w- c:\windows\system32\pdfl.dat
2010-01-17 17:40 . 2010-01-17 17:40 80 —-a-w- c:\windows\system32\ibfl.dat
2010-01-17 17:39 . 2009-10-17 05:39 72584 —-a-w- c:\windows\zllsputility.exe
2010-01-17 17:39 . 2009-10-12 23:15 128016 —-a-w- c:\windows\system32\drivers\kl1.sys
2010-01-17 17:32 . 2009-10-17 05:39 103816 —-a-w- c:\windows\system32\zlcommdb.dll
2010-01-17 17:32 . 2009-10-17 05:39 69000 —-a-w- c:\windows\system32\zlcomm.dll
2010-01-17 17:28 . 2009-10-17 05:39 1238408 —-a-w- c:\windows\system32\zpeng25.dll
2010-01-17 17:28 . 2010-01-17 17:40 ——– d—–w- c:\windows\system32\ZoneLabs
2010-01-17 17:27 . 2010-01-17 17:27 ——– d—–w- c:\program files\Zone Labs
2010-01-17 17:23 . 2010-01-19 02:05 ——– d—–w- c:\windows\Internet Logs
2010-01-17 16:48 . 2010-01-17 16:48 ——– d—–w- c:\documents and settings\All Users\Application Data\ZA_PreservedFiles
2010-01-17 03:17 . 2010-01-17 03:17 144 —-a-w- c:\windows\system32\lkfl.dat
2010-01-17 03:17 . 2010-01-17 17:40 ——– d—–w- c:\program files\CheckPoint
2010-01-17 03:16 . 2010-01-17 17:39 4212 —ha-w- c:\windows\system32\zllictbl.dat
2010-01-16 17:55 . 2010-01-18 14:41 ——– d—–w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-01-16 15:30 . 2010-01-17 22:33 ——– d—–w- c:\program files\CA Yahoo! Anti-Spy
2010-01-14 23:57 . 2010-01-14 23:57 50968 —-a-w- c:\windows\system32\avgfwdx.dll
2010-01-14 23:57 . 2010-01-14 23:57 30104 —-a-w- c:\windows\system32\drivers\avgfwdx.sys
2010-01-14 23:56 . 2010-01-15 00:07 ——– d—–w- c:\windows\SxsCaPendDel
2010-01-14 23:06 . 2010-01-14 23:06 ——– d—–w- c:\documents and settings\Stefven Eiffel Poet\Application Data\AVG8
2010-01-12 02:49 . 2010-01-12 02:49 ——– d—–w- c:\documents and settings\Stefven Eiffel Poet\Local Settings\Application Data\Broderbund Software
2010-01-12 02:49 . 2010-01-12 02:49 ——– d—–w- c:\documents and settings\All Users\Application Data\Broderbund Software
2010-01-12 02:47 . 2010-01-15 00:46 ——– d—–w- c:\program files\Web Publish
2010-01-12 02:46 . 2008-05-15 19:19 3715072 —-a-w- c:\windows\system32\cdintf300.dll
2010-01-12 02:38 . 2010-01-12 02:40 ——– d—–w- c:\program files\Common Files\Broderbund
2010-01-12 02:38 . 2010-01-12 02:49 ——– d—–w- c:\program files\The Print Shop 23
2009-12-29 04:04 . 2009-12-29 04:04 ——– d—–w- c:\documents and settings\All Users\Application Data\McAfee
2009-12-27 04:03 . 2009-12-27 04:03 ——– d—–w- c:\documents and settings\All Users\Application Data\McAfee Security Scan
2009-12-27 04:03 . 2010-01-03 16:44 ——– d—–w- c:\program files\McAfee Security Scan

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-23 18:27 . 2009-09-12 21:06 7 —-a-w- c:\windows\sbacknt.bin
2010-01-23 13:32 . 2009-06-15 11:39 ——– d—–w- c:\documents and settings\All Users\Application Data\avg8
2010-01-20 04:14 . 2007-02-06 21:39 349232 -c–a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.3\inst.exe
2010-01-18 20:22 . 2009-10-01 15:09 12521888 —-a-w- c:\documents and settings\Stefven Eiffel Poet\Application Data\vghd\Data\update\updater.exe
2010-01-17 22:33 . 2005-04-09 01:07 ——– d—–w- c:\program files\55lt3stm
2010-01-17 16:33 . 2005-06-03 04:58 ——– d—–w- c:\documents and settings\All Users\Application Data\Viewpoint
2010-01-17 16:33 . 2005-06-03 04:58 ——– d—–w- c:\program files\Viewpoint
2010-01-17 16:33 . 2007-04-09 00:34 ——– d—–w- c:\program files\Free Internet Window Washer
2010-01-16 15:30 . 2005-04-23 01:59 ——– d—–w- c:\program files\Common Files\Scanner
2010-01-16 15:27 . 2005-08-08 01:52 ——– d—–w- c:\documents and settings\All Users\Application Data\Yahoo! Companion
2010-01-16 15:27 . 2005-04-30 13:39 ——– d–h–r- c:\documents and settings\All Users\Application Data\yahoo!
2010-01-16 15:27 . 2005-03-17 02:04 ——– d—–w- c:\program files\Yahoo!
2010-01-16 15:26 . 2005-03-30 13:32 ——– d—–w- c:\documents and settings\Stefven Eiffel Poet\Application Data\Yahoo!
2010-01-14 23:59 . 2009-06-15 11:39 ——– d—–w- c:\program files\AVG
2010-01-12 02:51 . 2005-03-17 01:03 365952 -c–a-w- c:\documents and settings\Stefven Eiffel Poet\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-01-03 16:41 . 2009-02-23 00:16 ——– d—–w- c:\program files\Creative
2009-12-29 15:54 . 2009-05-27 19:47 ——– d—–w- c:\program files\Microsoft Silverlight
2009-12-24 01:17 . 2009-12-24 15:22 52224 —-a-w- c:\documents and settings\Stefven Eiffel Poet\Application Data\Mozilla\Firefox\Profiles\eaten3dd.default\extensions\{90c39cb5-4269-45fb-9e41-7a2e5c34995b}\components\FFExternalAlert.dll
2009-12-24 01:17 . 2009-12-24 15:22 101376 —-a-w- c:\documents and settings\Stefven Eiffel Poet\Application Data\Mozilla\Firefox\Profiles\eaten3dd.default\extensions\{90c39cb5-4269-45fb-9e41-7a2e5c34995b}\components\RadioWMPCore.dll
2009-02-28 02:45 . 2009-02-28 02:45 0 -c–a-w- c:\program files\temp01
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"Motive SmartBridge"="c:\progra~1\VERIZO~1\SMARTB~1\MotiveSB.exe" [2002-05-18 401408]
"HP Component Manager"="c:\program files\HP\hpcoretech\hpcmpmgr.exe" [2010-01-19 315392]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2003-10-30 225280]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2003-10-30 188416]
"Show missed alarms"="c:\program files\Alarm\Alarm.exe" [2010-01-19 307624]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-03-04 225280]
"SunJavaUpdateSched"="c:\program files\Java\jre1.5.0_06\bin\jusched.exe" [2005-11-10 36975]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2005-02-17 49152]
"Sprint SmartView"="c:\program files\Sprint\Sprint SmartView\SprintSV.exe" [2008-08-04 18968]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-01-19 137072]
"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2009-10-17 1106824]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2010-01-19 504160]

c:\documents and settings\Stefven Eiffel Poet\Start Menu\Programs\Startup\
DesktopVideoPlayer.LNK - c:\program files\vghd\vghd.exe [2009-9-12 476496]
ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Event Reminder.lnk - c:\program files\The Print Shop 23\Remind.exe [2008-7-16 421888]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2003-9-16 237568]
Verizon Online Support Center.lnk - c:\program files\Verizon Online\bin\matcli.exe [2005-3-16 282624]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"= 1 (0x1)
"DisableRegistryTools"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-06-15 11:41 11952 —-a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001
"FirewallDisableNotify"=dword:00000001
"FirewallOverride"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"UacDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Alarm\\Alarm Tray.exe"=
"c:\\Program Files\\Yahoo!\\Widgets\\YahooWidgets.exe"=
"c:\\Program Files\\Sprint\\Sprint SmartView\\SprintSV.exe"=
"c:\\Program Files\\Alarm\\Alarm.exe"=
"c:\\Program Files\\HP\\hpcoretech\\hpcmpmgr.exe"=
"c:\\Program Files\\Common Files\\Adobe\\Updater6\\Adobe_Updater.exe"=
"c:\\Program Files\\Verizon Online\\bin\\mpbtn.exe"=
"c:\\WINDOWS\\system32\\hkcmd.exe"=
"c:\\WINDOWS\\system32\\igfxtray.exe"=
"c:\\Program Files\\QuickTime\\qttask.exe"=
"c:\\Program Files\\vghd\\VirtuaGirl_downloader.exe"=
"c:\\PROGRA~1\\VERIZO~1\\SMARTB~1\\MotiveSB.exe"=
"c:\\DOCUME~1\\STEFVE~1\\LOCALS~1\\Temp\\axmx.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [01/18/2010 2:34 PM 64288]
R2 ISWKL;ZoneAlarm ForceField ISWKL;c:\program files\CheckPoint\ZAForceField\ISWKL.sys [10/14/2009 8:30 AM 25208]
R2 IswSvc;ZoneAlarm ForceField IswSvc;c:\program files\CheckPoint\ZAForceField\ISWSVC.exe [10/14/2009 8:30 AM 476528]
R3 AlarmClockMonitor;Talking Alarm Clock user logon monitor;c:\program files\Alarm\AlarmMonitor.exe [09/15/2004 12:30 PM 246184]
R3 Avgfwdx;Avgfwdx;c:\windows\system32\drivers\avgfwdx.sys [01/14/2010 6:57 PM 30104]
S1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [06/15/2009 6:41 AM 327688]
S2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe –> c:\progra~1\AVG\AVG8\avgwdsvc.exe [?]
S3 Avgfwfd;AVG network filter service;c:\windows\system32\drivers\avgfwdx.sys [01/14/2010 6:57 PM 30104]
S4 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;"c:\program files\Lavasoft\Ad-Aware\AAWService.exe" –> c:\program files\Lavasoft\Ad-Aware\AAWService.exe [?]

— Other Services/Drivers In Memory —

*NewlyCreated* - ASC3360PR
.
.
——- Supplementary Scan ——-
.
uLocal Page = \blank.htm
uStart Page = hxxp://my.yahoo.com/
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/wdgt3/*http://www.yahoo.com/ext/search/search.html
uInternet Connection Wizard,ShellNext = hxxp://cgi.verizon.net/bookmarks/bmredir.asp?region=all&bw=dsl&cd=6.1&bm=ms_welcome
uInternet Settings,ProxyOverride = 127.0.0.1;localhost
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/wdgt3/*http://www.yahoo.com
IE: &Yahoo! Search - file:///c:\program files\Yahoo!\Common/ycsrch.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: Yahoo! &Dictionary - file:///c:\program files\Yahoo!\Common/ycdict.htm
IE: Yahoo! &Maps - file:///c:\program files\Yahoo!\Common/ycmap.htm
IE: Yahoo! &SMS - file:///c:\program files\Yahoo!\Common/ycsms.htm
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
.
- - - - ORPHANS REMOVED - - - -

BHO-{28CAEFF3-0F18-4036-B504-51D73BD81ABC} - REG_SZ

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-23 13:26
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
———————— Other Running Processes ————————
.
c:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exe
c:\program files\Alarm\Alarm Tray.exe
c:\program files\Yahoo!\Widgets\YahooWidgets.exe
c:\program files\Verizon Online\bin\mpbtn.exe
c:\program files\vghd\VirtuaGirl_downloader.exe
c:\program files\Yahoo!\Widgets\YahooWidgets.exe
c:\docume~1\STEFVE~1\LOCALS~1\Temp\axmx.exe
c:\program files\Java\jre1.5.0_06\bin\jucheck.exe
.
**************************************************************************
.
Completion time: 2010-01-23 13:41:15 - machine was rebooted
ComboFix-quarantined-files.txt 2010-01-23 18:41
ComboFix2.txt 2010-01-23 17:15

Pre-Run: 36,080,824,320 bytes free
Post-Run: 36,029,489,152 bytes free

- - End Of File - - A090F5D84F21CF7C889D6922CF6D5C99

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:43:27 PM, on 01/23/2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\VERIZO~1\SMARTB~1\MotiveSB.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Alarm\Alarm Tray.exe
C:\Program Files\Alarm\AlarmMonitor.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe
C:\Program Files\Verizon Online\bin\mpbtn.exe
C:\Program Files\vghd\VirtuaGirl_downloader.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe
C:\DOCUME~1\STEFVE~1\LOCALS~1\Temp\axmx.exe
C:\Program Files\Java\jre1.5.0_06\bin\jucheck.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://cgi.verizon.net/bookmarks/bmredir.a…p;bm=ms_welcome
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn7\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn7\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: ZoneAlarm Toolbar Registrar - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn7\YTSingleInstance.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn7\yt.dll
O3 - Toolbar: ZoneAlarm Toolbar - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\VERIZO~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Show missed alarms] C:\Program Files\Alarm\Alarm.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Sprint SmartView] "C:\Program Files\Sprint\Sprint SmartView\SprintSV.exe" -a
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - Startup: DesktopVideoPlayer.LNK = C:\Program Files\vghd\vghd.exe
O4 - Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE
O4 - Startup: PowerToChange.lnk = C:\Program Files\PowerToChange\PowerToChange.exe
O4 - Startup: Yahoo! Widgets.lnk = C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe
O4 - Global Startup: Event Reminder.lnk = C:\Program Files\The Print Shop 23\Remind.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Verizon Online Support Center.lnk = C:\Program Files\Verizon Online\bin\matcli.exe
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: Yahoo! Klondike Solitaire - http://presence.games.yahoo.com/yog/y/ks12_x.cab
O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} (Citrix ICA Client) - http://a516.g.akamai.net/f/516/25175/7d/ru…cat-no-eula.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1111030080892
O16 - DPF: {ED28050F-D713-43BA-A376-DCC5C35407D5} (MsnMusicAx Class) - https://music.msn.com/client/msnmusax3024.cab
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: Talking Alarm Clock user logon monitor (AlarmClockMonitor) - Cinnamon Software Inc. - C:\Program Files\Alarm\AlarmMonitor.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - Unknown owner - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: ZoneAlarm ForceField IswSvc (IswSvc) - Check Point Software Technologies - C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe
O23 - Service: Sprint RcAppSvc (SprintRcAppSvc) - PCTEL - C:\Program Files\Sprint\Sprint SmartView\RcAppSvc.exe
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
O24 - Desktop Component 0: (no name) - http://www.vanermengem.com/img/paris/kvefr0291s.jpg

–
End of file - 9354 bytes

Grazie~

LDTate

Post #10January 23, 2010, 7:00 PM UTC

File::
c:\program files\55lt3stm\55lt3stm.dll 
c:\DOCUME~1\\STEFVE~1\LOCALS~1\Temp\axmx.exe

Folder::
c:\program files\55lt3stm
c:\program files\vghd
c:\program files\Viewpoint

billiesdead

Post #11January 23, 2010, 7:10 PM UTC last edited January 23, 2010, 7:11 PM UTC

I got an alert when I tried to drag the txt doc to the combo fix icon. It says:

"!!Alert!! It is not safe to continue.
The contents of the combofix package have been compromised.
Please download a fresh copy from
http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Note you may be infected with a file patching virus "virut"

and there is only an "ok" button.

(I haven't clicked or closed it yet, I'll stand by)

LDTate

Post #12January 23, 2010, 7:14 PM UTC last edited January 23, 2010, 7:16 PM UTC

Delete
File::
c:\program files\55lt3stm\55lt3stm.dll
c:\DOCUME~1\\STEFVE~1\LOCALS~1\Temp\axmx.exe

Use add/remove programs and remove these if listed. If not listed then go to the folder and delete it.
c:\program files\55lt3stm
c:\program files\vghd
c:\program files\Viewpoint

Try Combofix again

billiesdead

Post #13January 23, 2010, 8:08 PM UTC

Reloaded ComboFix…internet running pretty fast now. still cannot access tsk manager.
-Grtefully

ComboFix 10-01-23.02 - Stefven Eiffel Poet 01/23/2010 14:29:52.4.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.222.97 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Stefven Eiffel Poet\Desktop\CFScript.txt
AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
AV: Lavasoft Ad-Watch Live! Anti-Virus *On-access scanning enabled* (Updated) {A1C4F2E0-7FDE-4917-AFAE-013EFC3EDE33}

FILE ::
"c:\docume~1\\STEFVE~1\LOCALS~1\Temp\axmx.exe"
"c:\program files\55lt3stm\55lt3stm.dll"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_ASC3360PR

((((((((((((((((((((((((( Files Created from 2009-12-23 to 2010-01-23 )))))))))))))))))))))))))))))))
.

2010-01-20 03:29 . 2010-01-20 03:29 ——– d—–w- c:\documents and settings\Stefven Eiffel Poet\Application Data\Malwarebytes
2010-01-20 03:28 . 2010-01-07 21:07 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-20 03:28 . 2010-01-20 03:28 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-01-20 03:28 . 2010-01-20 03:29 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-01-20 03:28 . 2010-01-07 21:07 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-01-20 03:23 . 2010-01-20 03:23 ——– d—–w- c:\program files\ERUNT
2010-01-20 03:09 . 2010-01-20 03:09 ——– d—–w- c:\documents and settings\Stefven Eiffel Poet\Local Settings\Application Data\PCHealth
2010-01-20 02:43 . 2010-01-20 02:43 21504 —-a-w- C:\SysRestorePoint.exe
2010-01-20 01:59 . 2010-01-20 01:59 ——– d—–w- c:\program files\Trend Micro
2010-01-19 15:11 . 2010-01-19 15:11 2029800 —-a-w- c:\documents and settings\Stefven Eiffel Poet\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\fpupdateax\fpupdateax.exe
2010-01-18 22:46 . 2009-12-02 13:19 15880 —-a-w- c:\windows\system32\lsdelete.exe
2010-01-18 19:34 . 2009-12-02 13:19 64288 —-a-w- c:\windows\system32\drivers\Lbd.sys
2010-01-18 19:10 . 2010-01-18 19:33 ——– d—–w- c:\documents and settings\All Users\Application Data\Lavasoft
2010-01-18 19:10 . 2010-01-18 19:10 ——– d—–w- c:\program files\Lavasoft
2010-01-17 17:40 . 2010-01-17 17:40 128 —-a-w- c:\windows\system32\pdfl.dat
2010-01-17 17:40 . 2010-01-17 17:40 80 —-a-w- c:\windows\system32\ibfl.dat
2010-01-17 17:39 . 2009-10-17 05:39 72584 —-a-w- c:\windows\zllsputility.exe
2010-01-17 17:39 . 2009-10-12 23:15 128016 —-a-w- c:\windows\system32\drivers\kl1.sys
2010-01-17 17:32 . 2009-10-17 05:39 103816 —-a-w- c:\windows\system32\zlcommdb.dll
2010-01-17 17:32 . 2009-10-17 05:39 69000 —-a-w- c:\windows\system32\zlcomm.dll
2010-01-17 17:28 . 2009-10-17 05:39 1238408 —-a-w- c:\windows\system32\zpeng25.dll
2010-01-17 17:28 . 2010-01-17 17:40 ——– d—–w- c:\windows\system32\ZoneLabs
2010-01-17 17:27 . 2010-01-17 17:27 ——– d—–w- c:\program files\Zone Labs
2010-01-17 17:23 . 2010-01-19 02:05 ——– d—–w- c:\windows\Internet Logs
2010-01-17 16:48 . 2010-01-17 16:48 ——– d—–w- c:\documents and settings\All Users\Application Data\ZA_PreservedFiles
2010-01-17 03:17 . 2010-01-17 03:17 144 —-a-w- c:\windows\system32\lkfl.dat
2010-01-17 03:17 . 2010-01-17 17:40 ——– d—–w- c:\program files\CheckPoint
2010-01-17 03:16 . 2010-01-17 17:39 4212 —ha-w- c:\windows\system32\zllictbl.dat
2010-01-16 17:55 . 2010-01-18 14:41 ——– d—–w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-01-16 15:30 . 2010-01-17 22:33 ——– d—–w- c:\program files\CA Yahoo! Anti-Spy
2010-01-14 23:57 . 2010-01-14 23:57 50968 —-a-w- c:\windows\system32\avgfwdx.dll
2010-01-14 23:57 . 2010-01-14 23:57 30104 —-a-w- c:\windows\system32\drivers\avgfwdx.sys
2010-01-14 23:56 . 2010-01-15 00:07 ——– d—–w- c:\windows\SxsCaPendDel
2010-01-14 23:06 . 2010-01-14 23:06 ——– d—–w- c:\documents and settings\Stefven Eiffel Poet\Application Data\AVG8
2010-01-12 02:49 . 2010-01-12 02:49 ——– d—–w- c:\documents and settings\Stefven Eiffel Poet\Local Settings\Application Data\Broderbund Software
2010-01-12 02:49 . 2010-01-12 02:49 ——– d—–w- c:\documents and settings\All Users\Application Data\Broderbund Software
2010-01-12 02:47 . 2010-01-15 00:46 ——– d—–w- c:\program files\Web Publish
2010-01-12 02:46 . 2008-05-15 19:19 3715072 —-a-w- c:\windows\system32\cdintf300.dll
2010-01-12 02:38 . 2010-01-12 02:40 ——– d—–w- c:\program files\Common Files\Broderbund
2010-01-12 02:38 . 2010-01-12 02:49 ——– d—–w- c:\program files\The Print Shop 23
2009-12-29 04:04 . 2009-12-29 04:04 ——– d—–w- c:\documents and settings\All Users\Application Data\McAfee
2009-12-27 04:03 . 2009-12-27 04:03 ——– d—–w- c:\documents and settings\All Users\Application Data\McAfee Security Scan
2009-12-27 04:03 . 2010-01-03 16:44 ——– d—–w- c:\program files\McAfee Security Scan

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-23 18:27 . 2009-09-12 21:06 7 —-a-w- c:\windows\sbacknt.bin
2010-01-23 13:32 . 2009-06-15 11:39 ——– d—–w- c:\documents and settings\All Users\Application Data\avg8
2010-01-20 04:14 . 2007-02-06 21:39 349232 -c–a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.3\inst.exe
2010-01-18 20:22 . 2009-10-01 15:09 12521888 —-a-w- c:\documents and settings\Stefven Eiffel Poet\Application Data\vghd\Data\update\updater.exe
2010-01-17 16:33 . 2005-06-03 04:58 ——– d—–w- c:\documents and settings\All Users\Application Data\Viewpoint
2010-01-17 16:33 . 2007-04-09 00:34 ——– d—–w- c:\program files\Free Internet Window Washer
2010-01-16 15:30 . 2005-04-23 01:59 ——– d—–w- c:\program files\Common Files\Scanner
2010-01-16 15:27 . 2005-08-08 01:52 ——– d—–w- c:\documents and settings\All Users\Application Data\Yahoo! Companion
2010-01-16 15:27 . 2005-04-30 13:39 ——– d–h–r- c:\documents and settings\All Users\Application Data\yahoo!
2010-01-16 15:27 . 2005-03-17 02:04 ——– d—–w- c:\program files\Yahoo!
2010-01-16 15:26 . 2005-03-30 13:32 ——– d—–w- c:\documents and settings\Stefven Eiffel Poet\Application Data\Yahoo!
2010-01-14 23:59 . 2009-06-15 11:39 ——– d—–w- c:\program files\AVG
2010-01-12 02:51 . 2005-03-17 01:03 365952 -c–a-w- c:\documents and settings\Stefven Eiffel Poet\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-01-03 16:41 . 2009-02-23 00:16 ——– d—–w- c:\program files\Creative
2009-12-29 15:54 . 2009-05-27 19:47 ——– d—–w- c:\program files\Microsoft Silverlight
2009-12-24 01:17 . 2009-12-24 15:22 52224 —-a-w- c:\documents and settings\Stefven Eiffel Poet\Application Data\Mozilla\Firefox\Profiles\eaten3dd.default\extensions\{90c39cb5-4269-45fb-9e41-7a2e5c34995b}\components\FFExternalAlert.dll
2009-12-24 01:17 . 2009-12-24 15:22 101376 —-a-w- c:\documents and settings\Stefven Eiffel Poet\Application Data\Mozilla\Firefox\Profiles\eaten3dd.default\extensions\{90c39cb5-4269-45fb-9e41-7a2e5c34995b}\components\RadioWMPCore.dll
2009-02-28 02:45 . 2009-02-28 02:45 0 -c–a-w- c:\program files\temp01
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"Motive SmartBridge"="c:\progra~1\VERIZO~1\SMARTB~1\MotiveSB.exe" [2002-05-18 401408]
"HP Component Manager"="c:\program files\HP\hpcoretech\hpcmpmgr.exe" [2010-01-19 315392]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2003-10-30 225280]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2003-10-30 188416]
"Show missed alarms"="c:\program files\Alarm\Alarm.exe" [2010-01-19 307624]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-03-04 225280]
"SunJavaUpdateSched"="c:\program files\Java\jre1.5.0_06\bin\jusched.exe" [2005-11-10 36975]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2005-02-17 49152]
"Sprint SmartView"="c:\program files\Sprint\Sprint SmartView\SprintSV.exe" [2008-08-04 18968]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-01-19 137072]
"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2009-10-17 1106824]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2010-01-19 504160]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Event Reminder.lnk - c:\program files\The Print Shop 23\Remind.exe [2008-7-16 421888]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2003-9-16 237568]
Verizon Online Support Center.lnk - c:\program files\Verizon Online\bin\matcli.exe [2005-3-16 282624]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"= 1 (0x1)
"DisableRegistryTools"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-06-15 11:41 11952 —-a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001
"FirewallDisableNotify"=dword:00000001
"FirewallOverride"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"UacDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Alarm\\Alarm Tray.exe"=
"c:\\Program Files\\Yahoo!\\Widgets\\YahooWidgets.exe"=
"c:\\Program Files\\Sprint\\Sprint SmartView\\SprintSV.exe"=
"c:\\Program Files\\Alarm\\Alarm.exe"=
"c:\\Program Files\\HP\\hpcoretech\\hpcmpmgr.exe"=
"c:\\Program Files\\Common Files\\Adobe\\Updater6\\Adobe_Updater.exe"=
"c:\\Program Files\\Verizon Online\\bin\\mpbtn.exe"=
"c:\\WINDOWS\\system32\\hkcmd.exe"=
"c:\\WINDOWS\\system32\\igfxtray.exe"=
"c:\\Program Files\\QuickTime\\qttask.exe"=
"c:\\PROGRA~1\\VERIZO~1\\SMARTB~1\\MotiveSB.exe"=
"c:\\WINDOWS\\system32\\wuauclt.exe"=
"c:\\DOCUME~1\\STEFVE~1\\LOCALS~1\\Temp\\uuej.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [01/18/2010 2:34 PM 64288]
R2 ISWKL;ZoneAlarm ForceField ISWKL;c:\program files\CheckPoint\ZAForceField\ISWKL.sys [10/14/2009 8:30 AM 25208]
R2 IswSvc;ZoneAlarm ForceField IswSvc;c:\program files\CheckPoint\ZAForceField\ISWSVC.exe [10/14/2009 8:30 AM 476528]
R3 AlarmClockMonitor;Talking Alarm Clock user logon monitor;c:\program files\Alarm\AlarmMonitor.exe [09/15/2004 12:30 PM 246184]
R3 asc3360pr;asc3360pr;\??\c:\windows\system32\drivers\lkkphm.sys –> c:\windows\system32\drivers\lkkphm.sys [?]
R3 Avgfwdx;Avgfwdx;c:\windows\system32\drivers\avgfwdx.sys [01/14/2010 6:57 PM 30104]
S1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [06/15/2009 6:41 AM 327688]
S2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe –> c:\progra~1\AVG\AVG8\avgwdsvc.exe [?]
S3 Avgfwfd;AVG network filter service;c:\windows\system32\drivers\avgfwdx.sys [01/14/2010 6:57 PM 30104]
S4 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;"c:\program files\Lavasoft\Ad-Aware\AAWService.exe" –> c:\program files\Lavasoft\Ad-Aware\AAWService.exe [?]

— Other Services/Drivers In Memory —

*NewlyCreated* - ASC3360PR
.
.
——- Supplementary Scan ——-
.
uLocal Page = \blank.htm
uStart Page = hxxp://my.yahoo.com/
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/wdgt3/*http://www.yahoo.com/ext/search/search.html
uInternet Connection Wizard,ShellNext = hxxp://cgi.verizon.net/bookmarks/bmredir.asp?region=all&bw=dsl&cd=6.1&bm=ms_welcome
uInternet Settings,ProxyOverride = 127.0.0.1;localhost
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/wdgt3/*http://www.yahoo.com
IE: &Yahoo! Search - file:///c:\program files\Yahoo!\Common/ycsrch.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: Yahoo! &Dictionary - file:///c:\program files\Yahoo!\Common/ycdict.htm
IE: Yahoo! &Maps - file:///c:\program files\Yahoo!\Common/ycmap.htm
IE: Yahoo! &SMS - file:///c:\program files\Yahoo!\Common/ycsms.htm
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
.
- - - - ORPHANS REMOVED - - - -

BHO-{28CAEFF3-0F18-4036-B504-51D73BD81ABC} - REG_SZ
AddRemove-ViewpointMediaPlayer - c:\program files\Viewpoint\Viewpoint Media Player\mtsAxInstaller.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-23 14:43
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
———————— Other Running Processes ————————
.
c:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exe
c:\program files\Alarm\Alarm Tray.exe
c:\program files\Yahoo!\Widgets\YahooWidgets.exe
c:\program files\Verizon Online\bin\mpbtn.exe
c:\program files\Yahoo!\Widgets\YahooWidgets.exe
c:\docume~1\STEFVE~1\LOCALS~1\Temp\uuej.exe
c:\program files\Java\jre1.5.0_06\bin\jucheck.exe
.
**************************************************************************
.
Completion time: 2010-01-23 14:56:12 - machine was rebooted
ComboFix-quarantined-files.txt 2010-01-23 19:56
ComboFix2.txt 2010-01-23 18:41
ComboFix3.txt 2010-01-23 17:15

Pre-Run: 36,014,002,176 bytes free
Post-Run: 35,933,741,056 bytes free

- - End Of File - - 89C1D3E7D5C3663F137E0EFE673D1EBE

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:01:42 PM, on 01/23/2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\VERIZO~1\SMARTB~1\MotiveSB.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Alarm\Alarm Tray.exe
C:\Program Files\Alarm\AlarmMonitor.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe
C:\Program Files\Verizon Online\bin\mpbtn.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe
C:\DOCUME~1\STEFVE~1\LOCALS~1\Temp\uuej.exe
C:\Program Files\Java\jre1.5.0_06\bin\jucheck.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://cgi.verizon.net/bookmarks/bmredir.a…p;bm=ms_welcome
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn7\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn7\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: ZoneAlarm Toolbar Registrar - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn7\YTSingleInstance.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn7\yt.dll
O3 - Toolbar: ZoneAlarm Toolbar - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\VERIZO~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Show missed alarms] C:\Program Files\Alarm\Alarm.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Sprint SmartView] "C:\Program Files\Sprint\Sprint SmartView\SprintSV.exe" -a
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - Startup: DesktopVideoPlayer.LNK = C:\Program Files\vghd\vghd.exe
O4 - Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE
O4 - Startup: PowerToChange.lnk = C:\Program Files\PowerToChange\PowerToChange.exe
O4 - Startup: Yahoo! Widgets.lnk = C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe
O4 - Global Startup: Event Reminder.lnk = C:\Program Files\The Print Shop 23\Remind.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Verizon Online Support Center.lnk = C:\Program Files\Verizon Online\bin\matcli.exe
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: Yahoo! Klondike Solitaire - http://presence.games.yahoo.com/yog/y/ks12_x.cab
O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} (Citrix ICA Client) - http://a516.g.akamai.net/f/516/25175/7d/ru…cat-no-eula.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1111030080892
O16 - DPF: {ED28050F-D713-43BA-A376-DCC5C35407D5} (MsnMusicAx Class) - https://music.msn.com/client/msnmusax3024.cab
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: Talking Alarm Clock user logon monitor (AlarmClockMonitor) - Cinnamon Software Inc. - C:\Program Files\Alarm\AlarmMonitor.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - Unknown owner - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: ZoneAlarm ForceField IswSvc (IswSvc) - Check Point Software Technologies - C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe
O23 - Service: Sprint RcAppSvc (SprintRcAppSvc) - PCTEL - C:\Program Files\Sprint\Sprint SmartView\RcAppSvc.exe
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
O24 - Desktop Component 0: (no name) - http://www.vanermengem.com/img/paris/kvefr0291s.jpg

–
End of file - 9338 bytes

LDTate

Post #14January 23, 2010, 8:25 PM UTC

C:\DOCUME~1\STEFVE~1\LOCALS~1\Temp\uuej.exe

Notice how a temp file is getting recreated everytime we remove one?

Go to:
C:\DOCUME~1\STEFVE~1\LOCALS~1\Temp <–Delete everything in there.

Taskmanager:

Open a run box (windows key + R) > copy/paste the following command into the run box > OK

reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t Reg_dword /d 0 /f

This should enable your Task Manager.

Re-run this command as often as you need to if the malware disables it again.

This should enable your task manager for you:

billiesdead

Post #15January 23, 2010, 9:00 PM UTC last edited January 23, 2010, 9:11 PM UTC

I deleted some of it, but not the following: access denied: uuej.exe winlrlk.exe and AAX3.tmp program in use: mpa03060.dcr and ~df6.tmp The code works for about one second with task manager, but malware closes it before I can end some process.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Trojans and Annoyances

✨ Ask AI

Ask AI