[Resolved]Please Help Me

Well I have been getting several adware popups and i ran scans detecting many cookies, registry keys, and contaminated files. Also when i open TaskMgr.exe i get a second one that lags the computer up and also creates popups. I kindly ask for help and want to thank you for taking time to help me

Logfile of HijackThis v1.99.1
Scan saved at 11:23:33 PM, on 7/10/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\COMMON~1\YMANTE~1\wucrtupd.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter.exe
C:\Documents and Settings\HP_Owner\Desktop\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/…/search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://yahoo.sbc.com/dsl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/…/search/ie.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.sbc.com/dsl
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Common\ycomp5_1_6_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {174F4D8C-D26F-ADEC-1C60-8F8DBE5385C6} - C:\WINDOWS\system32\xduoxj.dll
O2 - BHO: BHOAd - {85589B5D-D53D-4237-A677-46B82EA275F3} - C:\WINDOWS\xhelper.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - c:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: Helper Class - {D80C4E21-C346-4E21-8E64-20746AA20AEB} - C:\Program Files\NavExcel Search Toolbar\NavExcelBar.dll (file missing)
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - c:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Common\ycomp5_1_6_0.dll
O3 - Toolbar: NavExcel Toolbar - {5AA06644-BC46-4220-A460-47A6EB47C96D} - C:\Program Files\NavExcel Search Toolbar\NavExcelBar.dll (file missing)
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [DeadAIM] rundll32.exe "C:\Program Files\AIM\\DeadAIM.ocm",ExportedCheckODLs
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [AutoTBar] c:\Program Files\HP\Digital Imaging\bin\AUTOTBAR.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [runner1] C:\WINDOWS\retadpu11.exe 61A847B5BBF72813338B2B27128065E9C084320161C4661227A755E9C2933154389A
O4 - HKLM\..\Run: [SpyHunter] C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [Srro] "C:\PROGRA~1\COMMON~1\YMANTE~1\wucrtupd.exe" -vt ndrv
O4 - HKCU\..\Run: [Jtzmi] "C:\Documents and Settings\HP_Owner\My Documents\??crosoft\t?skmgr.exe"
O4 - HKCU\..\Run: [ares] "C:\Documents and Settings\HP_Owner\Desktop\DeskTop\Diablo 2 editor\Anime\A-Z\A-D\Ares\bak\Ares.exe" -h
O8 - Extra context menu item: Add To HP Organize… - C:\PROGRA~1\HEWLET~1\HPORGA~1\bin\core.hp.main\SendTo.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O9 - Extra button: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\Common\ylogin.dll
O9 - Extra 'Tools' menuitem: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\Common\ylogin.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {69EF49E5-FE46-4B92-B5FA-2193AB7A6B8A} (GameLauncher Control) - http://www.acclaim.com/cabs/acclaim_v5.cab
O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} (HGPlugin9USA Class) - http://gamedownload.ijjimax.com/gamedownlo…GPlugin9USA.cab
O20 - AppInit_DLLs:
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: SAVScan - Symantec Corporation - c:\Program Files\Norton AntiVirus\SAVScan.exe

Also, i close the second taskmgr.exe because it severely lags up my computer and brings the CPU number up to the high 90's
Here is the log from ComboFix


"HP_Owner" - 2007-07-11 15:08:22 - ComboFix 07-07-12 - Service Pack 2

/wow section - STAGE #8

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\Program Files\Common Files\Yazzle1275OinAdmin.exe
C:\Program Files\Common Files\Yazzle1275OinUninstaller.exe
C:\WINDOWS\system32\462pT2S4.exe
C:\WINDOWS\system32\wnstsicomsv32.exe
C:\WINDOWS\system32\xduoxj.dll


((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))


——-\LEGACY_NM
——-\nm


((((((((((((((((((((((((( Files Created from 2007-06-11 to 2007-07-11 )))))))))))))))))))))))))))))))


2007-07-11 15:06 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-07-10 23:08 d——– C:\Program Files\Enigma Software Group
2007-07-10 23:01 dr–s—- C:\WINDOWS\F?nts
2007-07-08 21:52 d——– C:\Program Files\Incomplete
2007-07-02 23:42 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\WinZip
2007-07-02 12:31 126,976 –a—— C:\WINDOWS\xhelper.dll
2007-07-01 15:59 d——– C:\Q3Ademo
2007-06-29 20:34 d–h—– C:\WINDOWS\PIF
2007-06-27 19:17 dr–s—- C:\WINDOWS\??sembly
2007-06-27 12:52 d——– C:\DOCUME~1\HP_Owner\APPLIC~1\??crosoft.NET
2007-06-23 12:55 d——– C:\Program Files\çasks
2007-06-22 09:38 122,880 –a—— C:\WINDOWS\xmlhelper2.dll
2007-06-22 08:22 d——– C:\DOCUME~1\HP_Owner\APPLIC~1\Sonic
2007-06-22 08:21 d——– C:\DOCUME~1\HP_Owner\APPLIC~1\Leadertech
2007-06-15 16:11 122,880 –a—— C:\WINDOWS\xmlhelper.dll


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-07-11 01:34:08 ——– d—–w C:\DOCUME~1\HP_Owner\APPLIC~1\AdobeUM
2007-07-10 22:38:12 ——– d—–w C:\Program Files\World of Warcraft
2007-07-10 20:04:13 ——– d—–w C:\Program Files\Warcraft III
2007-07-09 04:52:27 ——– d—–w C:\Program Files\LimeWire
2007-07-04 18:14:10 ——– d—–w C:\Program Files\Easy Internet signup
2007-06-27 23:39:13 ——– d—–w C:\Program Files\Real Alternative
2007-06-27 19:52:47 ——– d—–w C:\DOCUME~1\HP_Owner\APPLIC~1\??crosoft.NET
2007-06-23 19:55:48 ——– d—–w C:\Program Files\?asks
2007-06-09 04:35:49 ——– d—–w C:\DOCUME~1\HP_Owner\APPLIC~1\Viewpoint
2007-06-09 02:03:50 ——– d—–w C:\Program Files\AIM6
2007-06-09 01:54:43 ——– d—–w C:\Program Files\Viewpoint
2007-06-06 23:42:30 ——– d—–w C:\DOCUME~1\HP_Owner\APPLIC~1\??pPatch
2007-06-05 04:18:30 ——– d—–w C:\Program Files\Common Files\Blizzard Entertainment
2007-06-02 20:09:32 ——– d—–w C:\Program Files\?icrosoft.NET
2007-06-01 01:37:43 ——– d—–w C:\DOCUME~1\HP_Owner\APPLIC~1\SBTT
2007-05-31 22:04:48 ——– d—–w C:\Program Files\T?sks
2007-05-30 01:16:38 ——– d–h–w C:\Program Files\InstallShield Installation Information
2007-05-30 01:16:38 ——– d—–w C:\Program Files\Scions of Fate
2007-05-23 01:02:38 ——– d—–w C:\DOCUME~1\HP_Owner\APPLIC~1\A?pPatch
2007-05-21 02:39:45 ——– d—–w C:\Program Files\Common Files\?ymantec
2007-05-20 22:35:07 ——– d—–w C:\Program Files\QuickTime
2007-05-20 22:34:45 ——– d—–w C:\Program Files\nickarcade
2007-05-20 22:34:12 ——– d—–w C:\Program Files\iTunes
2007-05-20 22:32:10 ——– d—–w C:\Program Files\AIM
2007-05-20 22:17:35 ——– d—–w C:\Program Files\Alwil Software
2007-05-20 22:14:41 ——– d—–w C:\DOCUME~1\HP_Owner\APPLIC~1\Uniblue
2007-05-20 22:13:17 ——– d—–w C:\Program Files\Common Files\Wise Installation Wizard
2007-05-20 22:07:37 ——– d—–w C:\Program Files\LIUtilities
2007-05-20 17:43:07 ——– d—–w C:\Program Files\Uniblue
2007-05-20 17:12:37 ——– d—–w C:\Program Files\InetGet2
2007-05-20 16:36:03 ——– d—–w C:\Program Files\Outerinfo
2007-04-20 23:11:46 11,524 —-a-w C:\WINDOWS\system32\cxscheca001.dll


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]
2003-06-20 19:57 209489 –a—— C:\Program Files\Yahoo!\Common\ycomp5_1_6_0.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
2003-11-03 21:17 54248 –a—— C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{85589B5D-D53D-4237-A677-46B82EA275F3}]
2007-07-02 12:31 126976 –a—— C:\WINDOWS\xhelper.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BDF3E430-B101-42AD-A544-FADC6B084872}]
2004-06-04 17:46 103552 –a—— c:\Program Files\Norton AntiVirus\NavShExt.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D80C4E21-C346-4E21-8E64-20746AA20AEB}]
C:\Program Files\NavExcel Search Toolbar\NavExcelBar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AGRSMMSG"="AGRSMMSG.exe" [2005-03-04 12:01 C:\WINDOWS\AGRSMMSG.exe]
"DeadAIM"="C:\Program Files\AIM\\DeadAIM.ocm" [2004-02-28 13:12]
"VTTimer"="VTTimer.exe" [2004-10-22 12:53 C:\WINDOWS\system32\VTTimer.exe]
"ViewMgr"="C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe" []
"AutoTBar"="c:\Program Files\HP\Digital Imaging\bin\AUTOTBAR.EXE" []
"SpyHunter"="C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter.exe" [2007-04-26 19:03]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-11-21 12:42]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 12:00]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 09:24]
"Aim6"="C:\Program Files\AIM6\aim6.exe" [2007-04-27 14:17]
"Srro"="C:\PROGRA~1\COMMON~1\YMANTE~1\wucrtupd.exe" [2007-05-20 19:39]
"Jtzmi"="C:\Documents and Settings\HP_Owner\My Documents\??crosoft\t?skmgr.exe" [2007-06-20 07:50]
"ares"="C:\Documents and Settings\HP_Owner\Desktop\DeskTop\Diablo 2 editor\Anime\A-Z\A-D\Ares\bak\Ares.exe" [2005-01-17 08:07]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"RunNarrator"=Narrator.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"AllowLegacyWebView"=1 (0x1)
"AllowUnhashedWebView"=1 (0x1)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{BC0CFA58-3A6F-51ba-9EFE-B320F4F621BA}"="C:\WINDOWS\system32\cxscheca001.dll" [2007-04-20 16:11]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.exe.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.exe.lnk
backup=C:\WINDOWS\pss\Adobe Gamma Loader.exe.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digimax Viewer 2.1.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Digimax Viewer 2.1.lnk
backup=C:\WINDOWS\pss\Digimax Viewer 2.1.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^SBC Self Support Tool.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\SBC Self Support Tool.lnk
backup=C:\WINDOWS\pss\SBC Self Support Tool.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Updates from HP.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Updates from HP.lnk
backup=C:\WINDOWS\pss\Updates from HP.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^HP_Owner^Start Menu^Programs^Startup^HP Organize.lnk]
path=C:\Documents and Settings\HP_Owner\Start Menu\Programs\Startup\HP Organize.lnk
backup=C:\WINDOWS\pss\HP Organize.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcxMonitor]
ALCXMNTR.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ares]
"C:\Documents and Settings\HP_Owner\Desktop\DeskTop\Diablo 2 editor\Ares\Ares.exe" -h

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp]
"C:\Program Files\Common Files\Symantec Shared\ccApp.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IpWins]
C:\Program Files\Ipwindows\ipwins.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Motive SmartBridge]
C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\navapp]
C:\Program Files\NavExcel\NavHelper\v2.0.4d\navapp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
nwiz.exe /install

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
C:\Program Files\Steam\Steam.exe -silent

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
1

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"YPCService"=3 (0x3)
"xmlprov"=3 (0x3)
"wscsvc"=2 (0x2)
"WmiApSrv"=3 (0x3)
"SymWSC"=2 (0x2)
"SNDSrvc"=3 (0x3)
"navapsvc"=2 (0x2)
"Messenger"=3 (0x3)
"Fax"=3 (0x3)
"CiSvc"=3 (0x3)
"ccSetMgr"=2 (0x2)
"ccPwdSvc"=3 (0x3)
"ccEvtMgr"=2 (0x2)


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\K]
AutoRun\command- K:\LaunchU3.exe -a


Contents of the 'Scheduled Tasks' folder
2007-07-08 07:00:30 C:\WINDOWS\tasks\At1.job
2007-06-29 16:00:00 C:\WINDOWS\tasks\At10.job
2007-06-30 17:01:20 C:\WINDOWS\tasks\At11.job
2007-07-09 18:01:15 C:\WINDOWS\tasks\At12.job
2007-07-11 19:01:32 C:\WINDOWS\tasks\At13.job
2007-07-11 20:00:37 C:\WINDOWS\tasks\At14.job
2007-07-11 21:00:37 C:\WINDOWS\tasks\At15.job
2007-07-11 22:00:39 C:\WINDOWS\tasks\At16.job
2007-07-10 23:01:24 C:\WINDOWS\tasks\At17.job
2007-07-11 00:00:30 C:\WINDOWS\tasks\At18.job
2007-07-11 01:00:30 C:\WINDOWS\tasks\At19.job
2007-07-07 08:00:30 C:\WINDOWS\tasks\At2.job
2007-07-11 02:00:30 C:\WINDOWS\tasks\At20.job
2007-07-11 03:00:30 C:\WINDOWS\tasks\At21.job
2007-07-11 04:00:30 C:\WINDOWS\tasks\At22.job
2007-07-11 05:00:30 C:\WINDOWS\tasks\At23.job
2007-07-11 06:00:33 C:\WINDOWS\tasks\At24.job
2007-06-29 09:00:00 C:\WINDOWS\tasks\At3.job
2007-06-29 10:00:00 C:\WINDOWS\tasks\At4.job
2007-06-29 11:00:00 C:\WINDOWS\tasks\At5.job
2007-06-29 12:00:00 C:\WINDOWS\tasks\At6.job
2007-06-29 13:00:00 C:\WINDOWS\tasks\At7.job
2007-07-03 14:00:01 C:\WINDOWS\tasks\At8.job
2007-06-29 15:00:00 C:\WINDOWS\tasks\At9.job
2007-07-07 03:00:26 C:\WINDOWS\tasks\Norton AntiVirus - Scan my computer - HP_Owner.job
2005-01-14 01:04:39 C:\WINDOWS\tasks\Symantec NetDetect.job
2007-05-20 22:00:13 C:\WINDOWS\tasks\Uniblue SpyEraser.job

**************************************************************************

catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-11 15:16:12
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-07-11 15:18:10 - machine was rebooted
C:\ComboFix-quarantined-files.txt … 2007-07-11 15:17

— E O F —

"HP_Owner" - 2007-07-11 18:06:59 - ComboFix 07-07-12 - Service Pack 2

/wow section - STAGE #8

((((((((((((((((((((((((( Files Created from 2007-06-12 to 2007-07-12 )))))))))))))))))))))))))))))))


2007-07-11 15:06 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-07-10 23:08 d——– C:\Program Files\Enigma Software Group
2007-07-10 23:01 dr–s—- C:\WINDOWS\F?nts
2007-07-08 21:52 d——– C:\Program Files\Incomplete
2007-07-02 23:42 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\WinZip
2007-07-02 12:31 126,976 –a—— C:\WINDOWS\xhelper.dll
2007-07-01 15:59 d——– C:\Q3Ademo
2007-06-29 20:34 d–h—– C:\WINDOWS\PIF
2007-06-27 19:17 dr–s—- C:\WINDOWS\??sembly
2007-06-27 12:52 d——– C:\DOCUME~1\HP_Owner\APPLIC~1\??crosoft.NET
2007-06-23 12:55 d——– C:\Program Files\çasks
2007-06-22 09:38 122,880 –a—— C:\WINDOWS\xmlhelper2.dll
2007-06-22 08:22 d——– C:\DOCUME~1\HP_Owner\APPLIC~1\Sonic
2007-06-22 08:21 d——– C:\DOCUME~1\HP_Owner\APPLIC~1\Leadertech
2007-06-15 16:11 122,880 –a—— C:\WINDOWS\xmlhelper.dll


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-07-11 01:34:08 ——– d—–w C:\DOCUME~1\HP_Owner\APPLIC~1\AdobeUM
2007-07-10 22:38:12 ——– d—–w C:\Program Files\World of Warcraft
2007-07-10 20:04:13 ——– d—–w C:\Program Files\Warcraft III
2007-07-09 04:52:27 ——– d—–w C:\Program Files\LimeWire
2007-07-04 18:14:10 ——– d—–w C:\Program Files\Easy Internet signup
2007-06-27 23:39:13 ——– d—–w C:\Program Files\Real Alternative
2007-06-27 19:52:47 ——– d—–w C:\DOCUME~1\HP_Owner\APPLIC~1\??crosoft.NET
2007-06-23 19:55:48 ——– d—–w C:\Program Files\?asks
2007-06-09 04:35:49 ——– d—–w C:\DOCUME~1\HP_Owner\APPLIC~1\Viewpoint
2007-06-09 02:03:50 ——– d—–w C:\Program Files\AIM6
2007-06-09 01:54:43 ——– d—–w C:\Program Files\Viewpoint
2007-06-06 23:42:30 ——– d—–w C:\DOCUME~1\HP_Owner\APPLIC~1\??pPatch
2007-06-05 04:18:30 ——– d—–w C:\Program Files\Common Files\Blizzard Entertainment
2007-06-02 20:09:32 ——– d—–w C:\Program Files\?icrosoft.NET
2007-06-01 01:37:43 ——– d—–w C:\DOCUME~1\HP_Owner\APPLIC~1\SBTT
2007-05-31 22:04:48 ——– d—–w C:\Program Files\T?sks
2007-05-30 01:16:38 ——– d–h–w C:\Program Files\InstallShield Installation Information
2007-05-30 01:16:38 ——– d—–w C:\Program Files\Scions of Fate
2007-05-23 01:02:38 ——– d—–w C:\DOCUME~1\HP_Owner\APPLIC~1\A?pPatch
2007-05-21 02:39:45 ——– d—–w C:\Program Files\Common Files\?ymantec
2007-05-20 22:35:07 ——– d—–w C:\Program Files\QuickTime
2007-05-20 22:34:45 ——– d—–w C:\Program Files\nickarcade
2007-05-20 22:34:12 ——– d—–w C:\Program Files\iTunes
2007-05-20 22:32:10 ——– d—–w C:\Program Files\AIM
2007-05-20 22:17:35 ——– d—–w C:\Program Files\Alwil Software
2007-05-20 22:14:41 ——– d—–w C:\DOCUME~1\HP_Owner\APPLIC~1\Uniblue
2007-05-20 22:13:17 ——– d—–w C:\Program Files\Common Files\Wise Installation Wizard
2007-05-20 22:07:37 ——– d—–w C:\Program Files\LIUtilities
2007-05-20 17:43:07 ——– d—–w C:\Program Files\Uniblue
2007-05-20 17:12:37 ——– d—–w C:\Program Files\InetGet2
2007-05-20 16:36:03 ——– d—–w C:\Program Files\Outerinfo
2007-04-20 23:11:46 11,524 —-a-w C:\WINDOWS\system32\cxscheca001.dll


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]
2003-06-20 19:57 209489 –a—— C:\Program Files\Yahoo!\Common\ycomp5_1_6_0.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
2003-11-03 21:17 54248 –a—— C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{85589B5D-D53D-4237-A677-46B82EA275F3}]
2007-07-02 12:31 126976 –a—— C:\WINDOWS\xhelper.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BDF3E430-B101-42AD-A544-FADC6B084872}]
2004-06-04 17:46 103552 –a—— c:\Program Files\Norton AntiVirus\NavShExt.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D80C4E21-C346-4E21-8E64-20746AA20AEB}]
C:\Program Files\NavExcel Search Toolbar\NavExcelBar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AGRSMMSG"="AGRSMMSG.exe" [2005-03-04 12:01 C:\WINDOWS\AGRSMMSG.exe]
"DeadAIM"="C:\Program Files\AIM\\DeadAIM.ocm" [2004-02-28 13:12]
"VTTimer"="VTTimer.exe" [2004-10-22 12:53 C:\WINDOWS\system32\VTTimer.exe]
"ViewMgr"="C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe" []
"AutoTBar"="c:\Program Files\HP\Digital Imaging\bin\AUTOTBAR.EXE" []

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 12:00]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 09:24]
"Aim6"="C:\Program Files\AIM6\aim6.exe" [2007-04-27 14:17]
"Srro"="C:\PROGRA~1\COMMON~1\YMANTE~1\wucrtupd.exe" [2007-05-20 19:39]
"Jtzmi"="C:\Documents and Settings\HP_Owner\My Documents\??crosoft\t?skmgr.exe" [2007-06-20 07:50]
"ares"="C:\Documents and Settings\HP_Owner\Desktop\DeskTop\Diablo 2 editor\Anime\A-Z\A-D\Ares\bak\Ares.exe" [2005-01-17 08:07]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"RunNarrator"=Narrator.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"AllowLegacyWebView"=1 (0x1)
"AllowUnhashedWebView"=1 (0x1)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{BC0CFA58-3A6F-51ba-9EFE-B320F4F621BA}"="C:\WINDOWS\system32\cxscheca001.dll" [2007-04-20 16:11]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.exe.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.exe.lnk
backup=C:\WINDOWS\pss\Adobe Gamma Loader.exe.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digimax Viewer 2.1.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Digimax Viewer 2.1.lnk
backup=C:\WINDOWS\pss\Digimax Viewer 2.1.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^SBC Self Support Tool.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\SBC Self Support Tool.lnk
backup=C:\WINDOWS\pss\SBC Self Support Tool.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Updates from HP.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Updates from HP.lnk
backup=C:\WINDOWS\pss\Updates from HP.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^HP_Owner^Start Menu^Programs^Startup^HP Organize.lnk]
path=C:\Documents and Settings\HP_Owner\Start Menu\Programs\Startup\HP Organize.lnk
backup=C:\WINDOWS\pss\HP Organize.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcxMonitor]
ALCXMNTR.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ares]
"C:\Documents and Settings\HP_Owner\Desktop\DeskTop\Diablo 2 editor\Ares\Ares.exe" -h

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp]
"C:\Program Files\Common Files\Symantec Shared\ccApp.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IpWins]
C:\Program Files\Ipwindows\ipwins.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Motive SmartBridge]
C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\navapp]
C:\Program Files\NavExcel\NavHelper\v2.0.4d\navapp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
nwiz.exe /install

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
C:\Program Files\Steam\Steam.exe -silent

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
1

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"YPCService"=3 (0x3)
"xmlprov"=3 (0x3)
"wscsvc"=2 (0x2)
"WmiApSrv"=3 (0x3)
"SymWSC"=2 (0x2)
"SNDSrvc"=3 (0x3)
"navapsvc"=2 (0x2)
"Messenger"=3 (0x3)
"Fax"=3 (0x3)
"CiSvc"=3 (0x3)
"ccSetMgr"=2 (0x2)
"ccPwdSvc"=3 (0x3)
"ccEvtMgr"=2 (0x2)


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\K]
AutoRun\command- K:\LaunchU3.exe -a

*Newly Created Service* - CATCHME

Contents of the 'Scheduled Tasks' folder
2007-07-08 07:00:30 C:\WINDOWS\tasks\At1.job
2007-06-29 16:00:00 C:\WINDOWS\tasks\At10.job
2007-06-30 17:01:20 C:\WINDOWS\tasks\At11.job
2007-07-09 18:01:15 C:\WINDOWS\tasks\At12.job
2007-07-11 19:01:32 C:\WINDOWS\tasks\At13.job
2007-07-11 20:00:37 C:\WINDOWS\tasks\At14.job
2007-07-11 21:00:37 C:\WINDOWS\tasks\At15.job
2007-07-11 22:00:39 C:\WINDOWS\tasks\At16.job
2007-07-11 23:00:00 C:\WINDOWS\tasks\At17.job
2007-07-12 00:00:00 C:\WINDOWS\tasks\At18.job
2007-07-12 01:00:00 C:\WINDOWS\tasks\At19.job
2007-07-07 08:00:30 C:\WINDOWS\tasks\At2.job
2007-07-11 02:00:30 C:\WINDOWS\tasks\At20.job
2007-07-11 03:00:30 C:\WINDOWS\tasks\At21.job
2007-07-11 04:00:30 C:\WINDOWS\tasks\At22.job
2007-07-11 05:00:30 C:\WINDOWS\tasks\At23.job
2007-07-11 06:00:33 C:\WINDOWS\tasks\At24.job
2007-06-29 09:00:00 C:\WINDOWS\tasks\At3.job
2007-06-29 10:00:00 C:\WINDOWS\tasks\At4.job
2007-06-29 11:00:00 C:\WINDOWS\tasks\At5.job
2007-06-29 12:00:00 C:\WINDOWS\tasks\At6.job
2007-06-29 13:00:00 C:\WINDOWS\tasks\At7.job
2007-07-03 14:00:01 C:\WINDOWS\tasks\At8.job
2007-06-29 15:00:00 C:\WINDOWS\tasks\At9.job
2007-07-07 03:00:26 C:\WINDOWS\tasks\Norton AntiVirus - Scan my computer - HP_Owner.job
2005-01-14 01:04:39 C:\WINDOWS\tasks\Symantec NetDetect.job
2007-05-20 22:00:13 C:\WINDOWS\tasks\Uniblue SpyEraser.job

**************************************************************************

catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-11 18:14:50
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-07-11 18:15:29
C:\ComboFix-quarantined-files.txt … 2007-07-11 18:15
C:\ComboFix2.txt … 2007-07-11 15:18

— E O F —

Hijack this -

Adobe Acrobat - Reader 6.0.2 Update
Adobe Flash Player 9 ActiveX
Adobe Photoshop 6.0
Adobe Reader 6.0.1
Adobe SVG Viewer
Agere Systems PCI Soft Modem
AIM 6
Allok RM RMVB to AVI MPEG DVD Converter 1.4.4
AOL Instant Messenger
AVG Anti-Spyware 7.5
BroadJump Client Foundation
CC_ccStart
ccCommon
DeadAIM
Digimax Viewer 2.1
DivX
DivX Converter
DivX Player
DivX Web Player
Help and Support Additions
High Definition Audio Driver Package - KB835221
HijackThis 1.99.1
Hotfix for Windows XP (KB926239)
HP Deskjet Preloaded Printer Drivers
HP Image Zone Plus 4.2
HP Organize
HP Photo & Imaging 3.5 - HP Devices
HP PSC & OfficeJet 4.0
HP Software Update
IntelliMover Data Transfer Demo
InterVideo WinDVD Player
iPod for Windows 2006-03-23
iTunes
J2SE Runtime Environment 5.0 Update 1
KBD
KSignAccessToolkit v1.0
LimeWire PRO 4.8.1
LiveReg (Symantec Corporation)
LiveUpdate 1.90 (Symantec Corporation)
Microsoft .NET Framework 1.1
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Office 2003 Web Components
Microsoft Office Standard Edition 2003
Microsoft Office XP Web Components
Microsoft Plus! Dancer LE
Microsoft Plus! Digital Media Edition Installer
Microsoft Plus! Photo Story 2 LE
Microsoft Works 7.0
middle_man
Mozilla Firefox (1.5.0.12)
MSN
MSN Music Assistant
MSRedist
muvee autoProducer 3.5 magicMoments - HPD
NavExcel Search Toolbar (remove only)
Nick Aracde Toolbar
Norton AntiVirus 2004
Norton AntiVirus 2004 (Symantec Corporation)
Norton AntiVirus Parent MSI
Norton Internet Security
Norton WMI Update
NVIDIA Drivers
PC-Doctor for Windows
Photosmart 320,370,7400,8100,8400 Series
Python 2.2 combined Win32 extensions
Python 2.2.1
QuickTime
Real Alternative 1.51
River Past Audio Converter Pro
S3 S3Display
S3 S3Gamma2
S3 S3Info2
S3 S3Overlay
SBC Self Support Tool
SBC Yahoo! Applications
Security Update for Step By Step Interactive Training (KB898458)
Security Update for Windows XP (KB883939)
Security Update for Windows XP (KB890046)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896422)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB896688)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899588)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB903235)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Sonic RecordNow!
Ultra RM Converter 2.3.6
Update for Windows XP (KB894391)
Update for Windows XP (KB896727)
Update for Windows XP (KB898461)
Updates from HP
Ventrilo Client
VIA/S3G Display Driver
Video Converter 3
Viewpoint Media Player
Visual IP InSight(SBC)
WC3Banlist
WildTangent Web Driver
Windows Installer 3.1 (KB893803)
Windows Installer 3.1 (KB893803)
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Player 11
Windows Media Player 11
Windows XP Hotfix - KB834707
Windows XP Hotfix - KB867282
Windows XP Hotfix - KB873333
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB883667
Windows XP Hotfix - KB885250
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB887742
Windows XP Hotfix - KB888113
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890047
Windows XP Hotfix - KB890175
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB890923
Windows XP Hotfix - KB891781
Windows XP Hotfix - KB893066
Windows XP Hotfix - KB893086
WinPcap 3.1
WinRAR archiver
WinZip 11.1
World of Warcraft

ComboFix -

"HP_Owner" - 2007-07-12 13:46:02 - ComboFix 07-07-12 - Service Pack 2

/wow section - STAGE #8

((((((((((((((((((((((((( Files Created from 2007-06-12 to 2007-07-12 )))))))))))))))))))))))))))))))


2007-07-11 19:57 10,872 –a—— C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-07-11 15:06 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-07-10 23:08 d——– C:\Program Files\Enigma Software Group
2007-07-10 23:01 dr–s—- C:\WINDOWS\F?nts
2007-07-08 21:52 d——– C:\Program Files\Incomplete
2007-07-02 23:42 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\WinZip
2007-07-02 12:31 126,976 –a—— C:\WINDOWS\xhelper.dll
2007-07-01 15:59 d——– C:\Q3Ademo
2007-06-29 20:34 d–h—– C:\WINDOWS\PIF
2007-06-27 19:17 dr–s—- C:\WINDOWS\??sembly
2007-06-27 12:52 d——– C:\DOCUME~1\HP_Owner\APPLIC~1\??crosoft.NET
2007-06-23 12:55 d——– C:\Program Files\çasks
2007-06-22 08:22 d——– C:\DOCUME~1\HP_Owner\APPLIC~1\Sonic
2007-06-22 08:21 d——– C:\DOCUME~1\HP_Owner\APPLIC~1\Leadertech


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-07-12 03:04:37 ——– d—–w C:\Program Files\Common Files\?ymantec
2007-07-12 02:19:44 ——– d—–w C:\Program Files\Warcraft III
2007-07-11 01:34:08 ——– d—–w C:\DOCUME~1\HP_Owner\APPLIC~1\AdobeUM
2007-07-10 22:38:12 ——– d—–w C:\Program Files\World of Warcraft
2007-07-09 04:52:27 ——– d—–w C:\Program Files\LimeWire
2007-07-04 18:14:10 ——– d—–w C:\Program Files\Easy Internet signup
2007-06-27 23:39:13 ——– d—–w C:\Program Files\Real Alternative
2007-06-27 19:52:47 ——– d—–w C:\DOCUME~1\HP_Owner\APPLIC~1\??crosoft.NET
2007-06-23 19:55:48 ——– d—–w C:\Program Files\?asks
2007-06-09 04:35:49 ——– d—–w C:\DOCUME~1\HP_Owner\APPLIC~1\Viewpoint
2007-06-09 02:03:50 ——– d—–w C:\Program Files\AIM6
2007-06-09 01:54:43 ——– d—–w C:\Program Files\Viewpoint
2007-06-06 23:42:30 ——– d—–w C:\DOCUME~1\HP_Owner\APPLIC~1\??pPatch
2007-06-05 04:18:30 ——– d—–w C:\Program Files\Common Files\Blizzard Entertainment
2007-06-02 20:09:32 ——– d—–w C:\Program Files\?icrosoft.NET
2007-06-01 01:37:43 ——– d—–w C:\DOCUME~1\HP_Owner\APPLIC~1\SBTT
2007-05-31 22:04:48 ——– d—–w C:\Program Files\T?sks
2007-05-30 01:16:38 ——– d–h–w C:\Program Files\InstallShield Installation Information
2007-05-30 01:16:38 ——– d—–w C:\Program Files\Scions of Fate
2007-05-23 01:02:38 ——– d—–w C:\DOCUME~1\HP_Owner\APPLIC~1\A?pPatch
2007-05-20 22:35:07 ——– d—–w C:\Program Files\QuickTime
2007-05-20 22:34:45 ——– d—–w C:\Program Files\nickarcade
2007-05-20 22:34:12 ——– d—–w C:\Program Files\iTunes
2007-05-20 22:32:10 ——– d—–w C:\Program Files\AIM
2007-05-20 22:17:35 ——– d—–w C:\Program Files\Alwil Software
2007-05-20 22:14:41 ——– d—–w C:\DOCUME~1\HP_Owner\APPLIC~1\Uniblue
2007-05-20 22:13:17 ——– d—–w C:\Program Files\Common Files\Wise Installation Wizard
2007-05-20 22:07:37 ——– d—–w C:\Program Files\LIUtilities
2007-05-20 17:43:07 ——– d—–w C:\Program Files\Uniblue
2007-05-20 17:12:37 ——– d—–w C:\Program Files\InetGet2
2007-05-20 16:36:03 ——– d—–w C:\Program Files\Outerinfo


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]
2003-06-20 19:57 209489 –a—— C:\Program Files\Yahoo!\Common\ycomp5_1_6_0.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
2003-11-03 21:17 54248 –a—— C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{85589B5D-D53D-4237-A677-46B82EA275F3}]
2007-07-02 12:31 126976 –a—— C:\WINDOWS\xhelper.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BDF3E430-B101-42AD-A544-FADC6B084872}]
2004-06-04 17:46 103552 –a—— c:\Program Files\Norton AntiVirus\NavShExt.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D80C4E21-C346-4E21-8E64-20746AA20AEB}]
C:\Program Files\NavExcel Search Toolbar\NavExcelBar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AGRSMMSG"="AGRSMMSG.exe" [2005-03-04 12:01 C:\WINDOWS\AGRSMMSG.exe]
"DeadAIM"="C:\Program Files\AIM\\DeadAIM.ocm" [2004-02-28 13:12]
"VTTimer"="VTTimer.exe" [2004-10-22 12:53 C:\WINDOWS\system32\VTTimer.exe]
"ViewMgr"="C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe" []
"AutoTBar"="c:\Program Files\HP\Digital Imaging\bin\AUTOTBAR.EXE" []
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 02:25]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 12:00]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 09:24]
"Aim6"="C:\Program Files\AIM6\aim6.exe" [2007-04-27 14:17]
"Srro"="C:\PROGRA~1\COMMON~1\YMANTE~1\wucrtupd.exe" []
"Jtzmi"="C:\Documents and Settings\HP_Owner\My Documents\??crosoft\t?skmgr.exe" []
"ares"="C:\Documents and Settings\HP_Owner\Desktop\DeskTop\Diablo 2 editor\Anime\A-Z\A-D\Ares\bak\Ares.exe" [2005-01-17 08:07]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"RunNarrator"=Narrator.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"AllowLegacyWebView"=1 (0x1)
"AllowUnhashedWebView"=1 (0x1)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{BC0CFA58-3A6F-51ba-9EFE-B320F4F621BA}"="C:\WINDOWS\system32\cxscheca001.dll" []
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll" [2007-05-30 05:29]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\AVG Anti-Spyware Driver]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\AVG Anti-Spyware Guard]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.exe.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.exe.lnk
backup=C:\WINDOWS\pss\Adobe Gamma Loader.exe.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digimax Viewer 2.1.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Digimax Viewer 2.1.lnk
backup=C:\WINDOWS\pss\Digimax Viewer 2.1.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^SBC Self Support Tool.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\SBC Self Support Tool.lnk
backup=C:\WINDOWS\pss\SBC Self Support Tool.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Updates from HP.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Updates from HP.lnk
backup=C:\WINDOWS\pss\Updates from HP.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^HP_Owner^Start Menu^Programs^Startup^HP Organize.lnk]
path=C:\Documents and Settings\HP_Owner\Start Menu\Programs\Startup\HP Organize.lnk
backup=C:\WINDOWS\pss\HP Organize.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcxMonitor]
ALCXMNTR.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ares]
"C:\Documents and Settings\HP_Owner\Desktop\DeskTop\Diablo 2 editor\Ares\Ares.exe" -h

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp]
"C:\Program Files\Common Files\Symantec Shared\ccApp.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IpWins]
C:\Program Files\Ipwindows\ipwins.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Motive SmartBridge]
C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\navapp]
C:\Program Files\NavExcel\NavHelper\v2.0.4d\navapp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
nwiz.exe /install

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
C:\Program Files\Steam\Steam.exe -silent

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
1

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"YPCService"=3 (0x3)
"xmlprov"=3 (0x3)
"wscsvc"=2 (0x2)
"WmiApSrv"=3 (0x3)
"SymWSC"=2 (0x2)
"SNDSrvc"=3 (0x3)
"navapsvc"=2 (0x2)
"Messenger"=3 (0x3)
"Fax"=3 (0x3)
"CiSvc"=3 (0x3)
"ccSetMgr"=2 (0x2)
"ccPwdSvc"=3 (0x3)
"ccEvtMgr"=2 (0x2)


Contents of the 'Scheduled Tasks' folder
2007-07-08 07:00:30 C:\WINDOWS\tasks\At1.job
2007-06-29 16:00:00 C:\WINDOWS\tasks\At10.job
2007-06-30 17:01:20 C:\WINDOWS\tasks\At11.job
2007-07-09 18:01:15 C:\WINDOWS\tasks\At12.job
2007-07-12 19:00:00 C:\WINDOWS\tasks\At13.job
2007-07-12 20:00:00 C:\WINDOWS\tasks\At14.job
2007-07-11 21:00:37 C:\WINDOWS\tasks\At15.job
2007-07-11 22:00:39 C:\WINDOWS\tasks\At16.job
2007-07-11 23:00:00 C:\WINDOWS\tasks\At17.job
2007-07-12 00:00:00 C:\WINDOWS\tasks\At18.job
2007-07-12 01:00:00 C:\WINDOWS\tasks\At19.job
2007-07-07 08:00:30 C:\WINDOWS\tasks\At2.job
2007-07-12 02:00:00 C:\WINDOWS\tasks\At20.job
2007-07-12 03:00:00 C:\WINDOWS\tasks\At21.job
2007-07-11 04:00:30 C:\WINDOWS\tasks\At22.job
2007-07-11 05:00:30 C:\WINDOWS\tasks\At23.job
2007-07-12 06:00:00 C:\WINDOWS\tasks\At24.job
2007-06-29 09:00:00 C:\WINDOWS\tasks\At3.job
2007-06-29 10:00:00 C:\WINDOWS\tasks\At4.job
2007-06-29 11:00:00 C:\WINDOWS\tasks\At5.job
2007-06-29 12:00:00 C:\WINDOWS\tasks\At6.job
2007-06-29 13:00:00 C:\WINDOWS\tasks\At7.job
2007-07-03 14:00:01 C:\WINDOWS\tasks\At8.job
2007-06-29 15:00:00 C:\WINDOWS\tasks\At9.job
2007-07-07 03:00:26 C:\WINDOWS\tasks\Norton AntiVirus - Scan my computer - HP_Owner.job
2005-01-14 01:04:39 C:\WINDOWS\tasks\Symantec NetDetect.job
2007-05-20 22:00:13 C:\WINDOWS\tasks\Uniblue SpyEraser.job

**************************************************************************

catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-12 13:52:33
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-07-12 13:53:22
C:\ComboFix-quarantined-files.txt … 2007-07-12 13:53
C:\ComboFix2.txt … 2007-07-11 18:15
C:\ComboFix3.txt … 2007-07-11 15:18

— E O F —

A. Please disable AVG AntiSpyware by opening the program and on the Status page - beside "Resident Shield" click on "change status" so that it says "inactive" for it may interfere with our HJT fix.

• Remember to reactivate this feature when all our work is finished.

B. Please download the OTMoveIt by OldTimer

• Save it to your desktop.
• DO NOT RUN IT YET

C. Go Start then Run and type Notepad.exe to open a blank Notepad file.

• Now copy and paste the the following files and folders in bold into that Notepad file:
  
  
  C:\WINDOWS\tasks\At1.job
  C:\WINDOWS\tasks\At10.job
  C:\WINDOWS\tasks\At11.job
  C:\WINDOWS\tasks\At12.job
  C:\WINDOWS\tasks\At13.job
  C:\WINDOWS\tasks\At14.job
  C:\WINDOWS\tasks\At15.job
  C:\WINDOWS\tasks\At16.job
  C:\WINDOWS\tasks\At17.job
  C:\WINDOWS\tasks\At18.job
  C:\WINDOWS\tasks\At19.job
  C:\WINDOWS\tasks\At20.job
  C:\WINDOWS\tasks\At21.job
  C:\WINDOWS\tasks\At22.job
  C:\WINDOWS\tasks\At23.job
  C:\WINDOWS\tasks\At24.job
  C:\WINDOWS\tasks\At3.job
  C:\WINDOWS\tasks\At4.job
  C:\WINDOWS\tasks\At5.job
  C:\WINDOWS\tasks\At6.job
  C:\WINDOWS\tasks\At7.job
  C:\WINDOWS\tasks\At8.job
  C:\WINDOWS\tasks\At9.job
  C:\ALCXMNTR.EXE
  C:\WINDOWS\system32\cxscheca001.dll
  C:\WINDOWS\xhelper.dll
  C:\WINDOWS\retadpu11.exe
  C:\Program Files\InetGet2
  C:\Program Files\Outerinfo
  C:\Program Files\çasks
  
  
• Save the file to your Desktop (Important) as Delete.txt
• Close Notepad.

D. Please print out or copy this page to Notepad. Make sure to work through the fixes in the exact order in which they are mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes.

• First we need to make all files and folders VISIBLE:
  
  • Go to start>control panel>folder options>view
  • Choose to "show hidden files and folders,"
  • Uncheck the "hide protected operating system files" and the "hide extensions for know file types" boxes.
  • Close the window with ok
• Please RUN HijackThis.
  . Click the SCAN button to produce a log.
  
  
• Place a check mark beside each one of the following items:
  
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/…/search/ie.html
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/…/search/ie.html
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
  R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
  O2 - BHO: (no name) - {174F4D8C-D26F-ADEC-1C60-8F8DBE5385C6} - C:\WINDOWS\system32\xduoxj.dll
  O2 - BHO: BHOAd - {85589B5D-D53D-4237-A677-46B82EA275F3} - C:\WINDOWS\xhelper.dll
  O2 - BHO: Helper Class - {D80C4E21-C346-4E21-8E64-20746AA20AEB} - C:\Program Files\NavExcel Search Toolbar\NavExcelBar.dll (file missing)
  O3 - Toolbar: NavExcel Toolbar - {5AA06644-BC46-4220-A460-47A6EB47C96D} - C:\Program Files\NavExcel Search Toolbar\NavExcelBar.dll (file missing)
  O4 - HKLM\..\Run: [runner1] C:\WINDOWS\retadpu11.exe 61A847B5BBF72813338B2B27128065E9C084320161C4661227A755E9C2933154389A
  O4 - HKCU\..\Run: [Srro] "C:\PROGRA~1\COMMON~1\YMANTE~1\wucrtupd.exe" -vt ndrv
  O4 - HKCU\..\Run: [Jtzmi] "C:\Documents and Settings\HP_Owner\My Documents\??crosoft\t?skmgr.exe"
  O20 - AppInit_DLLs:
  
  
  
• Now with all the items selected, and all windows closed except for HJT, delete them by clicking the FIX checked button. Close the HijackThis window.
  
  
• Please double-click OTMoveIt.exe to start the tool.
  • Copy the file paths from Delete.txt to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):
  • Return to OTMoveIt, right click on the "Paste List of Files/Folders to be moved" window
  • Choose Paste.
  • Click the red Moveit! button.
  • Copy everything on the Results window to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it on your next reply.
  • Close OTMoveIt
• Reboot Your System in Safe Mode
  
  How to use the F8 method to Start Your Computer in Safe Mode
  
  
  • Restart the computer.
  • As soon as BIOS is loaded begin tapping the F8 key until the Advanced Options menu appears.
  • Use the arrow keys to select the Safe mode menu item
  • Press Enter.
• Using the Add/Remove Programs module in your Control Panel, please UNINSTALL the following program(s). These programs are either malware or come bundled with malware or they are foistware, i-e programs that are usually installed without the user's consent.
  
  
  WildTangent Web Driver
  
  
  See the following if you want a more in-depth explanation:
  
  http://www.bleepingcomputer.com/uninstall/all.html
  
  and/or
  
  http://www.spywarewarrior.com/rogue_anti-s…re.htm#products
  
  
  
  
• Using Windows Explorer (Windows Key + E), locate the following folders, and DELETE them (if still present):
  
  C:\WINDOWS\F?nts
  C:\WINDOWS\??sembly
  C:\DOCUMENTS and SETTINGS\HP_Owner\APPLICATION DATA\??crosoft.NET
  C:\DOCUMENTS and SETTINGS\HP_Owner\APPLICATION DATA\??pPatch
  C:\Program Files\?icrosoft.NET
  C:\DOCUMENTS and SETTINGS\HP_Owner\APPLICATION DATA\A?pPatch
  C:\Program Files\Common Files\?ymantec
  C:\Program Files\T?sks
  
  Locating the correct folders is the difficult part. As you can see, all the folders to delete have one or more ?? in their names. When you look on your computer, these ?? could be any character including Chinese letters, letters from the Cyrillic alphabet or they even ccould be the correct caracters (??icrosoft could actually be Microsoft). If in doubt, right click on the folder and choose Properties. The big companies will have their name in the properties. Malware doesn't. If you are still unsure, write down the full path of the folder (remembering where it was in the tree) and report the folder name to me when you have finished with all the rest.
  
  
• Exit Explorer, and REBOOT BACK INTO NORMAL MODE
  
  
• Finally, RUN Hijackthis again and produce a new HJT log. Post it in this thread so we can check how everything looks now.

Regards,

Trevuren

One quick thing before the Hijackthis log.

When i was checking the selected items, i wasnt able to find the second of the first two, and first of the last 3

R1 - HKLM\software\microsoft\internet explorer\main,Search Bar= http://red.clientapps.yahoo.com/customize…./search/ie.html
R1 - HKLM\software\microsoft\internet explorer\main,Search Page= http://red.clientapps.yahoo.com/customize….//www.yahoo.com
O2 - BHO: (no name) - {174F4D8C-D26F-ADEC-1C60-8F8DBE5385C6} -C:\WINDOWS\system31\xduoxj.dll
O4 - HKLM\..\Run: [runner1] C:\WINDOWS\retadpu11.exe
61A847B5BBF72813338B2B27128065E9C084320161C46612247A755E9C2933154389A

Logfile of HijackThis v1.99.1
Scan saved at 6:35:19 PM, on 7/12/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\system32\VTTimer.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\AIM6\aim6.exe
C:\Documents and Settings\HP_Owner\Desktop\DeskTop\Diablo 2 editor\Anime\A-Z\A-D\Ares\bak\Ares.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Documents and Settings\HP_Owner\Desktop\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://yahoo.sbc.com/dsl
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Common\ycomp5_1_6_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - c:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - c:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Common\ycomp5_1_6_0.dll
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [DeadAIM] rundll32.exe "C:\Program Files\AIM\\DeadAIM.ocm",ExportedCheckODLs
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [AutoTBar] c:\Program Files\HP\Digital Imaging\bin\AUTOTBAR.EXE
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [ares] "C:\Documents and Settings\HP_Owner\Desktop\DeskTop\Diablo 2 editor\Anime\A-Z\A-D\Ares\bak\Ares.exe" -h
O8 - Extra context menu item: Add To HP Organize… - C:\PROGRA~1\HEWLET~1\HPORGA~1\bin\core.hp.main\SendTo.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O9 - Extra button: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\Common\ylogin.dll
O9 - Extra 'Tools' menuitem: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\Common\ylogin.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {5F5F9FB8-878E-4455-95E0-F64B2314288A} (ijjiPlugin2 Class) - http://gamedownload.ijjimax.com/gamedownlo…Plugin11USA.cab
O16 - DPF: {69EF49E5-FE46-4B92-B5FA-2193AB7A6B8A} (GameLauncher Control) - http://www.acclaim.com/cabs/acclaim_v5.cab
O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} (HGPlugin9USA Class) - http://gamedownload.ijjimax.com/gamedownlo…GPlugin9USA.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: SAVScan - Symantec Corporation - c:\Program Files\Norton AntiVirus\SAVScan.exe

"HP_Owner" - 2007-07-12 19:52:55 - ComboFix 07-07-13.8 - Service Pack 2 NTFS


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\DOCUME~1\HP_Owner\MYDOCU~1.\crosof~1
C:\DOCUME~1\HP_Owner\MYDOCU~1.\curity~1
C:\DOCUME~1\HP_Owner\MYDOCU~1.\wnsxs~1
C:\Program Files\tsks~1
C:\WINDOWS\system32\kernel32.exe
C:\WINDOWS\wr.txt


((((((((((((((((((((((((( Files Created from 2007-06-13 to 2007-07-13 )))))))))))))))))))))))))))))))


2007-07-12 19:52 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-07-12 17:53 d–h—– C:\DOCUME~1\HP_Owner\APPLIC~1\ijjigame
2007-07-11 19:57 10,872 –a—— C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-07-10 23:08 d——– C:\Program Files\Enigma Software Group
2007-07-08 21:52 d——– C:\Program Files\Incomplete
2007-07-02 23:42 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\WinZip
2007-07-01 15:59 d——– C:\Q3Ademo
2007-06-29 20:34 d–h—– C:\WINDOWS\PIF
2007-06-22 08:22 d——– C:\DOCUME~1\HP_Owner\APPLIC~1\Sonic
2007-06-22 08:21 d——– C:\DOCUME~1\HP_Owner\APPLIC~1\Leadertech


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-07-13 01:23:19 ——– d—–w C:\Program Files\WildTangent
2007-07-13 00:51:24 ——– d—–w C:\Program Files\Warcraft III
2007-07-11 01:34:08 ——– d—–w C:\DOCUME~1\HP_Owner\APPLIC~1\AdobeUM
2007-07-10 22:38:12 ——– d—–w C:\Program Files\World of Warcraft
2007-07-09 04:52:27 ——– d—–w C:\Program Files\LimeWire
2007-07-04 18:14:10 ——– d—–w C:\Program Files\Easy Internet signup
2007-06-27 23:39:13 ——– d—–w C:\Program Files\Real Alternative
2007-06-09 04:35:49 ——– d—–w C:\DOCUME~1\HP_Owner\APPLIC~1\Viewpoint
2007-06-09 02:03:50 ——– d—–w C:\Program Files\AIM6
2007-06-09 01:54:43 ——– d—–w C:\Program Files\Viewpoint
2007-06-05 04:18:30 ——– d—–w C:\Program Files\Common Files\Blizzard Entertainment
2007-06-01 01:37:43 ——– d—–w C:\DOCUME~1\HP_Owner\APPLIC~1\SBTT
2007-05-30 01:16:38 ——– d–h–w C:\Program Files\InstallShield Installation Information
2007-05-30 01:16:38 ——– d—–w C:\Program Files\Scions of Fate
2007-05-20 22:35:07 ——– d—–w C:\Program Files\QuickTime
2007-05-20 22:34:45 ——– d—–w C:\Program Files\nickarcade
2007-05-20 22:34:12 ——– d—–w C:\Program Files\iTunes
2007-05-20 22:32:10 ——– d—–w C:\Program Files\AIM
2007-05-20 22:17:35 ——– d—–w C:\Program Files\Alwil Software
2007-05-20 22:14:41 ——– d—–w C:\DOCUME~1\HP_Owner\APPLIC~1\Uniblue
2007-05-20 22:13:17 ——– d—–w C:\Program Files\Common Files\Wise Installation Wizard
2007-05-20 22:07:37 ——– d—–w C:\Program Files\LIUtilities
2007-05-20 17:43:07 ——– d—–w C:\Program Files\Uniblue


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]
2003-06-20 19:57 209489 –a—— C:\Program Files\Yahoo!\Common\ycomp5_1_6_0.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
2003-11-03 21:17 54248 –a—— C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BDF3E430-B101-42AD-A544-FADC6B084872}]
2004-06-04 17:46 103552 –a—— c:\Program Files\Norton AntiVirus\NavShExt.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AGRSMMSG"="AGRSMMSG.exe" [2005-03-04 12:01 C:\WINDOWS\AGRSMMSG.exe]
"DeadAIM"="C:\Program Files\AIM\\DeadAIM.ocm" [2004-02-28 13:12]
"VTTimer"="VTTimer.exe" [2004-10-22 12:53 C:\WINDOWS\system32\VTTimer.exe]
"ViewMgr"="C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe" []
"AutoTBar"="c:\Program Files\HP\Digital Imaging\bin\AUTOTBAR.EXE" []
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 02:25]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 12:00]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 09:24]
"Aim6"="C:\Program Files\AIM6\aim6.exe" [2007-04-27 14:17]
"ares"="C:\Documents and Settings\HP_Owner\Desktop\DeskTop\Diablo 2 editor\Anime\A-Z\A-D\Ares\bak\Ares.exe" [2005-01-17 08:07]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"RunNarrator"=Narrator.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"AllowLegacyWebView"=1 (0x1)
"AllowUnhashedWebView"=1 (0x1)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{BC0CFA58-3A6F-51ba-9EFE-B320F4F621BA}"="C:\WINDOWS\system32\cxscheca001.dll" []
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll" [2007-05-30 05:29]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\AVG Anti-Spyware Driver]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\AVG Anti-Spyware Guard]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.exe.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.exe.lnk
backup=C:\WINDOWS\pss\Adobe Gamma Loader.exe.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digimax Viewer 2.1.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Digimax Viewer 2.1.lnk
backup=C:\WINDOWS\pss\Digimax Viewer 2.1.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^SBC Self Support Tool.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\SBC Self Support Tool.lnk
backup=C:\WINDOWS\pss\SBC Self Support Tool.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Updates from HP.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Updates from HP.lnk
backup=C:\WINDOWS\pss\Updates from HP.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^HP_Owner^Start Menu^Programs^Startup^HP Organize.lnk]
path=C:\Documents and Settings\HP_Owner\Start Menu\Programs\Startup\HP Organize.lnk
backup=C:\WINDOWS\pss\HP Organize.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcxMonitor]
ALCXMNTR.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ares]
"C:\Documents and Settings\HP_Owner\Desktop\DeskTop\Diablo 2 editor\Ares\Ares.exe" -h

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp]
"C:\Program Files\Common Files\Symantec Shared\ccApp.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IpWins]
C:\Program Files\Ipwindows\ipwins.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Motive SmartBridge]
C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\navapp]
C:\Program Files\NavExcel\NavHelper\v2.0.4d\navapp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
nwiz.exe /install

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
C:\Program Files\Steam\Steam.exe -silent

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
1

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"YPCService"=3 (0x3)
"xmlprov"=3 (0x3)
"wscsvc"=2 (0x2)
"WmiApSrv"=3 (0x3)
"SymWSC"=2 (0x2)
"SNDSrvc"=3 (0x3)
"navapsvc"=2 (0x2)
"Messenger"=3 (0x3)
"Fax"=3 (0x3)
"CiSvc"=3 (0x3)
"ccSetMgr"=2 (0x2)
"ccPwdSvc"=3 (0x3)
"ccEvtMgr"=2 (0x2)


Contents of the 'Scheduled Tasks' folder
2007-07-07 08:00:30 C:\WINDOWS\tasks\At2.job
2007-07-07 03:00:26 C:\WINDOWS\tasks\Norton AntiVirus - Scan my computer - HP_Owner.job
2005-01-14 01:04:39 C:\WINDOWS\tasks\Symantec NetDetect.job
2007-05-20 22:00:13 C:\WINDOWS\tasks\Uniblue SpyEraser.job

**************************************************************************

catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-12 19:58:46
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-07-12 19:59:14
C:\ComboFix-quarantined-files.txt … 2007-07-12 19:59

— E O F —