Spyware / Malware / Virus Removal

[Resolved]Please Help

8 min read

Looking for the outcome? Ask AI

SouthSideDiablo Topic Starter

Post #1July 8, 2007, 9:26 PM UTC last edited July 9, 2007, 11:20 PM UTC

I've been having some problem with my computer lately. Mainly pop-ups and sometimes when I close a window, it will stay on the screen. Also, there has been times where my taskbar has disappered. So far all I have done is scan for viruses with Norton, but it has returned with nothing. Please help.

Logfile of HijackThis v1.99.1
Scan saved at 5:21:29 AM, on 7/8/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\TortoiseSVN\bin\TSVNCache.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Verizon\McciTrayApp.exe
C:\Program Files\Verizon\Servicepoint\VerizonServicepoint.exe
C:\WINDOWS\avp.exe
C:\WINDOWS\mgrs.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\AIM6\aim6.exe
c:\progra~1\intern~1\iexplore.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hamachi\hamachi.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\IceChat7\IceChat7.exe
C:\Program Files\Mozilla FireFox\firefox.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://wapp.verizon.net/bookmarks/bmredir….p;bm=ho_central
O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Verizon Broadband Toolbar - {4E7BD74F-2B8D-469E-D0FC-E57AF4D5FA7D} - C:\WINDOWS\DOWNLO~1\vzbb.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [nTrayFw] C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe
O4 - HKLM\..\Run: [EasyTuneV] C:\Program Files\Gigabyte\ET5\GUI.exe
O4 - HKLM\..\Run: [CallControl 4.5] C:\Program Files\FaxTalk Communicator\FTCtrl32.exe /autoload
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Verizon_McciTrayApp] C:\Program Files\Verizon\McciTrayApp.exe
O4 - HKLM\..\Run: [VerizonServicepoint.exe] C:\Program Files\Verizon\Servicepoint\VerizonServicepoint.exe
O4 - HKLM\..\Run: [ace fork bat option] C:\Documents and Settings\All Users\Application Data\Book Store Ace Fork\OkayPing.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [avp] C:\WINDOWS\avp.exe
O4 - HKLM\..\Run: [wzsdarep.exe] C:\WINDOWS\system32\wzsdarep.exe
O4 - HKLM\..\Run: [smgr] mgrs.exe
O4 - HKLM\..\Run: [Windows Updater Servc] C:\WINDOWS\system32\xpuupdate.exe
O4 - HKLM\..\Run: [ShareSearcher] C:\DOCUME~1\user\LOCALS~1\Temp\ss1.exe
O4 - HKLM\..\Run: [runner1] C:\WINDOWS\retadpu2000352.exe 61A847B5BBF72810329B385577FB01F0B3E35B6638993F4661AA4EBD86D67C56389B284534F310
O4 - HKLM\..\Run: [CTDrive] rundll32.exe C:\WINDOWS\system32\drvlah.dll,startup
O4 - HKLM\..\Run: [icq.com] rundll32.exe "C:\WINDOWS\system32\hoalnoui.dll",forkonce
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [HOLDBARB] C:\DOCUME~1\user\APPLIC~1\PLANBA~1\Online phone pure.exe
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [µTorrent] "C:\Documents and Settings\user\Desktop\utorrent.exe"
O4 - HKCU\..\Run: [ttool] C:\WINDOWS\9129837.exe
O4 - Startup: hamachi.lnk = C:\Program Files\Hamachi\hamachi.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: GetRight - Tray Icon.lnk = C:\Program Files\GetRight\getright.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm
O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - https://activatemydsl.verizon.net/sdcCommon…DSL/tgctlcm.cab
O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} (HGPlugin9USA Class) - http://gamedownload.ijjimax.com/gamedownlo…GPlugin9USA.cab
O20 - AppInit_DLLs: C:\WINDOWS\system32\tmp_f7.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe
O23 - Service: DomainService - Unknown owner - C:\WINDOWS\system32\kdyloijk.exe (file missing)
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe" -k runservice (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - Unknown owner - C:\WINDOWS\system32\nvsvc32.exe (file missing)
O23 - Service: OPTI-SAFE Xtreme OnEvent (onevent) - Unknown owner - C:\Program Files\OPTI-SAFE Xtreme\ntevent.exe (file missing)
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe (file missing)
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: OPTI-SAFE Xtreme UPS (powersrv) - Unknown owner - C:\Program Files\OPTI-SAFE Xtreme\ntsrv.exe (file missing)
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: OPTI-SAFE Xtreme SNMP Agent (SNMPAGENTSRV) - Unknown owner - C:\Program Files\OPTI-SAFE Xtreme\upsagentd.exe (file missing)
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: OPTI-SAFE Xtreme Web Server (upsis) - Unknown owner - C:\Program Files\OPTI-SAFE Xtreme\upsis.exe (file missing)

I found out that the windows staying open problem is becuase I would keep my computer running, but my monitor off for hours, then turning on the monitor, and opening and closing windows.

LDTate

Post #2July 9, 2007, 11:23 PM UTC

Hello and welcome to the forums

You have some infections there.

Download ComboFix from Here to your Desktop.

Double click combofix.exe and follow the prompts.
When finished, it shall produce a log for you, combofix.txt.Post that log and a HiJackthis log in your next reply

Note: Do not mouseclick combofix's window while its running. That may cause it to stall

SouthSideDiablo

Post #3July 10, 2007, 11:49 AM UTC

Here is the combofix log,

"user" - 2007-07-10 7:34:19 - ComboFix 07-07-10.1 - Service Pack 2

(((((((((((((((((((((((((((((((((((((((((((( V Log )))))))))))))))))))))))))))))))))))))))))))))))))))))))

C:\WINDOWS\system32\auiiuoxq.dll
C:\WINDOWS\system32\awsdgofv.dll
C:\WINDOWS\system32\emgewhht.dll
C:\WINDOWS\system32\eumpmnhl.dll
C:\WINDOWS\system32\fpjpkdpi.dll
C:\WINDOWS\system32\gdccmxnt.dll
C:\WINDOWS\system32\gtgdgmwu.dll
C:\WINDOWS\system32\iktmkuev.dll
C:\WINDOWS\system32\jalushhq.dll
C:\WINDOWS\system32\lgswayxc.dll
C:\WINDOWS\system32\lktlvmrw.dll
C:\WINDOWS\system32\nbnuvtvl.dll
C:\WINDOWS\system32\pomoebee.dll
C:\WINDOWS\system32\qofyvysq.dll
C:\WINDOWS\system32\rhahtiud.dll
C:\WINDOWS\system32\rmmreghf.dll
C:\WINDOWS\system32\rnwabdrv.dll
C:\WINDOWS\system32\tsknmdev.dll
C:\WINDOWS\system32\xticjsfq.dll
C:\WINDOWS\system32\yeaasngk.dll
C:\WINDOWS\system32\ygftlqjq.dll
C:\WINDOWS\system32\yhgxkqqu.dll
C:\WINDOWS\system32\yiefebqq.dll
C:\WINDOWS\system32\prrgkptt.exe
C:\WINDOWS\system32\gebbaba.dll
C:\WINDOWS\system32\hggfebb.dll
C:\WINDOWS\system32\ljjgefe.dll
C:\WINDOWS\system32\wvutrrq.dll
C:\WINDOWS\system32\wincqt32.dll
C:\WINDOWS\system32\qxouiiua.ini
C:\WINDOWS\system32\vfogdswa.ini
C:\WINDOWS\system32\lhnmpmue.ini
C:\WINDOWS\system32\ipdkpjpf.ini
C:\WINDOWS\system32\tnxmccdg.ini
C:\WINDOWS\system32\uwmgdgtg.ini
C:\WINDOWS\system32\veukmtki.ini
C:\WINDOWS\system32\qhhsulaj.ini
C:\WINDOWS\system32\cxyawsgl.ini
C:\WINDOWS\system32\wrmvltkl.ini
C:\WINDOWS\system32\lvtvunbn.ini
C:\WINDOWS\system32\ijkmp.bak1
C:\WINDOWS\system32\ijkmp.bak2
C:\WINDOWS\system32\ijkmp.ini
C:\WINDOWS\system32\ijkmp.ini2
C:\WINDOWS\system32\ijkmp.tmp
C:\WINDOWS\system32\eebeomop.ini
C:\WINDOWS\system32\duithahr.ini
C:\WINDOWS\system32\fhgermmr.ini
C:\WINDOWS\system32\vrdbawnr.ini
C:\WINDOWS\system32\vedmnkst.ini
C:\WINDOWS\system32\qfsjcitx.ini
C:\WINDOWS\system32\kgnsaaey.ini
C:\WINDOWS\system32\qjqltfgy.ini
C:\WINDOWS\system32\uqqkxghy.ini
C:\WINDOWS\system32\qqbefeiy.ini
C:\WINDOWS\system32\ijkmp.bak1
C:\WINDOWS\system32\ijkmp.bak2
C:\WINDOWS\system32\ijkmp.ini
C:\WINDOWS\system32\ijkmp.ini2
C:\WINDOWS\system32\ijkmp.tmp
C:\WINDOWS\system32\ijkmp.bak1
C:\WINDOWS\system32\ijkmp.bak2
C:\WINDOWS\system32\ijkmp.ini
C:\WINDOWS\system32\ijkmp.ini2
C:\WINDOWS\system32\ijkmp.tmp
C:\WINDOWS\system32\pmkji.dll
C:\WINDOWS\system32\mljkkii.dll

* * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

C:\d.exe
C:\WINDOWS\avp.exe
C:\WINDOWS\b.exe
C:\WINDOWS\mgrs.exe
C:\WINDOWS\new_drv.sys
C:\WINDOWS\racle~1
C:\WINDOWS\racle~1\csrss.exe
C:\WINDOWS\svchost.exe
C:\WINDOWS\system32\afieiubb.exe
C:\WINDOWS\system32\ahjegqxk.exe
C:\WINDOWS\system32\akqtkvbp.exe
C:\WINDOWS\system32\avoslfvq.exe
C:\WINDOWS\system32\byampuvp.exe
C:\WINDOWS\system32\cdavkatr.exe
C:\WINDOWS\system32\chcqevcn.exe
C:\WINDOWS\system32\cveftvlp.exe
C:\WINDOWS\system32\dapkldst.exe
C:\WINDOWS\system32\driver.exe
C:\WINDOWS\system32\dtwtsajr.exe
C:\WINDOWS\system32\dufdccsf.exe
C:\WINDOWS\system32\dxbgvotn.exe
C:\WINDOWS\system32\ekrspibk.exe
C:\WINDOWS\system32\emoyvhnu.exe
C:\WINDOWS\system32\eqmfgjcf.exe
C:\WINDOWS\system32\exbjtotv.exe
C:\WINDOWS\system32\fnciwhpi.exe
C:\WINDOWS\system32\gdurqsqm.exe
C:\WINDOWS\system32\gwujnlnn.exe
C:\WINDOWS\system32\hgnyfnis.exe
C:\WINDOWS\system32\htadyvxu.exe
C:\WINDOWS\system32\ixcmftou.exe
C:\WINDOWS\system32\jqnhswgh.exe
C:\WINDOWS\system32\jtccykrj.exe
C:\WINDOWS\system32\kgfhxihb.exe
C:\WINDOWS\system32\ljyfsdoa.exe
C:\WINDOWS\system32\lmfuiuht.exe
C:\WINDOWS\system32\modyufch.exe
C:\WINDOWS\system32\njwcrnvo.exe
C:\WINDOWS\system32\npfmcvbk.exe
C:\WINDOWS\system32\pvhdflyi.exe
C:\WINDOWS\system32\qjlxknmf.exe
C:\WINDOWS\system32\qnqqygxf.exe
C:\WINDOWS\system32\qyxqnprp.exe
C:\WINDOWS\system32\rihbnbkn.exe
C:\WINDOWS\system32\rypctwrn.exe
C:\WINDOWS\system32\susghvod.exe
C:\WINDOWS\system32\sysmon32.exe
C:\WINDOWS\system32\tgmfurav.exe
C:\WINDOWS\system32\tspniokv.exe
C:\WINDOWS\system32\ukhqttha.exe
C:\WINDOWS\system32\uqrciynk.exe
C:\WINDOWS\system32\uvsihkfq.exe
C:\WINDOWS\system32\vcnmekob.exe
C:\WINDOWS\system32\vfimwbmv.exe
C:\WINDOWS\system32\vqahtojd.exe
C:\WINDOWS\system32\vrokrrmv.exe
C:\WINDOWS\system32\winsys64.exe
C:\WINDOWS\system32\wmgmrlbe.exe
C:\WINDOWS\system32\xdfkcqci.exe
C:\WINDOWS\system32\xporiavy.exe
C:\WINDOWS\system32\yaswlftw.exe
C:\WINDOWS\system32\yriyxisq.exe
C:\WINDOWS\wr.txt

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

——-\LEGACY_DOMAINSERVICE
——-\LEGACY_NEW_DRV
——-\DomainService
——-\new_drv

((((((((((((((((((((((((( Files Created from 2007-06-10 to 2007-07-10 )))))))))))))))))))))))))))))))

2007-07-10 07:36 93,696 –a—— C:\WINDOWS\system32\drvwod.dll
2007-07-10 07:33 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-07-08 05:17 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
2007-07-08 05:15 d——– C:\Program Files\Spyware Doctor
2007-07-08 05:15 d——– C:\DOCUME~1\user\APPLIC~1\PC Tools
2007-07-08 05:14 626,688 –a—— C:\WINDOWS\system32\msvcr80.dll
2007-07-07 11:49 d——– C:\DOCUME~1\user\APPLIC~1\vlc
2007-07-07 11:29 d——– C:\Program Files\VideoLAN
2007-07-07 09:11 d——– C:\DOCUME~1\user\APPLIC~1\Command & Conquer 3 Tiberium Wars Demo
2007-07-05 20:57 d——– C:\Program Files\BitPim
2007-07-04 21:53 d——– C:\Program Files\Common Files\AOL
2007-07-04 11:15 93,696 –a—— C:\WINDOWS\system32\drvlah.dll
2007-07-04 09:44 d——– C:\DOCUME~1\user\APPLIC~1\Petroglyph
2007-07-04 09:16 49,536 –a—— C:\WINDOWS\system32\drivers\aczoyab5.sys
2007-07-04 09:11 98,304 –a—— C:\WINDOWS\system32CmdLineExt.dll
2007-07-04 09:08 d——– C:\DOCUME~1\user\APPLIC~1\InstallShield
2007-07-04 09:00 42,528 –a—— C:\sfwwnj.exe
2007-07-04 09:00 4,096 -rah—– C:\WINDOWS\system32\tmp_f7.dll
2007-07-04 09:00 10,557 -rah—– C:\WINDOWS\system32\systlcn.exe
2007-07-03 22:23 d——– C:\Program Files\Common Files\Bcgsoft
2007-07-03 22:14 d——– C:\Program Files\The Game Creators
2007-06-30 06:21 d——– C:\Program Files\Windows Media Connect 2
2007-06-30 06:20 d——– C:\WINDOWS\system32\drivers\UMDF
2007-06-24 21:25 2,624 –a—— C:\WINDOWS\system32\vtgfydgq.exe
2007-06-24 12:13 d——– C:\~MSSETUP.T
2007-06-24 09:24 98,304 –a—— C:\WINDOWS\system32\CmdLineExt.dll
2007-06-24 09:15 d——– C:\Program Files\LucasArts
2007-06-21 08:19 d—s—- C:\DOCUME~1\Guest\UserData
2007-06-16 15:21 263,623 –a—— C:\WINDOWS\system32\SpoonUninstall-KMOD Nations at War(v1.39f).dat
2007-06-16 12:48 131,584 –a—— C:\WINDOWS\system32\SpoonUninstall.exe
2007-06-15 10:58 d——– C:\Program Files\Electronic Arts

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-07-10 14:43:40 ——– d—–w C:\DOCUME~1\user\APPLIC~1\Hamachi
2007-07-10 14:39:59 ——– d—–w C:\Program Files\Common Files\Symantec Shared
2007-07-10 14:32:56 ——– d—–w C:\DOCUME~1\user\APPLIC~1\uTorrent
2007-07-09 12:45:28 ——– d—–w C:\Program Files\GetRight
2007-07-07 20:36:33 ——– d–h–w C:\Program Files\InstallShield Installation Information
2007-07-07 19:31:57 ——– d—–w C:\DOCUME~1\user\APPLIC~1\LimeWire
2007-07-07 10:27:14 ——– d—–w C:\Program Files\IceChat7
2007-07-06 14:43:25 ——– d—–w C:\DOCUME~1\user\APPLIC~1\IceChat
2007-07-05 04:54:46 ——– d—–w C:\Program Files\AIM6
2007-06-30 16:46:10 ——– d—–w C:\Program Files\EA GAMES
2007-06-28 16:11:42 43,520 —-a-w C:\WINDOWS\system32\CmdLineExt03.dll
2007-06-28 16:11:24 ——– d—–w C:\Program Files\Maxis
2007-06-28 00:27:49 ——– d—–w C:\Program Files\Hamachi
2007-06-27 23:53:40 3,003 —-a-w C:\WINDOWS\eReg.dat
2007-06-24 16:05:17 ——– d—–w C:\Program Files\OPTI-SAFE Xtreme
2007-06-14 03:56:57 ——– d—–w C:\Program Files\LimeWire
2007-06-02 20:31:49 ——– d—–w C:\Program Files\GameSpot
2007-06-02 20:24:46 99,904 —-a-w C:\WINDOWS\system32\PnkBstrB.exe
2007-06-01 21:01:51 ——– d—–w C:\DOCUME~1\user\APPLIC~1\AOL
2007-05-31 14:08:00 ——– d—–w C:\DOCUME~1\user\APPLIC~1\Subversion
2007-05-31 14:07:25 ——– d—–w C:\Program Files\TortoiseSVN
2007-05-31 04:49:07 ——– d—–w C:\Program Files\QuickTime
2007-05-31 04:47:08 ——– d—–w C:\Program Files\Apple Software Update
2007-05-24 03:58:38 ——– d—–w C:\Program Files\Opera
2007-05-24 02:29:45 ——– d—–w C:\DOCUME~1\user\APPLIC~1\AdobeUM
2007-05-20 16:38:03 ——– d—–w C:\DOCUME~1\user\APPLIC~1\U3
2007-05-20 15:41:19 22,584 —-a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2007-05-20 15:37:08 ——– d—–w C:\Program Files\Save
2007-05-19 19:38:11 ——– d—–w C:\Program Files\DAEMON Tools SearchBar
2007-05-19 19:37:51 ——– d—–w C:\Program Files\DaemonTools_WhenUSave_Installer
2007-05-19 19:35:23 ——– d—–w C:\Program Files\DAEMON Tools
2007-05-19 19:31:26 682,232 —-a-w C:\WINDOWS\system32\drivers\sptd.sys
2007-05-19 16:39:28 ——– d—–w C:\DOCUME~1\user\APPLIC~1\PLAN BASH
2007-05-19 16:38:30 ——– d—–w C:\Program Files\PLAN BASH
2007-05-16 23:04:34 ——– d—–w C:\DOCUME~1\user\APPLIC~1\Viewpoint
2007-05-16 23:02:54 ——– d—–w C:\Program Files\MindArk
2007-05-16 15:12:02 683,520 —-a-w C:\WINDOWS\system32\inetcomm.dll
2007-05-16 05:13:47 163,644 —-a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-05-16 05:13:43 ——– d—–w C:\Program Files\Call of Duty
2007-05-16 04:02:23 ——– d—–w C:\Program Files\Activision
2007-05-15 01:26:50 ——– d—–w C:\Program Files\Common Files\EasyInfo
2007-05-14 01:43:40 ——– d–h–w C:\DOCUME~1\user\APPLIC~1\Move Networks
2007-05-12 20:18:15 ——– d—–w C:\Program Files\Norton Internet Security
2007-05-12 20:07:15 ——– d—–w C:\Program Files\Symantec
2007-05-12 20:07:14 48,776 —-a-w C:\WINDOWS\system32\S32EVNT1.DLL
2007-05-12 20:07:14 115,000 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2007-05-12 19:38:10 0 -c–a-w C:\WINDOWS\system32\taskkill.exe
2007-05-12 18:00:43 ——– d—–w C:\Program Files\Army Operations
2007-05-12 17:16:35 ——– d—–w C:\DOCUME~1\user\APPLIC~1\Verizon
2007-05-12 17:16:34 ——– d—–w C:\Program Files\Verizon
2007-05-12 16:24:28 ——– d—–w C:\Program Files\VZBB Toolbar
2007-05-12 14:03:18 ——– d—–w C:\Program Files\PlayLinc
2007-05-12 13:47:06 ——– d—–w C:\DOCUME~1\user\APPLIC~1\Motive
2007-05-12 13:37:48 ——– d—–w C:\Program Files\Common Files\Motive
2007-05-12 05:14:31 0 -c–a-w C:\WINDOWS\PowerReg.dat
2007-05-12 05:12:00 ——– d—–w C:\Program Files\Infogrames Interactive
2007-05-12 05:07:36 ——– d—–w C:\Program Files\SupportSoft
2007-05-11 23:08:42 ——– d—–w C:\Program Files\Common Files\SupportSoft
2007-05-01 15:35:12 146,432 —-a-w C:\Program Files\Common Files\Yazzle1162OinAdmin.exe
2007-04-25 14:21:15 144,896 —-a-w C:\WINDOWS\system32\schannel.dll
2007-04-21 18:43:25 39,384 -c–a-w C:\DOCUME~1\user\APPLIC~1\GDIPFONTCACHEV1.DAT
2007-04-19 20:26:00 888,832 —-a-w C:\WINDOWS\system32\nvmobls.dll
2007-04-19 20:26:00 86,016 —-a-w C:\WINDOWS\system32\nvmctray.dll
2007-04-19 20:26:00 81,920 —-a-w C:\WINDOWS\system32\nvwddi.dll
2007-04-19 20:26:00 794,624 —-a-w C:\WINDOWS\system32\nvcplui.exe
2007-04-19 20:26:00 7,700,480 —-a-w C:\WINDOWS\system32\nvcpl.dll
2007-04-19 20:26:00 581,632 —-a-w C:\WINDOWS\system32\nvhwvid.dll
2007-04-19 20:26:00 5,644,288 —-a-w C:\WINDOWS\system32\nvoglnt.dll
2007-04-19 20:26:00 5,619,712 —-a-w C:\WINDOWS\system32\nvdisps.dll
2007-04-19 20:26:00 466,944 —-a-w C:\WINDOWS\system32\nvshell.dll
2007-04-19 20:26:00 45,056 —-a-w C:\WINDOWS\system32\nvmccsrs.dll
2007-04-19 20:26:00 442,368 —-a-w C:\WINDOWS\system32\nvappbar.exe
2007-04-19 20:26:00 425,984 —-a-w C:\WINDOWS\system32\keystone.exe
2007-04-19 20:26:00 4,543,616 —-a-w C:\WINDOWS\system32\nv4_disp.dll
2007-04-19 20:26:00 35,840 —-a-w C:\WINDOWS\system32\nvcodins.dll
2007-04-19 20:26:00 35,840 —-a-w C:\WINDOWS\system32\nvcod.dll
2007-04-19 20:26:00 311,296 —-a-w C:\WINDOWS\system32\nvexpbar.dll
2007-04-19 20:26:00 3,035,136 —-a-w C:\WINDOWS\system32\nvgames.dll
2007-04-19 20:26:00 286,720 —-a-w C:\WINDOWS\system32\nvnt4cpl.dll
2007-04-19 20:26:00 229,376 —-a-w C:\WINDOWS\system32\nvmccs.dll
2007-04-19 20:26:00 212,992 —-a-w C:\WINDOWS\system32\nvapi.dll
2007-04-19 20:26:00 2,924,544 —-a-w C:\WINDOWS\system32\nvvitvs.dll
2007-04-19 20:26:00 188,416 —-a-w C:\WINDOWS\system32\nvmccss.dll
2007-04-19 20:26:00 147,456 —-a-w C:\WINDOWS\system32\nvcolor.exe
2007-04-19 20:26:00 1,703,936 —-a-w C:\WINDOWS\system32\nvwdmcpl.dll
2007-04-19 20:26:00 1,474,560 —-a-w C:\WINDOWS\system32\nview.dll
2007-04-19 20:26:00 1,339,392 —-a-w C:\WINDOWS\system32\nvdspsch.exe
2007-04-19 20:26:00 1,236,992 —-a-w C:\WINDOWS\system32\nvwss.dll
2007-04-19 20:26:00 1,019,904 —-a-w C:\WINDOWS\system32\nvwimg.dll
2007-04-19 20:26:00 1,011,712 —-a-w C:\WINDOWS\system32\nvcpluir.dll
2007-04-18 23:48:49 10,920 —-a-w C:\aolconnfix.exe
2007-04-18 16:12:23 2,854,400 —-a-w C:\WINDOWS\system32\msi.dll
2007-04-17 05:47:36 33,624 —-a-w C:\WINDOWS\system32\wups.dll
2007-04-17 05:45:54 1,710,936 —-a-w C:\WINDOWS\system32\wuaueng.dll
2007-04-17 05:45:48 549,720 —-a-w C:\WINDOWS\system32\wuapi.dll
2007-04-17 05:45:42 325,976 —-a-w C:\WINDOWS\system32\wucltui.dll
2007-04-17 05:45:36 203,096 —-a-w C:\WINDOWS\system32\wuweb.dll
2007-04-17 05:45:28 92,504 —-a-w C:\WINDOWS\system32\cdm.dll
2007-04-17 05:45:20 53,080 —-a-w C:\WINDOWS\system32\wuauclt.exe
2007-04-17 05:45:20 43,352 —-a-w C:\WINDOWS\system32\wups2.dll

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
2003-11-03 15:17 54248 –a—— C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{31FF080D-12A3-439A-A2EF-4BA95A3148E8}]
2007-01-04 23:57 247112 –a—— C:\Program Files\GetRight\xx2gr.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4E7BD74F-2B8D-469E-D0FC-E57AF4D5FA7D}]
2005-01-12 08:12 1111104 –a—— C:\WINDOWS\DOWNLO~1\vzbb.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
2007-03-14 03:43 501400 –a—— C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9ECB9560-04F9-4bbc-943D-298DDF1699E1}]
2006-02-07 00:35 94384 –a—— C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A8F38D8D-E480-4D52-B7A2-731BB6995FDD}]
2007-04-02 19:19 140912 –a—— C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nwiz"="nwiz.exe" []
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-31 20:42]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-22 22:19]
"nTrayFw"="C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe" [2005-07-26 19:04]
"EasyTuneV"="C:\Program Files\Gigabyte\ET5\GUI.exe" [2004-06-14 20:54]
"CallControl 4.5"="C:\Program Files\FaxTalk Communicator\FTCtrl32.exe" [2004-03-23 16:43]
"SoundMan"="SOUNDMAN.EXE" [2006-03-01 01:22 C:\WINDOWS\soundman.exe]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43]
"AOLDialer"="C:\Program Files\Common Files\AOL\ACS\AOLDial.exe" []
"RealTray"="C:\Program Files\Real\RealPlayer\RealPlay.exe" [2007-02-15 09:04]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2006-10-30 10:36]
"Verizon_McciTrayApp"="C:\Program Files\Verizon\McciTrayApp.exe" [2007-03-11 14:37]
"VerizonServicepoint.exe"="C:\Program Files\Verizon\Servicepoint\VerizonServicepoint.exe" [2006-02-01 18:33]
"ace fork bat option"="C:\Documents and Settings\All Users\Application Data\Book Store Ace Fork\OkayPing.exe" [2007-05-19 09:39]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 09:41]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 09:24]
"Aim6"="C:\Program Files\AIM6\aim6.exe" [2007-04-27 14:17]
"HOLDBARB"="C:\DOCUME~1\user\APPLIC~1\PLANBA~1\Online phone pure.exe" [2007-05-19 09:38]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-04-03 15:29]
"µTorrent"="C:\Documents and Settings\user\Desktop\utorrent.exe" [2007-05-19 12:43]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=C:\WINDOWS\system32\tmp_f7.dll

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b33ff348-961c-11db-888c-0016e684cc9a}]
AutoRun\command- K:\LaunchU3.exe -a

*Newly Created Service* - COMHOST

Contents of the 'Scheduled Tasks' folder
2007-07-10 14:00:00 C:\WINDOWS\tasks\A092609A91CE128A.job
2007-05-31 04:47:09 C:\WINDOWS\tasks\AppleSoftwareUpdate.job
2007-07-07 03:00:00 C:\WINDOWS\tasks\Norton AntiVirus - Run Full System Scan - user.job

**************************************************************************

catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-10 07:43:16
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\MarkFun_NT]
"ImagePath"="\??\C:\Program Files\Gigabyte\ET5\markfun.w32"

Completion time: 2007-07-10 7:44:44 - machine was rebooted
C:\ComboFix-quarantined-files.txt … 2007-07-10 07:44

— E O F —

and here is the Hijackthis log,

Logfile of HijackThis v1.99.1
Scan saved at 7:48:36 AM, on 7/10/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\TortoiseSVN\bin\TSVNCache.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Verizon\McciTrayApp.exe
C:\Program Files\Verizon\Servicepoint\VerizonServicepoint.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\user\Desktop\utorrent.exe
c:\progra~1\intern~1\iexplore.exe
C:\Program Files\Hamachi\hamachi.exe
C:\Program Files\IceChat7\IceChat7.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\Program Files\Mozilla FireFox\firefox.exe
C:\Program Files\Symantec\LiveUpdate\AUpdate.exe
C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://wapp.verizon.net/bookmarks/bmredir….p;bm=ho_central
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: bho2gr Class - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - C:\Program Files\GetRight\xx2gr.dll
O2 - BHO: Verizon Broadband Toolbar - {4E7BD74F-2B8D-469E-D0FC-E57AF4D5FA7D} - C:\WINDOWS\DOWNLO~1\vzbb.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: Norton Internet Security 2006 - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Verizon Broadband Toolbar - {4E7BD74F-2B8D-469E-D0FC-E57AF4D5FA7D} - C:\WINDOWS\DOWNLO~1\vzbb.dll
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [nTrayFw] C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe
O4 - HKLM\..\Run: [EasyTuneV] C:\Program Files\Gigabyte\ET5\GUI.exe
O4 - HKLM\..\Run: [CallControl 4.5] C:\Program Files\FaxTalk Communicator\FTCtrl32.exe /autoload
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Verizon_McciTrayApp] C:\Program Files\Verizon\McciTrayApp.exe
O4 - HKLM\..\Run: [VerizonServicepoint.exe] C:\Program Files\Verizon\Servicepoint\VerizonServicepoint.exe
O4 - HKLM\..\Run: [ace fork bat option] C:\Documents and Settings\All Users\Application Data\Book Store Ace Fork\OkayPing.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [HOLDBARB] C:\DOCUME~1\user\APPLIC~1\PLANBA~1\Online phone pure.exe
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [µTorrent] "C:\Documents and Settings\user\Desktop\utorrent.exe"
O4 - Startup: hamachi.lnk = C:\Program Files\Hamachi\hamachi.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: GetRight - Tray Icon.lnk = C:\Program Files\GetRight\getright.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm
O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - https://activatemydsl.verizon.net/sdcCommon…DSL/tgctlcm.cab
O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} (HGPlugin9USA Class) - http://gamedownload.ijjimax.com/gamedownlo…GPlugin9USA.cab
O20 - AppInit_DLLs: C:\WINDOWS\system32\tmp_f7.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe" -k runservice (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - Unknown owner - C:\WINDOWS\system32\nvsvc32.exe (file missing)
O23 - Service: OPTI-SAFE Xtreme OnEvent (onevent) - Unknown owner - C:\Program Files\OPTI-SAFE Xtreme\ntevent.exe (file missing)
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe (file missing)
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: OPTI-SAFE Xtreme UPS (powersrv) - Unknown owner - C:\Program Files\OPTI-SAFE Xtreme\ntsrv.exe (file missing)
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: OPTI-SAFE Xtreme SNMP Agent (SNMPAGENTSRV) - Unknown owner - C:\Program Files\OPTI-SAFE Xtreme\upsagentd.exe (file missing)
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: OPTI-SAFE Xtreme Web Server (upsis) - Unknown owner - C:\Program Files\OPTI-SAFE Xtreme\upsis.exe (file missing)

LDTate

Post #4July 10, 2007, 12:45 PM UTC

If you know what this program is, then remove it from the fix:
C:\Documents and Settings\All Users\Application Data\Book Store Ace Fork\OkayPing.exe

Open notepad and copy/paste the text in the quotebox below into it:

File::
C:\WINDOWS\system32\drvwod.dll
C:\WINDOWS\system32\drvlah.dll
C:\sfwwnj.exe
C:\WINDOWS\system32\tmp_f7.dll
C:\WINDOWS\system32\systlcn.exe
C:\WINDOWS\system32\drivers\aczoyab5.sys
C:\WINDOWS\system32\vtgfydgq.exe
C:\Program Files\Common Files\Yazzle1162OinAdmin.exe
C:\Documents and Settings\All Users\Application Data\Book Store Ace Fork\OkayPing.exe

Folder::
C:\DOCUME~1\user\APPLIC~1\Viewpoint
C:\Documents and Settings\All Users\Application Data\Book Store Ace Fork

Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows\tmp_f7.dll]

Save this as ComboFix-Do.txt

[external image: Posted Image]

Refering to the picture above, drag ComboFix-Do.txt into ComboFix.exe

Then post the results log

SouthSideDiablo

Post #5July 11, 2007, 3:00 AM UTC

I have no idea what that program is. But here is the log:

"user" - 2007-07-10 10:41:04 - ComboFix 07-07-10.1 - Service Pack 2
Command switches used :: C:\Documents and Settings\user\Desktop\ComboFix-Do.txt

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

C:\DOCUME~1\user\APPLIC~1\Viewpoint
C:\DOCUME~1\user\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\-1203150185.mts
C:\DOCUME~1\user\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\-842677899.mts
C:\DOCUME~1\user\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\1137746897.mtz
C:\DOCUME~1\user\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\1447552185.mts
C:\DOCUME~1\user\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\1611636637.mts
C:\DOCUME~1\user\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\1751494511.mts
C:\DOCUME~1\user\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\2064516505.swf
C:\DOCUME~1\user\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\URLCache.ini
C:\DOCUME~1\user\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\-2044600796.mts
C:\DOCUME~1\user\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\1397640912.mts
C:\DOCUME~1\user\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\1500831434.mts
C:\DOCUME~1\user\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\1650246967.mts
C:\DOCUME~1\user\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\1713691772.mts
C:\DOCUME~1\user\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\584955300.mts
C:\DOCUME~1\user\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\80573107.swf
C:\DOCUME~1\user\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\URLCache.ini
C:\DOCUME~1\user\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\-1323130449.swf
C:\DOCUME~1\user\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\-1427327095.swf
C:\DOCUME~1\user\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\-910593480.mts
C:\DOCUME~1\user\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\171807613.mts
C:\DOCUME~1\user\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\1812284308.mts
C:\DOCUME~1\user\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\2039373226.mts
C:\DOCUME~1\user\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\407034558.ini
C:\DOCUME~1\user\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\527308403.jpg
C:\DOCUME~1\user\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\584955309.mtz
C:\DOCUME~1\user\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\URLCache.ini
C:\DOCUME~1\user\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03\-1706716660.mzv
C:\DOCUME~1\user\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03\-354611875.mts
C:\DOCUME~1\user\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03\-910619811.swf
C:\DOCUME~1\user\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03\1010809528.mts
C:\DOCUME~1\user\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03\1447529628.swf
C:\DOCUME~1\user\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03\1611560642.swf
C:\DOCUME~1\user\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03\162598907.swf
C:\DOCUME~1\user\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03\425470144.mts
C:\DOCUME~1\user\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03\946598200.mts
C:\DOCUME~1\user\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03\URLCache.ini
C:\DOCUME~1\user\APPLIC~1\Viewpoint\Viewpoint Experience Technology\Resources\UpdateVersionList_v2.mtx
C:\Documents and Settings\All Users\Application Data\Book Store Ace Fork
C:\Documents and Settings\All Users\Application Data\Book Store Ace Fork\Funk Internet Tray
C:\Documents and Settings\All Users\Application Data\Book Store Ace Fork\OkayPing.exe
C:\Documents and Settings\All Users\Application Data\Book Store Ace Fork\ThatPlanBoob
C:\Program Files\Common Files\Yazzle1162OinAdmin.exe
C:\sfwwnj.exe
C:\WINDOWS\system32\drivers\aczoyab5.sys
C:\WINDOWS\system32\drvlah.dll
C:\WINDOWS\system32\drvwod.dll
C:\WINDOWS\system32\systlcn.exe
C:\WINDOWS\system32\tmp_f7.dll
C:\WINDOWS\system32\vtgfydgq.exe

((((((((((((((((((((((((( Files Created from 2007-06-10 to 2007-07-10 )))))))))))))))))))))))))))))))

2007-07-10 07:33 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-07-08 05:17 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
2007-07-08 05:15 d——– C:\Program Files\Spyware Doctor
2007-07-08 05:15 d——– C:\DOCUME~1\user\APPLIC~1\PC Tools
2007-07-08 05:14 626,688 –a—— C:\WINDOWS\system32\msvcr80.dll
2007-07-07 11:49 d——– C:\DOCUME~1\user\APPLIC~1\vlc
2007-07-07 11:29 d——– C:\Program Files\VideoLAN
2007-07-07 09:11 d——– C:\DOCUME~1\user\APPLIC~1\Command & Conquer 3 Tiberium Wars Demo
2007-07-05 20:57 d——– C:\Program Files\BitPim
2007-07-04 21:53 d——– C:\Program Files\Common Files\AOL
2007-07-04 09:44 d——– C:\DOCUME~1\user\APPLIC~1\Petroglyph
2007-07-04 09:11 98,304 –a—— C:\WINDOWS\system32CmdLineExt.dll
2007-07-04 09:08 d——– C:\DOCUME~1\user\APPLIC~1\InstallShield
2007-07-03 22:23 d——– C:\Program Files\Common Files\Bcgsoft
2007-07-03 22:14 d——– C:\Program Files\The Game Creators
2007-06-30 06:21 d——– C:\Program Files\Windows Media Connect 2
2007-06-30 06:20 d——– C:\WINDOWS\system32\drivers\UMDF
2007-06-24 12:13 d——– C:\~MSSETUP.T
2007-06-24 09:24 98,304 –a—— C:\WINDOWS\system32\CmdLineExt.dll
2007-06-24 09:15 d——– C:\Program Files\LucasArts
2007-06-21 08:19 d—s—- C:\DOCUME~1\Guest\UserData
2007-06-16 15:21 263,623 –a—— C:\WINDOWS\system32\SpoonUninstall-KMOD Nations at War(v1.39f).dat
2007-06-16 12:48 131,584 –a—— C:\WINDOWS\system32\SpoonUninstall.exe
2007-06-15 10:58 d——– C:\Program Files\Electronic Arts

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-07-11 03:29:51 ——– d—–w C:\Program Files\Common Files\Symantec Shared
2007-07-10 17:53:19 ——– d—–w C:\DOCUME~1\user\APPLIC~1\Hamachi
2007-07-10 17:38:27 ——– d—–w C:\DOCUME~1\user\APPLIC~1\uTorrent
2007-07-09 12:45:28 ——– d—–w C:\Program Files\GetRight
2007-07-07 20:36:33 ——– d–h–w C:\Program Files\InstallShield Installation Information
2007-07-07 19:31:57 ——– d—–w C:\DOCUME~1\user\APPLIC~1\LimeWire
2007-07-07 10:27:14 ——– d—–w C:\Program Files\IceChat7
2007-07-06 14:43:25 ——– d—–w C:\DOCUME~1\user\APPLIC~1\IceChat
2007-07-05 04:54:46 ——– d—–w C:\Program Files\AIM6
2007-06-30 16:46:10 ——– d—–w C:\Program Files\EA GAMES
2007-06-28 16:11:42 43,520 —-a-w C:\WINDOWS\system32\CmdLineExt03.dll
2007-06-28 16:11:24 ——– d—–w C:\Program Files\Maxis
2007-06-28 00:27:49 ——– d—–w C:\Program Files\Hamachi
2007-06-27 23:53:40 3,003 —-a-w C:\WINDOWS\eReg.dat
2007-06-24 16:05:17 ——– d—–w C:\Program Files\OPTI-SAFE Xtreme
2007-06-14 03:56:57 ——– d—–w C:\Program Files\LimeWire
2007-06-02 20:31:49 ——– d—–w C:\Program Files\GameSpot
2007-06-02 20:24:46 99,904 —-a-w C:\WINDOWS\system32\PnkBstrB.exe
2007-06-01 21:01:51 ——– d—–w C:\DOCUME~1\user\APPLIC~1\AOL
2007-05-31 14:08:00 ——– d—–w C:\DOCUME~1\user\APPLIC~1\Subversion
2007-05-31 14:07:25 ——– d—–w C:\Program Files\TortoiseSVN
2007-05-31 04:49:07 ——– d—–w C:\Program Files\QuickTime
2007-05-31 04:47:08 ——– d—–w C:\Program Files\Apple Software Update
2007-05-24 03:58:38 ——– d—–w C:\Program Files\Opera
2007-05-24 02:29:45 ——– d—–w C:\DOCUME~1\user\APPLIC~1\AdobeUM
2007-05-20 16:38:03 ——– d—–w C:\DOCUME~1\user\APPLIC~1\U3
2007-05-20 15:41:19 22,584 —-a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2007-05-20 15:37:08 ——– d—–w C:\Program Files\Save
2007-05-19 19:38:11 ——– d—–w C:\Program Files\DAEMON Tools SearchBar
2007-05-19 19:37:51 ——– d—–w C:\Program Files\DaemonTools_WhenUSave_Installer
2007-05-19 19:35:23 ——– d—–w C:\Program Files\DAEMON Tools
2007-05-19 19:31:26 682,232 —-a-w C:\WINDOWS\system32\drivers\sptd.sys
2007-05-19 16:39:28 ——– d—–w C:\DOCUME~1\user\APPLIC~1\PLAN BASH
2007-05-19 16:38:30 ——– d—–w C:\Program Files\PLAN BASH
2007-05-16 23:02:54 ——– d—–w C:\Program Files\MindArk
2007-05-16 15:12:02 683,520 —-a-w C:\WINDOWS\system32\inetcomm.dll
2007-05-16 05:13:47 163,644 —-a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-05-16 05:13:43 ——– d—–w C:\Program Files\Call of Duty
2007-05-16 04:02:23 ——– d—–w C:\Program Files\Activision
2007-05-15 01:26:50 ——– d—–w C:\Program Files\Common Files\EasyInfo
2007-05-14 01:43:40 ——– d–h–w C:\DOCUME~1\user\APPLIC~1\Move Networks
2007-05-12 20:18:15 ——– d—–w C:\Program Files\Norton Internet Security
2007-05-12 20:07:15 ——– d—–w C:\Program Files\Symantec
2007-05-12 20:07:14 48,776 —-a-w C:\WINDOWS\system32\S32EVNT1.DLL
2007-05-12 20:07:14 115,000 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2007-05-12 19:38:10 0 -c–a-w C:\WINDOWS\system32\taskkill.exe
2007-05-12 18:00:43 ——– d—–w C:\Program Files\Army Operations
2007-05-12 17:16:35 ——– d—–w C:\DOCUME~1\user\APPLIC~1\Verizon
2007-05-12 17:16:34 ——– d—–w C:\Program Files\Verizon
2007-05-12 16:24:28 ——– d—–w C:\Program Files\VZBB Toolbar
2007-05-12 14:03:18 ——– d—–w C:\Program Files\PlayLinc
2007-05-12 13:47:06 ——– d—–w C:\DOCUME~1\user\APPLIC~1\Motive
2007-05-12 13:37:48 ——– d—–w C:\Program Files\Common Files\Motive
2007-05-12 05:14:31 0 -c–a-w C:\WINDOWS\PowerReg.dat
2007-05-12 05:12:00 ——– d—–w C:\Program Files\Infogrames Interactive
2007-05-12 05:07:36 ——– d—–w C:\Program Files\SupportSoft
2007-05-11 23:08:42 ——– d—–w C:\Program Files\Common Files\SupportSoft
2007-04-25 14:21:15 144,896 —-a-w C:\WINDOWS\system32\schannel.dll
2007-04-21 18:43:25 39,384 -c–a-w C:\DOCUME~1\user\APPLIC~1\GDIPFONTCACHEV1.DAT
2007-04-19 20:26:00 888,832 —-a-w C:\WINDOWS\system32\nvmobls.dll
2007-04-19 20:26:00 86,016 —-a-w C:\WINDOWS\system32\nvmctray.dll
2007-04-19 20:26:00 81,920 —-a-w C:\WINDOWS\system32\nvwddi.dll
2007-04-19 20:26:00 794,624 —-a-w C:\WINDOWS\system32\nvcplui.exe
2007-04-19 20:26:00 7,700,480 —-a-w C:\WINDOWS\system32\nvcpl.dll
2007-04-19 20:26:00 581,632 —-a-w C:\WINDOWS\system32\nvhwvid.dll
2007-04-19 20:26:00 5,644,288 —-a-w C:\WINDOWS\system32\nvoglnt.dll
2007-04-19 20:26:00 5,619,712 —-a-w C:\WINDOWS\system32\nvdisps.dll
2007-04-19 20:26:00 466,944 —-a-w C:\WINDOWS\system32\nvshell.dll
2007-04-19 20:26:00 45,056 —-a-w C:\WINDOWS\system32\nvmccsrs.dll
2007-04-19 20:26:00 442,368 —-a-w C:\WINDOWS\system32\nvappbar.exe
2007-04-19 20:26:00 425,984 —-a-w C:\WINDOWS\system32\keystone.exe
2007-04-19 20:26:00 4,543,616 —-a-w C:\WINDOWS\system32\nv4_disp.dll
2007-04-19 20:26:00 35,840 —-a-w C:\WINDOWS\system32\nvcodins.dll
2007-04-19 20:26:00 35,840 —-a-w C:\WINDOWS\system32\nvcod.dll
2007-04-19 20:26:00 311,296 —-a-w C:\WINDOWS\system32\nvexpbar.dll
2007-04-19 20:26:00 3,035,136 —-a-w C:\WINDOWS\system32\nvgames.dll
2007-04-19 20:26:00 286,720 —-a-w C:\WINDOWS\system32\nvnt4cpl.dll
2007-04-19 20:26:00 229,376 —-a-w C:\WINDOWS\system32\nvmccs.dll
2007-04-19 20:26:00 212,992 —-a-w C:\WINDOWS\system32\nvapi.dll
2007-04-19 20:26:00 2,924,544 —-a-w C:\WINDOWS\system32\nvvitvs.dll
2007-04-19 20:26:00 188,416 —-a-w C:\WINDOWS\system32\nvmccss.dll
2007-04-19 20:26:00 147,456 —-a-w C:\WINDOWS\system32\nvcolor.exe
2007-04-19 20:26:00 1,703,936 —-a-w C:\WINDOWS\system32\nvwdmcpl.dll
2007-04-19 20:26:00 1,474,560 —-a-w C:\WINDOWS\system32\nview.dll
2007-04-19 20:26:00 1,339,392 —-a-w C:\WINDOWS\system32\nvdspsch.exe
2007-04-19 20:26:00 1,236,992 —-a-w C:\WINDOWS\system32\nvwss.dll
2007-04-19 20:26:00 1,019,904 —-a-w C:\WINDOWS\system32\nvwimg.dll
2007-04-19 20:26:00 1,011,712 —-a-w C:\WINDOWS\system32\nvcpluir.dll
2007-04-18 23:48:49 10,920 —-a-w C:\aolconnfix.exe
2007-04-18 16:12:23 2,854,400 —-a-w C:\WINDOWS\system32\msi.dll
2007-04-17 05:47:36 33,624 —-a-w C:\WINDOWS\system32\wups.dll
2007-04-17 05:45:54 1,710,936 —-a-w C:\WINDOWS\system32\wuaueng.dll
2007-04-17 05:45:48 549,720 —-a-w C:\WINDOWS\system32\wuapi.dll
2007-04-17 05:45:42 325,976 —-a-w C:\WINDOWS\system32\wucltui.dll
2007-04-17 05:45:36 203,096 —-a-w C:\WINDOWS\system32\wuweb.dll
2007-04-17 05:45:28 92,504 —-a-w C:\WINDOWS\system32\cdm.dll
2007-04-17 05:45:20 53,080 —-a-w C:\WINDOWS\system32\wuauclt.exe
2007-04-17 05:45:20 43,352 —-a-w C:\WINDOWS\system32\wups2.dll

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
2003-11-03 15:17 54248 –a—— C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{31FF080D-12A3-439A-A2EF-4BA95A3148E8}]
2007-01-04 23:57 247112 –a—— C:\Program Files\GetRight\xx2gr.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4E7BD74F-2B8D-469E-D0FC-E57AF4D5FA7D}]
2005-01-12 08:12 1111104 –a—— C:\WINDOWS\DOWNLO~1\vzbb.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
2007-03-14 03:43 501400 –a—— C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9ECB9560-04F9-4bbc-943D-298DDF1699E1}]
2006-02-07 00:35 94384 –a—— C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A8F38D8D-E480-4D52-B7A2-731BB6995FDD}]
2007-04-02 19:19 140912 –a—— C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nwiz"="nwiz.exe" []
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-31 20:42]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-22 22:19]
"nTrayFw"="C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe" [2005-07-26 19:04]
"EasyTuneV"="C:\Program Files\Gigabyte\ET5\GUI.exe" [2004-06-14 20:54]
"CallControl 4.5"="C:\Program Files\FaxTalk Communicator\FTCtrl32.exe" [2004-03-23 16:43]
"SoundMan"="SOUNDMAN.EXE" [2006-03-01 01:22 C:\WINDOWS\soundman.exe]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43]
"AOLDialer"="C:\Program Files\Common Files\AOL\ACS\AOLDial.exe" []
"RealTray"="C:\Program Files\Real\RealPlayer\RealPlay.exe" [2007-02-15 09:04]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2006-10-30 10:36]
"Verizon_McciTrayApp"="C:\Program Files\Verizon\McciTrayApp.exe" [2007-03-11 14:37]
"VerizonServicepoint.exe"="C:\Program Files\Verizon\Servicepoint\VerizonServicepoint.exe" [2006-02-01 18:33]
"ace fork bat option"="C:\Documents and Settings\All Users\Application Data\Book Store Ace Fork\OkayPing.exe" []
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 09:41]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 09:24]
"Aim6"="C:\Program Files\AIM6\aim6.exe" [2007-04-27 14:17]
"HOLDBARB"="C:\DOCUME~1\user\APPLIC~1\PLANBA~1\Online phone pure.exe" [2007-05-19 09:38]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-04-03 15:29]
"µTorrent"="C:\Documents and Settings\user\Desktop\utorrent.exe" [2007-05-19 12:43]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=C:\WINDOWS\system32\tmp_f7.dll

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b33ff348-961c-11db-888c-0016e684cc9a}]
AutoRun\command- K:\LaunchU3.exe -a

*Newly Created Service* - COMHOST

Contents of the 'Scheduled Tasks' folder
2007-07-11 05:00:00 C:\WINDOWS\tasks\A092609A91CE128A.job
2007-05-31 04:47:09 C:\WINDOWS\tasks\AppleSoftwareUpdate.job
2007-07-07 03:00:00 C:\WINDOWS\tasks\Norton AntiVirus - Run Full System Scan - user.job

**************************************************************************

catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-10 10:52:31
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\MarkFun_NT]
"ImagePath"="\??\C:\Program Files\Gigabyte\ET5\markfun.w32"

Completion time: 2007-07-10 10:55:25 - machine was rebooted
C:\ComboFix-quarantined-files.txt … 2007-07-10 10:54
C:\ComboFix2.txt … 2007-07-10 07:44

— E O F —

LDTate

Post #6July 11, 2007, 7:49 PM UTC

Reboot and "copy/paste" a new HijackThis log file into this thread.

Also please describe how your computer behaves at the moment.

SouthSideDiablo

Post #7July 13, 2007, 7:20 PM UTC

Ok, at the moment it seems stable. Before a program called, "Dr Watson Debugging Program" had an error and cause me to restart. But here is the log:

Logfile of HijackThis v1.99.1
Scan saved at 3:19:09 PM, on 7/13/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\TortoiseSVN\bin\TSVNCache.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Verizon\McciTrayApp.exe
C:\Program Files\Verizon\Servicepoint\VerizonServicepoint.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\AIM6\aim6.exe
C:\Documents and Settings\user\Desktop\utorrent.exe
c:\progra~1\intern~1\iexplore.exe
C:\Program Files\GetRight\getright.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Hamachi\hamachi.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla FireFox\firefox.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://wapp.verizon.net/bookmarks/bmredir….p;bm=ho_central
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: bho2gr Class - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - C:\Program Files\GetRight\xx2gr.dll
O2 - BHO: Verizon Broadband Toolbar - {4E7BD74F-2B8D-469E-D0FC-E57AF4D5FA7D} - C:\WINDOWS\DOWNLO~1\vzbb.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: Norton Internet Security 2006 - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Verizon Broadband Toolbar - {4E7BD74F-2B8D-469E-D0FC-E57AF4D5FA7D} - C:\WINDOWS\DOWNLO~1\vzbb.dll
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [nTrayFw] C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe
O4 - HKLM\..\Run: [EasyTuneV] C:\Program Files\Gigabyte\ET5\GUI.exe
O4 - HKLM\..\Run: [CallControl 4.5] C:\Program Files\FaxTalk Communicator\FTCtrl32.exe /autoload
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Verizon_McciTrayApp] C:\Program Files\Verizon\McciTrayApp.exe
O4 - HKLM\..\Run: [VerizonServicepoint.exe] C:\Program Files\Verizon\Servicepoint\VerizonServicepoint.exe
O4 - HKLM\..\Run: [ace fork bat option] C:\Documents and Settings\All Users\Application Data\Book Store Ace Fork\OkayPing.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [HOLDBARB] C:\DOCUME~1\user\APPLIC~1\PLANBA~1\Online phone pure.exe
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [µTorrent] "C:\Documents and Settings\user\Desktop\utorrent.exe"
O4 - Startup: hamachi.lnk = C:\Program Files\Hamachi\hamachi.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: GetRight - Tray Icon.lnk = C:\Program Files\GetRight\getright.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm
O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - https://activatemydsl.verizon.net/sdcCommon…DSL/tgctlcm.cab
O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} (HGPlugin9USA Class) - http://gamedownload.ijjimax.com/gamedownlo…GPlugin9USA.cab
O20 - AppInit_DLLs: C:\WINDOWS\system32\tmp_f7.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe" -k runservice (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - Unknown owner - C:\WINDOWS\system32\nvsvc32.exe (file missing)
O23 - Service: OPTI-SAFE Xtreme OnEvent (onevent) - Unknown owner - C:\Program Files\OPTI-SAFE Xtreme\ntevent.exe (file missing)
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe (file missing)
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: OPTI-SAFE Xtreme UPS (powersrv) - Unknown owner - C:\Program Files\OPTI-SAFE Xtreme\ntsrv.exe (file missing)
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: OPTI-SAFE Xtreme SNMP Agent (SNMPAGENTSRV) - Unknown owner - C:\Program Files\OPTI-SAFE Xtreme\upsagentd.exe (file missing)
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: OPTI-SAFE Xtreme Web Server (upsis) - Unknown owner - C:\Program Files\OPTI-SAFE Xtreme\upsis.exe (file missing)

LDTate

Post #8July 13, 2007, 8:09 PM UTC

Launch Notepad (Start>All Programs>Accessories), and copy/paste all the Quoted REGEDIT below to it. Don't forget to include REGEDIT4.
Save in: Desktop
File Name: fixme.reg
Save as Type: * files
Click: Save

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""

Save this as fix.reg Choose to save as *all files and place it on your desktop.
It should look like this: [external image: Posted Image]
Doubleclick on it and when it asks you if you want to merge the contents to the registry, click yes/ok.
(In case you are unsure how to create a reg file, take a look here with screenshots.)

Reboot and "copy/paste" a new HijackThis log file into this thread.

Also please describe how your computer behaves at the moment.

SouthSideDiablo

Post #9July 14, 2007, 12:36 AM UTC

It's running pretty good. Nothing is crashing or anything.

Logfile of HijackThis v1.99.1
Scan saved at 8:34:47 PM, on 7/13/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\TortoiseSVN\bin\TSVNCache.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Verizon\McciTrayApp.exe
C:\Program Files\Verizon\Servicepoint\VerizonServicepoint.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\AIM6\aim6.exe
C:\Documents and Settings\user\Desktop\utorrent.exe
C:\Program Files\GetRight\getright.exe
C:\Program Files\AIM6\aolsoftware.exe
c:\progra~1\intern~1\iexplore.exe
C:\Program Files\Hamachi\hamachi.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\AIM6\aolsoftware.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://wapp.verizon.net/bookmarks/bmredir….p;bm=ho_central
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: bho2gr Class - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - C:\Program Files\GetRight\xx2gr.dll
O2 - BHO: Verizon Broadband Toolbar - {4E7BD74F-2B8D-469E-D0FC-E57AF4D5FA7D} - C:\WINDOWS\DOWNLO~1\vzbb.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: Norton Internet Security 2006 - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Verizon Broadband Toolbar - {4E7BD74F-2B8D-469E-D0FC-E57AF4D5FA7D} - C:\WINDOWS\DOWNLO~1\vzbb.dll
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [nTrayFw] C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe
O4 - HKLM\..\Run: [EasyTuneV] C:\Program Files\Gigabyte\ET5\GUI.exe
O4 - HKLM\..\Run: [CallControl 4.5] C:\Program Files\FaxTalk Communicator\FTCtrl32.exe /autoload
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Verizon_McciTrayApp] C:\Program Files\Verizon\McciTrayApp.exe
O4 - HKLM\..\Run: [VerizonServicepoint.exe] C:\Program Files\Verizon\Servicepoint\VerizonServicepoint.exe
O4 - HKLM\..\Run: [ace fork bat option] C:\Documents and Settings\All Users\Application Data\Book Store Ace Fork\OkayPing.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [HOLDBARB] C:\DOCUME~1\user\APPLIC~1\PLANBA~1\Online phone pure.exe
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [µTorrent] "C:\Documents and Settings\user\Desktop\utorrent.exe"
O4 - Startup: hamachi.lnk = C:\Program Files\Hamachi\hamachi.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: GetRight - Tray Icon.lnk = C:\Program Files\GetRight\getright.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm
O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - https://activatemydsl.verizon.net/sdcCommon…DSL/tgctlcm.cab
O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} (HGPlugin9USA Class) - http://gamedownload.ijjimax.com/gamedownlo…GPlugin9USA.cab
O20 - AppInit_DLLs: C:\WINDOWS\system32\tmp_f7.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe" -k runservice (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service - Unknown owner - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifEng.dll (file missing)
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - Unknown owner - C:\WINDOWS\system32\nvsvc32.exe (file missing)
O23 - Service: OPTI-SAFE Xtreme OnEvent (onevent) - Unknown owner - C:\Program Files\OPTI-SAFE Xtreme\ntevent.exe (file missing)
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe (file missing)
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: OPTI-SAFE Xtreme UPS (powersrv) - Unknown owner - C:\Program Files\OPTI-SAFE Xtreme\ntsrv.exe (file missing)
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: OPTI-SAFE Xtreme SNMP Agent (SNMPAGENTSRV) - Unknown owner - C:\Program Files\OPTI-SAFE Xtreme\upsagentd.exe (file missing)
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: OPTI-SAFE Xtreme Web Server (upsis) - Unknown owner - C:\Program Files\OPTI-SAFE Xtreme\upsis.exe (file missing)

LDTate

Post #10July 14, 2007, 12:40 AM UTC

Please Download NoLop to your desktop from one of the links below…
Link 1 http://www.spywareedge.net/nolop/NoLop.exe

Link 2 http://www.spywaretimes.com/Tools/download…ab6208a197bcc5/

First close any other programs you have running as this will require a reboot
Double click NoLop.exe to run it.
Now click the button labelled "Search and Destroy"
<>
When scanning is finished you will be prompted to reboot only if infected, Click OK
Now click the "REBOOT" Button.
A Message should popup from NoLop. If not, double click the program again and it will finish Please Post the contents of C:\NoLop.log along with a fresh HijackThis log

–If you receive an error, "mscomctl.ocx or one of its dependencies are not correctly registered," please download mscomctl.ocx to your system32 folder then rerun the program.] –
__________________

SouthSideDiablo

Post #11July 14, 2007, 1:19 AM UTC

Here is the log from NoLop:

NoLop! Log by Skate_Punk_21

Fix running from: C:\Documents and Settings\[removed]\Desktop
[7/13/2007]
[9:12:17 PM]

—Infection Files Found/Removed—
C:\WINDOWS\tasks\A092609A91CE128A.job

Beginning Removal…
Rebooting…
Removing Lop's Leftover Files/Folders…
Editing Registry…
**Fix Complete!**

—Listing AppData sub directories—

C:\Documents and Settings\All Users\Application Data\Adobe
C:\Documents and Settings\All Users\Application Data\Aol
C:\Documents and Settings\All Users\Application Data\Aol Downloads
C:\Documents and Settings\All Users\Application Data\Aol Ocp
C:\Documents and Settings\All Users\Application Data\Apple Computer
C:\Documents and Settings\All Users\Application Data\Bvrp Software
C:\Documents and Settings\All Users\Application Data\Cyberlink
C:\Documents and Settings\All Users\Application Data\Getrighttogo
C:\Documents and Settings\All Users\Application Data\Microsoft
C:\Documents and Settings\All Users\Application Data\Motive – EMPTY Directory
C:\Documents and Settings\All Users\Application Data\Nvidia
C:\Documents and Settings\All Users\Application Data\Nview_profiles – EMPTY Directory
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
C:\Documents and Settings\All Users\Application Data\Symantec
C:\Documents and Settings\All Users\Application Data\Temp – EMPTY Directory
C:\Documents and Settings\All Users\Application Data\Viewpoint
C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
C:\Documents and Settings\All Users\Application Data\Winzip
C:\Documents and Settings\Default User\Application Data\Identities
C:\Documents and Settings\Default User\Application Data\Microsoft
C:\Documents and Settings\Guest\Application Data\Aol
C:\Documents and Settings\Guest\Application Data\Getright
C:\Documents and Settings\Guest\Application Data\Identities
C:\Documents and Settings\Guest\Application Data\Limewire
C:\Documents and Settings\Guest\Application Data\Macromedia
C:\Documents and Settings\Guest\Application Data\Microsoft
C:\Documents and Settings\Guest\Application Data\Motive
C:\Documents and Settings\Guest\Application Data\Opera
C:\Documents and Settings\Guest\Application Data\Symantec
C:\Documents and Settings\Guest\Application Data\Verizon
C:\Documents and Settings\Localservice\Application Data\Microsoft
C:\Documents and Settings\Networkservice\Application Data\Aol
C:\Documents and Settings\Networkservice\Application Data\Microsoft
C:\Documents and Settings\User\Application Data\Acccore
C:\Documents and Settings\User\Application Data\Adobe
C:\Documents and Settings\User\Application Data\Adobeum – EMPTY Directory
C:\Documents and Settings\User\Application Data\Aim – EMPTY Directory
C:\Documents and Settings\User\Application Data\Aol – EMPTY Directory
C:\Documents and Settings\User\Application Data\Apple Computer
C:\Documents and Settings\User\Application Data\Command & Conquer 3 Tiberium Wars Demo
C:\Documents and Settings\User\Application Data\Cyberlink
C:\Documents and Settings\User\Application Data\Dvdcss
C:\Documents and Settings\User\Application Data\Hamachi
C:\Documents and Settings\User\Application Data\Help – EMPTY Directory
C:\Documents and Settings\User\Application Data\Icechat
C:\Documents and Settings\User\Application Data\Identities
C:\Documents and Settings\User\Application Data\Installshield
C:\Documents and Settings\User\Application Data\Leadertech
C:\Documents and Settings\User\Application Data\Limewire
C:\Documents and Settings\User\Application Data\Macromedia
C:\Documents and Settings\User\Application Data\Microsoft
C:\Documents and Settings\User\Application Data\Motive
C:\Documents and Settings\User\Application Data\Move Networks
C:\Documents and Settings\User\Application Data\Mozilla
C:\Documents and Settings\User\Application Data\Opera
C:\Documents and Settings\User\Application Data\Pc Tools
C:\Documents and Settings\User\Application Data\Petroglyph
C:\Documents and Settings\User\Application Data\Plan Bash
C:\Documents and Settings\User\Application Data\Subversion
C:\Documents and Settings\User\Application Data\Sun
C:\Documents and Settings\User\Application Data\Symantec
C:\Documents and Settings\User\Application Data\U3
C:\Documents and Settings\User\Application Data\Utorrent
C:\Documents and Settings\User\Application Data\Verizon
C:\Documents and Settings\User\Application Data\Viewpoint
C:\Documents and Settings\User\Application Data\Vlc
C:\Documents and Settings\User\Application Data\Vso
C:\Documents and Settings\User\Application Data\You've Got Pictures Screensaver

And a fresh HighjackThis:

Logfile of HijackThis v1.99.1
Scan saved at 9:18:52 PM, on 7/13/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\TortoiseSVN\bin\TSVNCache.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Verizon\McciTrayApp.exe
C:\Program Files\Verizon\Servicepoint\VerizonServicepoint.exe
C:\Program Files\AIM6\aim6.exe
C:\Documents and Settings\user\Desktop\utorrent.exe
c:\progra~1\intern~1\iexplore.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\Program Files\Hamachi\hamachi.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: bho2gr Class - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - C:\Program Files\GetRight\xx2gr.dll
O2 - BHO: Verizon Broadband Toolbar - {4E7BD74F-2B8D-469E-D0FC-E57AF4D5FA7D} - C:\WINDOWS\DOWNLO~1\vzbb.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: Norton Internet Security 2006 - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Verizon Broadband Toolbar - {4E7BD74F-2B8D-469E-D0FC-E57AF4D5FA7D} - C:\WINDOWS\DOWNLO~1\vzbb.dll
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [nTrayFw] C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe
O4 - HKLM\..\Run: [EasyTuneV] C:\Program Files\Gigabyte\ET5\GUI.exe
O4 - HKLM\..\Run: [CallControl 4.5] C:\Program Files\FaxTalk Communicator\FTCtrl32.exe /autoload
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Verizon_McciTrayApp] C:\Program Files\Verizon\McciTrayApp.exe
O4 - HKLM\..\Run: [VerizonServicepoint.exe] C:\Program Files\Verizon\Servicepoint\VerizonServicepoint.exe
O4 - HKLM\..\Run: [ace fork bat option] C:\Documents and Settings\All Users\Application Data\Book Store Ace Fork\OkayPing.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [HOLDBARB] C:\DOCUME~1\user\APPLIC~1\PLANBA~1\Online phone pure.exe
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [µTorrent] "C:\Documents and Settings\user\Desktop\utorrent.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: hamachi.lnk = C:\Program Files\Hamachi\hamachi.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: GetRight - Tray Icon.lnk = C:\Program Files\GetRight\getright.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm
O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - https://activatemydsl.verizon.net/sdcCommon…DSL/tgctlcm.cab
O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} (HGPlugin9USA Class) - http://gamedownload.ijjimax.com/gamedownlo…GPlugin9USA.cab
O20 - AppInit_DLLs: C:\WINDOWS\system32\tmp_f7.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe" -k runservice (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service - Unknown owner - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifEng.dll (file missing)
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - Unknown owner - C:\WINDOWS\system32\nvsvc32.exe (file missing)
O23 - Service: OPTI-SAFE Xtreme OnEvent (onevent) - Unknown owner - C:\Program Files\OPTI-SAFE Xtreme\ntevent.exe (file missing)
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe (file missing)
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: OPTI-SAFE Xtreme UPS (powersrv) - Unknown owner - C:\Program Files\OPTI-SAFE Xtreme\ntsrv.exe (file missing)
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: OPTI-SAFE Xtreme SNMP Agent (SNMPAGENTSRV) - Unknown owner - C:\Program Files\OPTI-SAFE Xtreme\upsagentd.exe (file missing)
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: OPTI-SAFE Xtreme Web Server (upsis) - Unknown owner - C:\Program Files\OPTI-SAFE Xtreme\upsis.exe (file missing)

SouthSideDiablo

Post #12July 14, 2007, 1:26 AM UTC

A program called "Dr Watson Debugging Program" has been crashing lately. When it crashes, i can not use my taskbar or anything.

LDTate

Post #13July 14, 2007, 1:31 AM UTC

Close all windows and browsers.
Open HijackThis

Click on Open Misc Tools
Click on Delete a File On Reboot
Click once on the file below to select it:
C:\Documents and Settings\All Users\Application Data\Book Store Ace Fork\OkayPing.exe

Click on the Back button to exit Process Manager

Now, back at the main screen of HijackThis, proceed to Scan.
and put a check by these.

O4 - HKLM\..\Run: [ace fork bat option] C:\Documents and Settings\All Users\Application Data\Book Store Ace Fork\OkayPing.exe

Close ALL windows and browsers except HijackThis and click "Fix checked"

Reboot and "copy/paste" a new HijackThis log file into this thread.

Also please describe how your computer behaves at the moment.

SouthSideDiablo

Post #14July 14, 2007, 1:54 AM UTC

It seems to be running good.

Logfile of HijackThis v1.99.1
Scan saved at 6:53:04 PM, on 7/13/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\TortoiseSVN\bin\TSVNCache.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Verizon\McciTrayApp.exe
C:\Program Files\Verizon\Servicepoint\VerizonServicepoint.exe
C:\Program Files\AIM6\aim6.exe
C:\Documents and Settings\user\Desktop\utorrent.exe
C:\Program Files\Messenger\msmsgs.exe
c:\progra~1\intern~1\iexplore.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\Program Files\Hamachi\hamachi.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
c:\program files\aim6\anotify.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: bho2gr Class - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - C:\Program Files\GetRight\xx2gr.dll
O2 - BHO: Verizon Broadband Toolbar - {4E7BD74F-2B8D-469E-D0FC-E57AF4D5FA7D} - C:\WINDOWS\DOWNLO~1\vzbb.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: Norton Internet Security 2006 - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Verizon Broadband Toolbar - {4E7BD74F-2B8D-469E-D0FC-E57AF4D5FA7D} - C:\WINDOWS\DOWNLO~1\vzbb.dll
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [nTrayFw] C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe
O4 - HKLM\..\Run: [EasyTuneV] C:\Program Files\Gigabyte\ET5\GUI.exe
O4 - HKLM\..\Run: [CallControl 4.5] C:\Program Files\FaxTalk Communicator\FTCtrl32.exe /autoload
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Verizon_McciTrayApp] C:\Program Files\Verizon\McciTrayApp.exe
O4 - HKLM\..\Run: [VerizonServicepoint.exe] C:\Program Files\Verizon\Servicepoint\VerizonServicepoint.exe
O4 - HKLM\..\Run: [ace fork bat option] C:\Documents and Settings\All Users\Application Data\Book Store Ace Fork\OkayPing.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [HOLDBARB] C:\DOCUME~1\user\APPLIC~1\PLANBA~1\Online phone pure.exe
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [µTorrent] "C:\Documents and Settings\user\Desktop\utorrent.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: hamachi.lnk = C:\Program Files\Hamachi\hamachi.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: GetRight - Tray Icon.lnk = C:\Program Files\GetRight\getright.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm
O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - https://activatemydsl.verizon.net/sdcCommon…DSL/tgctlcm.cab
O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} (HGPlugin9USA Class) - http://gamedownload.ijjimax.com/gamedownlo…GPlugin9USA.cab
O20 - AppInit_DLLs: C:\WINDOWS\system32\tmp_f7.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe" -k runservice (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service - Unknown owner - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifEng.dll (file missing)
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - Unknown owner - C:\WINDOWS\system32\nvsvc32.exe (file missing)
O23 - Service: OPTI-SAFE Xtreme OnEvent (onevent) - Unknown owner - C:\Program Files\OPTI-SAFE Xtreme\ntevent.exe (file missing)
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe (file missing)
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: OPTI-SAFE Xtreme UPS (powersrv) - Unknown owner - C:\Program Files\OPTI-SAFE Xtreme\ntsrv.exe (file missing)
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: OPTI-SAFE Xtreme SNMP Agent (SNMPAGENTSRV) - Unknown owner - C:\Program Files\OPTI-SAFE Xtreme\upsagentd.exe (file missing)
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: OPTI-SAFE Xtreme Web Server (upsis) - Unknown owner - C:\Program Files\OPTI-SAFE Xtreme\upsis.exe (file missing)

LDTate

Post #15July 14, 2007, 1:57 AM UTC

We still have a couple bad ones.

Double click combofix.exe and follow the prompts.
When finished, it shall produce a log for you, combofix.txt. Post that log and a HiJackthis log in your next reply

Note: Do not mouseclick combofix's window while its running. That may cause it to stall

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved]Please Help

✨ Ask AI

Ask AI