Spyware / Malware / Virus Removal

Pesky Virus - Need help to be sure it is removed

2 min read

Looking for the outcome? Ask AI

3streamMusic Topic Starter

Post #1March 12, 2010, 6:35 AM UTC last edited March 12, 2010, 4:57 PM UTC

NOTE* - THIS IS A DIFFERENT MACHINE THAN THE ONE I AM CURRENTLY BEING ASSISTED WITH
I have been dealing with a virus and have used Malwarebytes and ComboFix a few times. At one time the CPU was pegged at 100% and my wireless adapter stopped working. The computer has been cleaned up a little, but some evidence of a virus still exists - Firefox was mysteriously uninstalled
Here is my HiJack This log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:31:53 AM, on 3/12/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16981)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
c:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe
C:\Program Files\Linksys\Linksys Wireless Manager\LinksysWirelessManager.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.thirdstreammusic.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
N4 - Mozilla: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\ERIN\Application Data\Mozilla\Profiles\default\9p23sfhy.slt\prefs.js)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: STOPzilla Browser Helper Object - {E3215F20-3212-11D6-9F8B-00D0B743919D} - C:\Program Files\STOPzilla!\SZIEBHO.dll
O3 - Toolbar: HP view - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll
O4 - HKLM\..\Run: [nmctxth] "C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe"
O4 - HKLM\..\Run: [Linksys Wireless Manager] "C:\Program Files\Linksys\Linksys Wireless Manager\LinksysWirelessManager.exe" /cm /min /lcid 1033
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/ractrl.cab?lmi=100
O16 - DPF: {FF1CD9A3-00CD-45C1-8182-4EEC229A182D} (Plaxo Auto-Import Utility) - https://www.plaxo.com/activex/plx_upldr-2k-xp.cab
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: ANIWZCSd Service (ANIWZCSdService) - Alpha Networks Inc. - C:\Program Files\ANI\ANIWZCS2 Service\ANIWZCSdS.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Unknown owner - C:\Program Files\Bonjour\mDNSResponder.exe (file missing)
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Macromedia Licensing Service - Macromedia - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Pure Networks Platform Service (nmservice) - Cisco Systems, Inc. - C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: STOPzilla Service (szserver) - iS3, Inc. - C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe

–
End of file - 5081 bytes

Malwarebytes log:

Malwarebytes' Anti-Malware 1.44
Database version: 3510
Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.13

3/12/2010 1:48:21 AM
mbam-log-2010-03-12 (01-48-21).txt

Scan type: Quick Scan
Objects scanned: 127257
Time elapsed: 11 minute(s), 19 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\system32\drivers\9eed3a1f4b5b29720fd7887c2b18d1ff.szcpf (Rootkit.Agent) -> Quarantined and deleted successfully.

LDTate

Post #2March 12, 2010, 7:59 PM UTC

C:\WINDOWS\system32\drivers\9eed3a1f4b5b29720fd7887c2b18d1ff.szcpf (Rootkit.Agent) Looks like you have the same Rootkit on both pc's now. Post the combofix scan results.

3streamMusic

Post #3March 13, 2010, 12:55 AM UTC

ComboFix 10-03-12.02 - Erin 03/12/2010 19:42:59.5.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.503.16 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
.

((((((((((((((((((((((((( Files Created from 2010-02-13 to 2010-03-13 )))))))))))))))))))))))))))))))
.

2010-03-12 08:01 . 2010-03-12 08:01 ——– d—–w- c:\windows\LastGood
2010-03-12 00:11 . 2009-10-23 15:28 3558912 -c—-w- c:\windows\system32\dllcache\moviemk.exe
2010-03-12 00:08 . 2010-03-12 00:08 ——– d—–w- c:\program files\Linksys
2010-03-12 00:08 . 2008-12-12 23:05 23984 —-a-w- c:\windows\system32\drivers\pnarp.sys
2010-03-12 00:08 . 2008-12-12 23:05 25264 —-a-w- c:\windows\system32\drivers\purendis.sys
2010-03-12 00:07 . 2010-03-12 00:07 ——– d—–w- c:\program files\Common Files\Pure Networks Shared
2010-03-12 00:07 . 2010-03-12 00:07 ——– d—–w- c:\documents and settings\All Users\Application Data\Pure Networks
2010-03-12 00:05 . 2008-12-04 13:17 627072 —-a-r- c:\windows\system32\drivers\WUSB54GCv3.sys
2010-03-12 00:05 . 2008-12-04 13:17 221184 —-a-w- c:\windows\system32\RaCoInst.dll
2010-03-12 00:05 . 2008-12-04 13:17 15312 —-a-r- c:\windows\system32\RaCoInst.dat
2010-03-10 20:00 . 2010-03-10 20:00 ——– d—–w- c:\documents and settings\Erin\Application Data\Malwarebytes
2010-03-10 20:00 . 2010-01-07 21:07 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-03-10 20:00 . 2010-03-10 20:00 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-03-10 20:00 . 2010-03-10 20:00 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-03-10 20:00 . 2010-01-07 21:07 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-03-10 19:52 . 2007-06-14 20:53 700416 —-a-w- c:\windows\system32\BCMLogon.dll
2010-03-02 18:32 . 2010-03-02 18:32 1740800 —ha-w- C:\SZKGFS.dat
2010-02-27 19:57 . 2010-02-27 19:57 ——– d—–w- c:\program files\STOPzilla!
2010-02-14 23:59 . 2010-02-14 23:59 ——– d—–w- c:\program files\Trend Micro
2010-02-13 21:38 . 2010-02-13 21:38 1152 —-a-w- c:\windows\system32\windrv.sys
2010-02-13 18:14 . 2010-02-13 21:38 ——– d—–w- c:\documents and settings\Erin\Application Data\GetRightToGo
2010-02-13 02:59 . 2010-02-13 02:59 ——– d—–w- c:\documents and settings\All Users\Application Data\SITEguard
2010-02-13 02:58 . 2010-02-13 02:58 ——– d—–w- c:\program files\Common Files\iS3
2010-02-13 02:58 . 2010-03-13 00:48 ——– d—–w- c:\documents and settings\All Users\Application Data\STOPzilla!
2010-02-13 02:48 . 2004-10-22 01:06 45056 —-a-r- c:\documents and settings\Administrator\Application Data\Microsoft\Installer\{457791C5-D702-4143-A7B2-2744BE9573F2}\NewShortcut1_5B69D3033CA54B39B5ECE7D051297E77.exe
2010-02-13 02:48 . 2004-10-22 02:30 128 —-a-w- c:\documents and settings\Administrator\Local Settings\Application Data\fusioncache.dat
2010-02-12 21:33 . 2010-03-11 23:56 0 —-a-w- c:\windows\Jrukuja.bin
2010-02-12 21:33 . 2010-03-02 18:26 120 —-a-w- c:\windows\Wzeje.dat

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-13 00:43 . 2010-03-13 00:42 1816 —-a-w- c:\windows\system32\drivers\kgpfr2.cfg
2010-03-13 00:43 . 2010-03-12 06:57 2368 —-a-w- c:\windows\system32\drivers\kgpcpy.cfg
2010-03-12 05:32 . 2005-04-22 23:00 39860 —-a-w- c:\documents and settings\Erin\Application Data\wklnhst.dat
2010-03-12 00:11 . 2010-03-12 00:11 20 —-a-w- c:\windows\system32\config\systemprofile\Application Data\rbuwzv.dat
2010-03-10 19:52 . 2004-10-22 01:46 ——– d–h–w- c:\program files\InstallShield Installation Information
2010-03-01 03:15 . 2010-03-01 03:15 24 —-a-w- c:\documents and settings\NetworkService\Application Data\rbuwzv.dat
2010-02-27 01:08 . 2010-02-27 01:08 28 —-a-w- c:\documents and settings\NetworkService\Application Data\sgcpom.dat
2010-02-27 01:08 . 2010-02-27 01:08 28 —-a-w- c:\documents and settings\NetworkService\Application Data\cqfyto.dat
2010-02-22 04:17 . 2010-02-22 04:17 24 —-a-w- c:\windows\system32\config\systemprofile\Application Data\cqfyto.dat
2010-02-13 02:59 . 2010-02-13 02:59 24 —-a-w- c:\documents and settings\LocalService\Application Data\sgcpom.dat
2010-02-12 21:29 . 2010-02-12 21:29 24 —-a-w- c:\windows\system32\config\systemprofile\Application Data\sgcpom.dat
2010-02-04 16:21 . 2010-02-04 16:21 17408 —-a-r- c:\windows\system32\SZIO5.dll
2010-02-04 16:19 . 2010-02-04 16:19 442368 —-a-r- c:\windows\system32\SZBase5.dll
2010-02-04 16:18 . 2010-02-04 16:18 540672 —-a-r- c:\windows\system32\SZComp5.dll
2010-01-27 15:19 . 2010-01-27 15:19 167312 —-a-r- c:\windows\system32\drivers\SZKGFS.sys
2010-01-05 10:00 . 2004-11-11 00:34 832512 ——w- c:\windows\system32\wininet.dll
2010-01-05 10:00 . 2004-11-11 00:32 78336 —-a-w- c:\windows\system32\ieencode.dll
2010-01-05 10:00 . 2004-11-11 01:22 17408 —-a-w- c:\windows\system32\corpol.dll
2009-12-31 16:50 . 2004-11-11 00:33 353792 —-a-w- c:\windows\system32\drivers\srv.sys
2009-12-16 18:43 . 2004-11-11 00:32 343040 —-a-w- c:\windows\system32\mspaint.exe
2009-12-14 07:08 . 2004-11-11 00:31 33280 —-a-w- c:\windows\system32\csrsrv.dll
.

((((((((((((((((((((((((((((( SnapShot@2010-03-12_00.59.32 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-03-18 03:29 . 2008-07-08 13:02 17272 c:\windows\system32\spmsg.dll
- 2009-03-18 03:29 . 2009-05-26 11:40 17272 c:\windows\system32\spmsg.dll
+ 2010-03-12 01:17 . 2010-03-12 01:00 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2010-03-12 01:17 . 2010-03-12 01:00 16384 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2010-03-12 01:17 . 2010-03-12 01:00 16384 c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2005-05-12 16:24 . 2010-03-02 05:30 31648712 c:\windows\system32\MRT.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nmctxth"="c:\program files\Common Files\Pure Networks Shared\Platform\nmctxth.exe" [2008-12-12 642856]
"Linksys Wireless Manager"="c:\program files\Linksys\Linksys Wireless Manager\LinksysWirelessManager.exe" [2009-02-16 1358384]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak EasyShare software.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk
backup=c:\windows\pss\Kodak EasyShare software.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak software updater.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Kodak software updater.lnk
backup=c:\windows\pss\Kodak software updater.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Erin^Start Menu^Programs^Startup^netuza32.exe]
path=c:\documents and settings\Erin\Start Menu\Programs\Startup\netuza32.exe
backup=c:\windows\pss\netuza32.exeStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Erin^Start Menu^Programs^Startup^winesm32.exe]
path=c:\documents and settings\Erin\Start Menu\Programs\Startup\winesm32.exe
backup=c:\windows\pss\winesm32.exeStartup

[HKLM\~\startupfolder\C:^Documents and Settings^HP_Owner^Start Menu^Programs^Startup^Adobe Gamma.lnk]
path=c:\documents and settings\HP_Owner\Start Menu\Programs\Startup\Adobe Gamma.lnk
backup=c:\windows\pss\Adobe Gamma.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^HP_Owner^Start Menu^Programs^Startup^HP Organize.lnk]
path=c:\documents and settings\HP_Owner\Start Menu\Programs\Startup\HP Organize.lnk
backup=c:\windows\pss\HP Organize.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acme.PCHButton]
2004-10-22 02:29 159744 —-a-w- c:\progra~1\HELPAN~1\HPQ\XPXWWPP5\plugin\bin\PCHButton.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AGRSMMSG]
2005-03-04 16:01 88209 —-a-w- c:\windows\AGRSMMSG.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
2005-04-12 05:10 65536 —-a-w- c:\windows\ALCMTR.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcWzrd]
2005-04-06 22:53 2805248 —-a-w- c:\windows\ALCWZRD.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ANIWZCS2Service]
2004-12-16 21:49 49152 —-a-w- c:\program files\ANI\ANIWZCS2 Service\WZCSLDR2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 00:12 15360 ——w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus Photo R220 Series]
2006-12-25 10:00 177664 —-a-w- c:\windows\system32\spool\drivers\w32x86\3\E_FATIAIA.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IndexSearch]
2004-04-14 20:04 40960 —-a-w- c:\program files\ScanSoft\PaperPort\IndexSearch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2009-09-21 20:36 305440 —-a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LSBWatcher]
2004-10-15 04:54 253952 —-a-w- c:\hp\drivers\hplsbwatcher\LSBurnWatcher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 00:12 1695232 —-a-w- c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PaperPort PTD]
2004-04-14 19:46 57393 —-a-w- c:\program files\ScanSoft\PaperPort\pptd40nt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-09-05 05:54 417792 —-a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Reminder]
2003-12-18 07:31 118784 —-a-w- c:\windows\CREATOR\Remind_XP.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SmileboxTray]
2009-05-12 20:33 266888 —-a-w- c:\documents and settings\Erin\Application Data\Smilebox\SmileboxTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
2005-04-06 22:57 90112 —-a-w- c:\windows\SOUNDMAN.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSBkgdUpdate]
2003-10-14 15:22 155648 —-a-r- c:\program files\Common Files\ScanSoft Shared\SSBkgdUpdate\SSBkgdUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2004-10-22 00:27 32881 —-a-w- c:\program files\Java\j2re1.4.2_03\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Symantec NetDriver Monitor]
2006-01-04 13:55 100056 —-a-w- c:\progra~1\SYMNET~1\SNDMon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2004-10-22 01:39 180269 —-a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdateManager]
2003-08-19 15:01 110592 —-a-w- c:\program files\Common Files\Sonic\Update Manager\sgtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"KodakCCS"=2 (0x2)
"Fax"=3 (0x3)
"iPodService"=3 (0x3)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"AGRSMMSG"=AGRSMMSG.exe
"AlcWzrd"=ALCWZRD.EXE
"HotKeysCmds"=c:\windows\system32\hkcmd.exe
"KBD"=c:\hp\KBD\KBD.EXE
"PS2"=c:\windows\system32\ps2.exe
"Symantec NetDriver Monitor"=c:\progra~1\SYMNET~1\SNDMon.exe
"Recguard"=c:\windows\SMINST\RECGUARD.EXE
"AcctMgr"=c:\program files\Norton Password Manager\AcctMgr.exe /startup

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\appcertdlls]
cliphost REG_SZ c:\windows\system32\chkdpgrd.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

R0 szkg5;szkg5;c:\windows\system32\drivers\SZKG.sys [12/7/2009 4:59 PM 61328]
R0 szkgfs;szkgfs;c:\windows\system32\drivers\SZKGFS.sys [1/27/2010 10:19 AM 167312]
R3 WUSB54GCv3;Compact Wireless-G USB Network Adapter;c:\windows\system32\drivers\WUSB54GCv3.sys [3/11/2010 7:05 PM 627072]
S0 is3srv;is3srv;c:\windows\system32\drivers\is3srv.sys [12/7/2009 4:59 PM 61328]
S3 pmxscan;Visioneer USB Kernel;c:\windows\system32\drivers\usbscan.sys [2/12/2005 7:36 PM 15104]
S3 SISNPF;SIS Netgroup Packet Filter;c:\windows\system32\drivers\SISNPF.sys –> c:\windows\system32\drivers\SISNPF.sys [?]
.
Contents of the 'Scheduled Tasks' folder

2010-02-28 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]

2010-03-12 c:\windows\Tasks\Symantec Drmc.job
- c:\program files\Common Files\Symantec Shared\SymDrmc.exe [2003-09-10 09:48]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.thirdstreammusic.com/
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
Trusted Zone: plaxo.com\www
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Erin\Application Data\Mozilla\Firefox\Profiles\oomku7wy.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.3smd.com
FF - plugin: c:\documents and settings\Erin\Application Data\Mozilla\Firefox\Profiles\oomku7wy.default\extensions\[removed]\platform\WINNT_x86-msvc\plugins\npmnqmp071101000055.dll
FF - plugin: c:\program files\Java\j2re1.4.2_03\bin\NPJPI142_03.dll

—- FIREFOX POLICIES —-
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-12 19:48
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(732)
c:\windows\System32\BCMLogon.dll

- - - - - - - > 'explorer.exe'(2180)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2010-03-12 19:52:26
ComboFix-quarantined-files.txt 2010-03-13 00:52
ComboFix2.txt 2010-03-12 01:11
ComboFix3.txt 2010-03-10 23:41
ComboFix4.txt 2010-03-10 22:35
ComboFix5.txt 2010-03-13 00:41

Pre-Run: 126,455,685,120 bytes free
Post-Run: 126,423,195,648 bytes free

- - End Of File - - B4CA2FDEC1008D779616CC2B05833DFB

LDTate

Post #4March 13, 2010, 1:55 AM UTC

Copy/paste the text in the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Take your mouse, and place your cursor at the beginning of the text in the box below, then click and hold the left mouse button, while pulling your mouse over the text. This should highlight the text. Now release the left mouse button. Now, with the cursor over the highlighted text, right click the mouse for options, and select 'copy'. Now over the empty Notepad box, right click your mouse again, and select 'paste' and you will have copied and pasted the text.

File::
c:\windows\Jrukuja.bin
c:\windows\Wzeje.dat
c:\windows\system32\config\systemprofile\Application Data\rbuwzv.dat
c:\documents and settings\NetworkService\Application Data\rbuwzv.dat
c:\documents and settings\NetworkService\Application Data\sgcpom.dat
c:\documents and settings\NetworkService\Application Data\cqfyto.dat
c:\windows\system32\config\systemprofile\Application Data\cqfyto.dat
c:\documents and settings\LocalService\Application Data\sgcpom.dat
c:\windows\system32\config\systemprofile\Application Data\sgcpom.dat
c:\documents and settings\Erin\Start Menu\Programs\Startup\netuza32.exe
c:\windows\pss\netuza32.exe
c:\documents and settings\Erin\Start Menu\Programs\Startup\winesm32.exe
c:\windows\pss\winesm32.exe
c:\windows\system32\chkdpgrd.dll

Registry::
[-HKLM\~\startupfolder\C:^Documents and Settings^Erin^Start Menu^Programs^Startup^netuza32.exe]
[-HKLM\~\startupfolder\C:^Documents and Settings^Erin^Start Menu^Programs^Startup^winesm32.exe]
[-HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\appcertdlls]

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:
1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …

[external image: Posted Image]

Drag CFScript.txt into ComboFix.exe

Then post the results log using Copy / Paste

Also please describe how your computer behaves at the moment.

3streamMusic

Post #5March 13, 2010, 6:40 AM UTC

ComboFix 10-03-12.02 - Erin 03/13/2010 0:45.6.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.503.170 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Erin\Desktop\CFScript.txt

FILE ::
"c:\documents and settings\Erin\Start Menu\Programs\Startup\netuza32.exe"
"c:\documents and settings\Erin\Start Menu\Programs\Startup\winesm32.exe"
"c:\documents and settings\LocalService\Application Data\sgcpom.dat"
"c:\documents and settings\NetworkService\Application Data\cqfyto.dat"
"c:\documents and settings\NetworkService\Application Data\rbuwzv.dat"
"c:\documents and settings\NetworkService\Application Data\sgcpom.dat"
"c:\windows\Jrukuja.bin"
"c:\windows\pss\netuza32.exe"
"c:\windows\pss\winesm32.exe"
"c:\windows\system32\chkdpgrd.dll"
"c:\windows\system32\config\systemprofile\Application Data\cqfyto.dat"
"c:\windows\system32\config\systemprofile\Application Data\rbuwzv.dat"
"c:\windows\system32\config\systemprofile\Application Data\sgcpom.dat"
"c:\windows\Wzeje.dat"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\LocalService\Application Data\sgcpom.dat
c:\documents and settings\NetworkService\Application Data\cqfyto.dat
c:\documents and settings\NetworkService\Application Data\rbuwzv.dat
c:\documents and settings\NetworkService\Application Data\sgcpom.dat
c:\windows\Jrukuja.bin
c:\windows\system32\config\systemprofile\Application Data\cqfyto.dat
c:\windows\system32\config\systemprofile\Application Data\rbuwzv.dat
c:\windows\system32\config\systemprofile\Application Data\sgcpom.dat
c:\windows\Wzeje.dat

.
((((((((((((((((((((((((( Files Created from 2010-02-13 to 2010-03-13 )))))))))))))))))))))))))))))))
.

2010-03-12 08:01 . 2010-03-12 08:01 ——– d—–w- c:\windows\LastGood
2010-03-12 00:11 . 2009-10-23 15:28 3558912 -c—-w- c:\windows\system32\dllcache\moviemk.exe
2010-03-12 00:08 . 2010-03-12 00:08 ——– d—–w- c:\program files\Linksys
2010-03-12 00:08 . 2008-12-12 23:05 23984 —-a-w- c:\windows\system32\drivers\pnarp.sys
2010-03-12 00:08 . 2008-12-12 23:05 25264 —-a-w- c:\windows\system32\drivers\purendis.sys
2010-03-12 00:07 . 2010-03-12 00:07 ——– d—–w- c:\program files\Common Files\Pure Networks Shared
2010-03-12 00:07 . 2010-03-12 00:07 ——– d—–w- c:\documents and settings\All Users\Application Data\Pure Networks
2010-03-12 00:05 . 2008-12-04 13:17 627072 —-a-r- c:\windows\system32\drivers\WUSB54GCv3.sys
2010-03-12 00:05 . 2008-12-04 13:17 221184 —-a-w- c:\windows\system32\RaCoInst.dll
2010-03-12 00:05 . 2008-12-04 13:17 15312 —-a-r- c:\windows\system32\RaCoInst.dat
2010-03-10 20:00 . 2010-03-10 20:00 ——– d—–w- c:\documents and settings\Erin\Application Data\Malwarebytes
2010-03-10 20:00 . 2010-01-07 21:07 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-03-10 20:00 . 2010-03-10 20:00 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-03-10 20:00 . 2010-03-10 20:00 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-03-10 20:00 . 2010-01-07 21:07 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-03-10 19:52 . 2007-06-14 20:53 700416 —-a-w- c:\windows\system32\BCMLogon.dll
2010-03-02 18:32 . 2010-03-02 18:32 1740800 —ha-w- C:\SZKGFS.dat
2010-02-27 19:57 . 2010-02-27 19:57 ——– d—–w- c:\program files\STOPzilla!
2010-02-14 23:59 . 2010-02-14 23:59 ——– d—–w- c:\program files\Trend Micro
2010-02-13 21:38 . 2010-02-13 21:38 1152 —-a-w- c:\windows\system32\windrv.sys
2010-02-13 18:14 . 2010-02-13 21:38 ——– d—–w- c:\documents and settings\Erin\Application Data\GetRightToGo
2010-02-13 02:59 . 2010-02-13 02:59 ——– d—–w- c:\documents and settings\All Users\Application Data\SITEguard
2010-02-13 02:58 . 2010-02-13 02:58 ——– d—–w- c:\program files\Common Files\iS3
2010-02-13 02:58 . 2010-03-13 05:50 ——– d—–w- c:\documents and settings\All Users\Application Data\STOPzilla!
2010-02-13 02:48 . 2004-10-22 01:06 45056 —-a-r- c:\documents and settings\Administrator\Application Data\Microsoft\Installer\{457791C5-D702-4143-A7B2-2744BE9573F2}\NewShortcut1_5B69D3033CA54B39B5ECE7D051297E77.exe
2010-02-13 02:48 . 2004-10-22 02:30 128 —-a-w- c:\documents and settings\Administrator\Local Settings\Application Data\fusioncache.dat

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-13 00:43 . 2010-03-13 00:42 1816 —-a-w- c:\windows\system32\drivers\kgpfr2.cfg
2010-03-13 00:43 . 2010-03-12 06:57 2368 —-a-w- c:\windows\system32\drivers\kgpcpy.cfg
2010-03-12 05:32 . 2005-04-22 23:00 39860 —-a-w- c:\documents and settings\Erin\Application Data\wklnhst.dat
2010-03-10 19:52 . 2004-10-22 01:46 ——– d–h–w- c:\program files\InstallShield Installation Information
2010-02-04 16:21 . 2010-02-04 16:21 17408 —-a-r- c:\windows\system32\SZIO5.dll
2010-02-04 16:19 . 2010-02-04 16:19 442368 —-a-r- c:\windows\system32\SZBase5.dll
2010-02-04 16:18 . 2010-02-04 16:18 540672 —-a-r- c:\windows\system32\SZComp5.dll
2010-01-27 15:19 . 2010-01-27 15:19 167312 —-a-r- c:\windows\system32\drivers\SZKGFS.sys
2010-01-05 10:00 . 2004-11-11 00:34 832512 ——w- c:\windows\system32\wininet.dll
2010-01-05 10:00 . 2004-11-11 00:32 78336 —-a-w- c:\windows\system32\ieencode.dll
2010-01-05 10:00 . 2004-11-11 01:22 17408 —-a-w- c:\windows\system32\corpol.dll
2009-12-31 16:50 . 2004-11-11 00:33 353792 —-a-w- c:\windows\system32\drivers\srv.sys
2009-12-16 18:43 . 2004-11-11 00:32 343040 —-a-w- c:\windows\system32\mspaint.exe
2009-12-14 07:08 . 2004-11-11 00:31 33280 —-a-w- c:\windows\system32\csrsrv.dll
.

((((((((((((((((((((((((((((( SnapShot@2010-03-12_00.59.32 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-03-18 03:29 . 2008-07-08 13:02 17272 c:\windows\system32\spmsg.dll
- 2009-03-18 03:29 . 2009-05-26 11:40 17272 c:\windows\system32\spmsg.dll
+ 2010-03-12 01:17 . 2010-03-12 01:00 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2010-03-12 01:17 . 2010-03-12 01:00 16384 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2005-05-12 16:24 . 2010-03-02 05:30 31648712 c:\windows\system32\MRT.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nmctxth"="c:\program files\Common Files\Pure Networks Shared\Platform\nmctxth.exe" [2008-12-12 642856]
"Linksys Wireless Manager"="c:\program files\Linksys\Linksys Wireless Manager\LinksysWirelessManager.exe" [2009-02-16 1358384]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak EasyShare software.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk
backup=c:\windows\pss\Kodak EasyShare software.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak software updater.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Kodak software updater.lnk
backup=c:\windows\pss\Kodak software updater.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^HP_Owner^Start Menu^Programs^Startup^Adobe Gamma.lnk]
path=c:\documents and settings\HP_Owner\Start Menu\Programs\Startup\Adobe Gamma.lnk
backup=c:\windows\pss\Adobe Gamma.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^HP_Owner^Start Menu^Programs^Startup^HP Organize.lnk]
path=c:\documents and settings\HP_Owner\Start Menu\Programs\Startup\HP Organize.lnk
backup=c:\windows\pss\HP Organize.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acme.PCHButton]
2004-10-22 02:29 159744 —-a-w- c:\progra~1\HELPAN~1\HPQ\XPXWWPP5\plugin\bin\PCHButton.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AGRSMMSG]
2005-03-04 16:01 88209 —-a-w- c:\windows\AGRSMMSG.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
2005-04-12 05:10 65536 —-a-w- c:\windows\ALCMTR.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcWzrd]
2005-04-06 22:53 2805248 —-a-w- c:\windows\ALCWZRD.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ANIWZCS2Service]
2004-12-16 21:49 49152 —-a-w- c:\program files\ANI\ANIWZCS2 Service\WZCSLDR2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 00:12 15360 ——w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus Photo R220 Series]
2006-12-25 10:00 177664 —-a-w- c:\windows\system32\spool\drivers\w32x86\3\E_FATIAIA.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IndexSearch]
2004-04-14 20:04 40960 —-a-w- c:\program files\ScanSoft\PaperPort\IndexSearch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2009-09-21 20:36 305440 —-a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LSBWatcher]
2004-10-15 04:54 253952 —-a-w- c:\hp\drivers\hplsbwatcher\LSBurnWatcher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 00:12 1695232 —-a-w- c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PaperPort PTD]
2004-04-14 19:46 57393 —-a-w- c:\program files\ScanSoft\PaperPort\pptd40nt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-09-05 05:54 417792 —-a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Reminder]
2003-12-18 07:31 118784 —-a-w- c:\windows\CREATOR\Remind_XP.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SmileboxTray]
2009-05-12 20:33 266888 —-a-w- c:\documents and settings\Erin\Application Data\Smilebox\SmileboxTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
2005-04-06 22:57 90112 —-a-w- c:\windows\SOUNDMAN.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSBkgdUpdate]
2003-10-14 15:22 155648 —-a-r- c:\program files\Common Files\ScanSoft Shared\SSBkgdUpdate\SSBkgdUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2004-10-22 00:27 32881 —-a-w- c:\program files\Java\j2re1.4.2_03\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Symantec NetDriver Monitor]
2006-01-04 13:55 100056 —-a-w- c:\progra~1\SYMNET~1\SNDMon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2004-10-22 01:39 180269 —-a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdateManager]
2003-08-19 15:01 110592 —-a-w- c:\program files\Common Files\Sonic\Update Manager\sgtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"KodakCCS"=2 (0x2)
"Fax"=3 (0x3)
"iPodService"=3 (0x3)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"AGRSMMSG"=AGRSMMSG.exe
"AlcWzrd"=ALCWZRD.EXE
"HotKeysCmds"=c:\windows\system32\hkcmd.exe
"KBD"=c:\hp\KBD\KBD.EXE
"PS2"=c:\windows\system32\ps2.exe
"Symantec NetDriver Monitor"=c:\progra~1\SYMNET~1\SNDMon.exe
"Recguard"=c:\windows\SMINST\RECGUARD.EXE
"AcctMgr"=c:\program files\Norton Password Manager\AcctMgr.exe /startup

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

R0 szkg5;szkg5;c:\windows\system32\drivers\SZKG.sys [12/7/2009 4:59 PM 61328]
R0 szkgfs;szkgfs;c:\windows\system32\drivers\SZKGFS.sys [1/27/2010 10:19 AM 167312]
R3 WUSB54GCv3;Compact Wireless-G USB Network Adapter;c:\windows\system32\drivers\WUSB54GCv3.sys [3/11/2010 7:05 PM 627072]
S0 is3srv;is3srv;c:\windows\system32\drivers\is3srv.sys [12/7/2009 4:59 PM 61328]
S3 pmxscan;Visioneer USB Kernel;c:\windows\system32\drivers\usbscan.sys [2/12/2005 7:36 PM 15104]
S3 SISNPF;SIS Netgroup Packet Filter;c:\windows\system32\drivers\SISNPF.sys –> c:\windows\system32\drivers\SISNPF.sys [?]
.
Contents of the 'Scheduled Tasks' folder

2010-02-28 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]

2010-03-13 c:\windows\Tasks\Symantec Drmc.job
- c:\program files\Common Files\Symantec Shared\SymDrmc.exe [2003-09-10 09:48]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.thirdstreammusic.com/
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
Trusted Zone: plaxo.com\www
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Erin\Application Data\Mozilla\Firefox\Profiles\oomku7wy.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.3smd.com
FF - plugin: c:\documents and settings\Erin\Application Data\Mozilla\Firefox\Profiles\oomku7wy.default\extensions\[removed]\platform\WINNT_x86-msvc\plugins\npmnqmp071101000055.dll
FF - plugin: c:\program files\Java\j2re1.4.2_03\bin\NPJPI142_03.dll

—- FIREFOX POLICIES —-
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-13 00:50
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(732)
c:\windows\System32\BCMLogon.dll
.
Completion time: 2010-03-13 00:53:25
ComboFix-quarantined-files.txt 2010-03-13 05:53
ComboFix2.txt 2010-03-13 00:52
ComboFix3.txt 2010-03-12 01:11
ComboFix4.txt 2010-03-10 23:41
ComboFix5.txt 2010-03-13 05:44

Pre-Run: 126,442,815,488 bytes free
Post-Run: 126,425,747,456 bytes free

- - End Of File - - D172B46C5747CB702F679ECD5D55C403

LDTate

Post #6March 13, 2010, 10:38 AM UTC

You need to update Java.

Update Java
Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.
First remove the older versions:

Download JavaRa and unzip it to your desktop.
Double-click on JavaRa.exe to start the program.
Click on Remove Older Versions to remove the older versions of Java installed on your computer.
Click Yes when prompted. When JavaRa is done, a notice will appear that a logfile has been produced. Click OK.
A logfile will pop up. Please save it to a convenient location.

Now let's download and install the newest version:

Download the latest version of Java Runtime Environment (JRE) 6 Update 10.
Click on Windows XP/Vista/2000/2003 Offline and save the downloaded file to your desktop.
Close any programs you may have running - especially your web browser.
Then from your desktop double-click on the download to install the newest version.
Reboot your computer and let me know how it's running.

LDTate

Post #7March 15, 2010, 8:55 PM UTC

Where are we at with this?

LDTate

Post #8March 18, 2010, 8:39 PM UTC

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.

LDTate

Post #9March 21, 2010, 12:18 AM UTC

This topic has been reopened by request of the starter of this topic. Or it has been moved to the correct forum

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Pesky Virus - Need help to be sure it is removed

✨ Ask AI

Ask AI