What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved]Hjt Log For Missing Control Panel

27 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I was asked to post a HJT log here by Doug, over in the "Other Computer Problems" section.

I upgraded the Dell Dimension 8100 that was a 256MB RAM Windows Me machine to 768 MB of RAM and Windows XP Home SP2.

Everything seems OK, except I can't get the Control Panel to appear. Doug's been really helpful with me on this, and asked that I post a log here to see if anyone here could figure out what's going on.

Thanks in advance–Tom vonHatten

Logfile of HijackThis v1.99.1
Scan saved at 7:18:08 PM, on 7/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\Tablet.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\WTablet\TabUserW.exe
C:\WINDOWS\system32\Tablet.exe
C:\WINDOWS\system32\CTHELPER.EXE
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\All Users\Desktop\System Integrity\hijackthis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN2\YCOMP5_5_7_0.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL
O2 - BHO: SpywareGuardDLBLOCK.CBrowserHelper - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\PROGRAM FILES\SPYWAREGUARD\DLPROTECT.DLL
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN2\YCOMP5_5_7_0.DLL
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe"
O4 - HKLM\..\Run: [IntelliPoint] "c:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\RunServices: [MOSearch] C:\PROGRA~1\COMMON~1\System\MOSearch\Bin\mosearch.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: POWERR~1.EXE
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\All Users\Start Menu\Programs\>IMVU\Run IMVU.lnk (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: WebWorks Help 2.0 - file://C:\Program Files\procreate Painter Classic\Help\wwhelp2.cab
O16 - DPF: Win32 Classes -
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…ebscan_ansi.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/SSC/SharedCon…bin/AvSniff.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst20040510.cab
O16 - DPF: {3FE16C08-D6A7-4133-84FC-D5BFB4F7D886} (WebGameLoader Class) - http://zone.msn.com/bingame/rtlw/default/R…bGameLoader.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {64D01C7F-810D-446E-A07E-16C764235644} (AtlAtomadersCtlAttrib Class) - http://zone.msn.com/bingame/amad/default/atomaders.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {9D190AE6-C81E-4039-8061-978EBAD10073} (F-Secure Online Scanner 3.0) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cab
O16 - DPF: {B4831DED-3A57-4CC6-9E4B-0E7C5B08DBF4} - http://www.alwaysupdatednews.com/install/aun_0008.exe
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
Post #2
Hello tvhevh.

My name is Trevuren and I will try to help you with your problem.


There is a bit of malware and some restrictions imposed according to your HJT log. Let's remove it all and see what happens.

A. Please disable AVG's Guard for it may interfere with the changes that we need to make. Remember to re-enable it when all is done.

B. Please disable Spywareguard.

Double-click the red SG icon in your system tray.
Click Options.
Under General Uncheck all 3 options, then click "Save Settings"
Close Spywareguard.


C. Please RUN HijackThis
  • Click the SCAN button to produce a log.

  • Place a check mark beside each one of the following items:

    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O16 - DPF: Win32 Classes -
    O16 - DPF: {B4831DED-3A57-4CC6-9E4B-0E7C5B08DBF4} - http://www.alwaysupdatednews.com/install/aun_0008.exe

  • Now with all the items selected, and all windows closed except for HJT, delete them by clicking the FIX checked button. Close the HijackThis window.

  • Reboot Your System


  • Finally, RUN Hijackthis again and produce a new HJT log. Post it in this thread so we can check how everything looks now. In addition, please tell me if there are any more malware problems that you are aware of.
Regards,

Trevuren
Post #3
Trevuren:

I followed your instructions.

Here's the new HJT log.

I tried to bring up the the Control Panel–it started to come up, went to a blank window with the searching flashlight, then vanished after about a minute.

Thanks for the help so far–TvH

Logfile of HijackThis v1.99.1
Scan saved at 4:31:00 PM, on 7/12/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\Tablet.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\WTablet\TabUserW.exe
C:\WINDOWS\system32\Tablet.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\CTHELPER.EXE
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Documents and Settings\All Users\Desktop\System Integrity\hijackthis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN2\YCOMP5_5_7_0.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN2\YCOMP5_5_7_0.DLL
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe"
O4 - HKLM\..\Run: [IntelliPoint] "c:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\RunServices: [MOSearch] C:\PROGRA~1\COMMON~1\System\MOSearch\Bin\mosearch.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: POWERR~1.EXE
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\All Users\Start Menu\Programs\>IMVU\Run IMVU.lnk (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: WebWorks Help 2.0 - file://C:\Program Files\procreate Painter Classic\Help\wwhelp2.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…ebscan_ansi.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/SSC/SharedCon…bin/AvSniff.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst20040510.cab
O16 - DPF: {3FE16C08-D6A7-4133-84FC-D5BFB4F7D886} (WebGameLoader Class) - http://zone.msn.com/bingame/rtlw/default/R…bGameLoader.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {64D01C7F-810D-446E-A07E-16C764235644} (AtlAtomadersCtlAttrib Class) - http://zone.msn.com/bingame/amad/default/atomaders.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {9D190AE6-C81E-4039-8061-978EBAD10073} (F-Secure Online Scanner 3.0) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
Post #4
A. Please disable both AVG's Guard and SpywareGuard as before.


B. Please RUN HijackThis
  • Click the SCAN button to produce a log.

  • Place a check mark beside each one of the following items:


    O4 - HKLM\..\RunServices: [MOSearch] C:\PROGRA~1\COMMON~1\System\MOSearch\Bin\mosearch.exe
    O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)

  • Now with all the items selected, and all windows closed except for HJT, delete them by clicking the FIX checked button. Close the HijackThis window.

  • Reboot Your System


  • RUN Hijackthis again and produce a new HJT log.


C. Please do an online scan with Kaspersky Online Virus Scanner (Use Internet Explorer as your Browser)

Note: If you have used this particular scanner before, you MAY HAVE YO UNINSTALL the program through Add/Remove Programs before downloading the new ActiveX component

Next Click on Free Virus Scanner, then Kaspersky Online Scanner

You will be prompted to install an ActiveX component from Kaspersky, Click Yes.
  • The program will launch and then begin downloading the latest definition files:
  • Once the files have been downloaded click on NEXT
  • Now click on Scan Settings
  • In the scan settings make that the following are selected:
    • Scan using the following Anti-Virus database:
    Standard
    • Scan Options:
    Scan Archives
    Scan Mail Bases
  • Click OK
  • Now under select a target to scan:Select My Computer
  • This will program will start and scan your system.
  • The scan will take a while so be patient and let it run.
  • Once the scan is complete it will display if your system has been infected.
    • Now click on the Save as Text button:
  • Save the file to your desktop.
  • Copy and paste that information into your next post.
Regards

Trevuren
Post #5
Trevuren:

I've run the second removal and the Kaspersky. I can't tell if SG is back up–I don't get any indication in the lwr RH corner where all the running programs are shown, like Zone Alarm and AVG.

The Kaspersky scan came up clean–no files infected. I'm going to run it again, just to be sure. If it changes, I'll let you know.


Now for the HJT–TvH


Logfile of HijackThis v1.99.1
Scan saved at 10:22:28 PM, on 7/12/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\Tablet.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\WTablet\TabUserW.exe
C:\WINDOWS\system32\Tablet.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\CTHELPER.EXE
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\WINDOWS\system32\drwtsn32.exe
C:\WINDOWS\system32\drwtsn32.exe
C:\Documents and Settings\All Users\Desktop\System Integrity\hijackthis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN2\YCOMP5_5_7_0.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN2\YCOMP5_5_7_0.DLL
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe"
O4 - HKLM\..\Run: [IntelliPoint] "c:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: POWERR~1.EXE
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\All Users\Start Menu\Programs\>IMVU\Run IMVU.lnk (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: WebWorks Help 2.0 - file://C:\Program Files\procreate Painter Classic\Help\wwhelp2.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…ebscan_ansi.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/SSC/SharedCon…bin/AvSniff.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst20040510.cab
O16 - DPF: {3FE16C08-D6A7-4133-84FC-D5BFB4F7D886} (WebGameLoader Class) - http://zone.msn.com/bingame/rtlw/default/R…bGameLoader.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {64D01C7F-810D-446E-A07E-16C764235644} (AtlAtomadersCtlAttrib Class) - http://zone.msn.com/bingame/amad/default/atomaders.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {9D190AE6-C81E-4039-8061-978EBAD10073} (F-Secure Online Scanner 3.0) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
Post #6
Trevuren: Here's the Kaspersky Log. One of my Daughters was also logged on, so this is what the report looked like: ——————————————————————————- KASPERSKY ONLINE SCANNER REPORT Friday, July 13, 2007 7:18:12 PM Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.93.0 Kaspersky Anti-Virus database last update: 14/07/2007 Kaspersky Anti-Virus database records: 339770 ——————————————————————————- Scan Settings: Scan using the following antivirus database: standard Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: A:\ C:\ D:\ E:\ Scan Statistics: Total number of scanned objects: 101497 Number of viruses found: 0 Number of infected objects: 0 Number of suspicious objects: 0 Duration of the scan process: 02:39:54 Infected Object Name / Virus Name / Last Action C:\WINDOWS\SYSTEM32\DRIVERS\fidbox.dat Object is locked skipped C:\WINDOWS\SYSTEM32\DRIVERS\fidbox.idx Object is locked skipped C:\WINDOWS\SYSTEM32\wbem\REPOSITORY\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\SYSTEM32\wbem\REPOSITORY\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\SYSTEM32\wbem\REPOSITORY\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\SYSTEM32\wbem\REPOSITORY\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\SYSTEM32\wbem\REPOSITORY\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\SYSTEM32\wbem\REPOSITORY\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\SYSTEM32\wbem\REPOSITORY\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\SYSTEM32\config\system.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\config\software.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\config\default.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\config\SECURITY Object is locked skipped C:\WINDOWS\SYSTEM32\config\SAM Object is locked skipped C:\WINDOWS\SYSTEM32\config\SAM.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\SYSTEM32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\SYSTEM32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\SYSTEM32\config\SYSTEM Object is locked skipped C:\WINDOWS\SYSTEM32\config\SOFTWARE Object is locked skipped C:\WINDOWS\SYSTEM32\config\DEFAULT Object is locked skipped C:\WINDOWS\SYSTEM32\config\Internet.evt Object is locked skipped C:\WINDOWS\SYSTEM32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\SYSTEM32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\SYSTEM32\h323log.txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\SCHEDLOG.TXT Object is locked skipped C:\WINDOWS\TEMP\ZLT011b5.TMP Object is locked skipped C:\WINDOWS\TEMP\ZLT011b8.TMP Object is locked skipped C:\WINDOWS\Internet Logs\tvDebug.log Object is locked skipped C:\WINDOWS\Internet Logs\fwpktlog.txt Object is locked skipped C:\WINDOWS\Internet Logs\fwdbglog.txt Object is locked skipped C:\WINDOWS\Internet Logs\PC_6.ldb Object is locked skipped C:\WINDOWS\Internet Logs\IAMDB.RDB Object is locked skipped C:\WINDOWS\debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\AVG7\Log\emc.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log Object is locked skipped C:\Documents and Settings\default\NTUSER.DAT Object is locked skipped C:\Documents and Settings\default\Local Settings\Temp\~DF1188.tmp Object is locked skipped C:\Documents and Settings\default\Local Settings\History\HISTORY.IE5\INDEX.DAT Object is locked skipped C:\Documents and Settings\default\Local Settings\History\HISTORY.IE5\MSHist012007071320070714\index.dat Object is locked skipped C:\Documents and Settings\default\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\default\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped C:\Documents and Settings\default\Cookies\INDEX.DAT Object is locked skipped C:\Documents and Settings\default\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\default\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\default\Application Data\Microsoft\Feeds Cache\index.dat Object is locked skipped C:\Documents and Settings\default\Application Data\Mozilla\Firefox\Profiles\qk4bpc3o.Default User\history.dat Object is locked skipped C:\Documents and Settings\default\Application Data\Mozilla\Firefox\Profiles\qk4bpc3o.Default User\cert8.db Object is locked skipped C:\Documents and Settings\default\Application Data\Mozilla\Firefox\Profiles\qk4bpc3o.Default User\key3.db Object is locked skipped C:\Documents and Settings\default\Application Data\Mozilla\Firefox\Profiles\qk4bpc3o.Default User\formhistory.dat Object is locked skipped C:\Documents and Settings\default\Application Data\Mozilla\Firefox\Profiles\qk4bpc3o.Default User\parent.lock Object is locked skipped C:\Documents and Settings\default\Application Data\Mozilla\Firefox\Profiles\qk4bpc3o.Default User\Cache\_CACHE_MAP_ Object is locked skipped C:\Documents and Settings\default\Application Data\Mozilla\Firefox\Profiles\qk4bpc3o.Default User\Cache\_CACHE_001_ Object is locked skipped C:\Documents and Settings\default\Application Data\Mozilla\Firefox\Profiles\qk4bpc3o.Default User\Cache\_CACHE_002_ Object is locked skipped C:\Documents and Settings\default\Application Data\Mozilla\Firefox\Profiles\qk4bpc3o.Default User\Cache\_CACHE_003_ Object is locked skipped C:\Documents and Settings\default\Application Data\Mozilla\Firefox\Profiles\qk4bpc3o.Default User\search.sqlite Object is locked skipped C:\Documents and Settings\default\Application Data\Mozilla\Firefox\Profiles\qk4bpc3o.Default User\urlclassifier2.sqlite Object is locked skipped C:\Documents and Settings\default\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\Rose vonHatten\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\Rose vonHatten\Local Settings\Temp\~DFE648.tmp Object is locked skipped C:\Documents and Settings\Rose vonHatten\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\Rose vonHatten\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Rose vonHatten\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Rose vonHatten\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Rose vonHatten\Cookies\index.dat Object is locked skipped C:\Documents and Settings\Rose vonHatten\NTUSER.DAT Object is locked skipped C:\System Volume Information\_restore{C06F456A-93B7-4D7A-8759-C81F0F93FBC1}\RP21\change.log Object is locked skipped Scan process completed.
Post #7
That is also negative. I am now grasping for straws… I am going to ask you to run ANOTHER scan but I am reallly only looking for a special registry key.

Please download this file - combofix.exe by sUBs
  • Double click combofix.exe & follow the prompts.
  • When finished, it will produce a log. Please save that log to post in your next reply along with a fresh HJT log.
Note:
Do not mouse-click combofix's window while it is running. That may cause it to stall.

Regards,

Trevuren
Post #8
Trevuren:

Ran ComboFix and HJT.

Here are their logs, CF first.

–TvH

"default" - 2007-07-14 12:36:06 - ComboFix 07-07-14.6 - Service Pack 2 FAT32


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\WINDOWS\DOWNLO~1.\rave
C:\WINDOWS\DOWNLO~1.\rave\avirexe.vdm
C:\WINDOWS\DOWNLO~1.\rave\avirscr.vdm
C:\WINDOWS\DOWNLO~1.\rave\base.vdm
C:\WINDOWS\DOWNLO~1.\rave\daily.vdm
C:\WINDOWS\DOWNLO~1.\rave\daily.vdt
C:\WINDOWS\DOWNLO~1.\rave\filters.vdm
C:\WINDOWS\DOWNLO~1.\rave\kernel.vdk
C:\WINDOWS\DOWNLO~1.\rave\keyring.vdk
C:\WINDOWS\DOWNLO~1.\rave\mapi_vdm.vdm
C:\WINDOWS\DOWNLO~1.\rave\modules.vdk
C:\WINDOWS\DOWNLO~1.\rave\rav8def.vdm
C:\WINDOWS\DOWNLO~1.\rave\rufs.vdm
C:\WINDOWS\DOWNLO~1.\rave\rufsplg.vdm
C:\WINDOWS\DOWNLO~1.\rave\unarch.vdm
C:\WINDOWS\DOWNLO~1.\rave\unmail.vdm
C:\WINDOWS\DOWNLO~1.\rave\unpack.vdm
C:\WINDOWS\hosts
C:\WINDOWS\regedit.com
C:\WINDOWS\start.exe


((((((((((((((((((((((((( Files Created from 2007-06-14 to 2007-07-14 )))))))))))))))))))))))))))))))


2007-07-14 10:39 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-07-12 22:28 d——– C:\WINDOWS\SYSTEM32\Kaspersky Lab
2007-07-12 22:28 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kaspersky Lab
2007-07-10 20:09 d——– C:\DOCUME~1\default\APPLIC~1\Lavasoft
2007-07-10 16:43 d——– C:\Program Files\Microsoft FrontPage Express
2007-07-08 22:44 2,621,440 –ah—– C:\DOCUME~1\GRACEV~1\ntuser.dat
2007-07-08 22:44 d——– C:\DOCUME~1\GRACEV~1\APPLIC~1\WTablet
2007-07-08 19:56 d——– C:\DOCUME~1\default\APPLIC~1\{7148F0A6-6813-11D6-A77B-00B0D0142150}
2007-07-08 13:10 75,932 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\klick.dat
2007-07-08 13:10 74,396 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\klin.dat
2007-07-08 13:09 110,360 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\kl1.sys
2007-07-08 12:57 75,248 –a—— C:\WINDOWS\zllsputility.exe
2007-07-08 12:57 32 –ahs—- C:\WINDOWS\SYSTEM32\DRIVERS\fidbox.dat
2007-07-08 12:57 11,264 –a—— C:\WINDOWS\SYSTEM32\SpOrder.dll
2007-07-08 12:57 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\MailFrontier
2007-07-08 12:56 1,086,952 –a—— C:\WINDOWS\SYSTEM32\zpeng24.dll
2007-07-08 11:46 d——– C:\WINDOWS\network diagnostic
2007-07-08 11:36 d——– C:\Program Files\Windows Media Connect 2
2007-07-08 11:35 d——– C:\WINDOWS\SYSTEM32\LogFiles
2007-07-08 11:35 d——– C:\WINDOWS\SYSTEM32\DRIVERS\UMDF
2007-07-08 11:28 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
2007-07-08 11:10 d–hs—- C:\FOUND.019
2007-07-08 09:57 2,621,440 –a—— C:\DOCUME~1\ROSEVO~1\NTUSER.DAT
2007-07-08 09:57 d——– C:\DOCUME~1\ROSEVO~1\APPLIC~1\WTablet
2007-07-08 03:07 d——– C:\Program Files\MSXML 4.0
2007-07-07 15:12 d–hs—- C:\Recycled
2007-07-07 14:40 23,856 –a—— C:\WINDOWS\SYSTEM32\spupdsvc.exe
2007-07-07 14:40 d——– C:\WINDOWS\SYSTEM32\PreInstall
2007-07-07 14:37 d——– C:\DOCUME~1\LOCALS~1\APPLIC~1\WTablet
2007-07-07 14:35 d——– C:\Program Files\Microsoft IntelliPoint
2007-07-07 14:11 d——– C:\DOCUME~1\default\APPLIC~1\Help
2007-07-07 13:58 24 –a—— C:\WINDOWS\SYSTEM32\DVCStateBkp-{00000002-00000000-0000000A-00001102-00000002-80221102}.dat
2007-07-07 13:58 24 –a—— C:\WINDOWS\SYSTEM32\DVCState-{00000002-00000000-0000000A-00001102-00000002-80221102}.dat
2007-07-07 13:43 d——– C:\WINDOWS\SYSTEM32\SoftwareDistribution
2007-07-07 13:40 998,004 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\ha10kx2k.sys
2007-07-07 13:40 94,208 –a—— C:\WINDOWS\DEVREG.DLL
2007-07-07 13:40 90,112 ——— C:\WINDOWS\Updreg.EXE
2007-07-07 13:40 837,548 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\ctaud2k.sys
2007-07-07 13:40 77,824 –a—— C:\WINDOWS\SYSTEM32\EAXAC3.DLL
2007-07-07 13:40 65,536 –a—— C:\WINDOWS\SYSTEM32\a3d.dll
2007-07-07 13:40 643,072 –a—— C:\WINDOWS\SYSTEM32\CTSBLFX.DLL
2007-07-07 13:40 61,440 –a—— C:\WINDOWS\SYSTEM32\CTAGENT.DLL
2007-07-07 13:40 61,440 –a—— C:\WINDOWS\MIDIDEF.EXE
2007-07-07 13:40 53,248 –a—— C:\WINDOWS\SYSTEM32\ac3api.dll
2007-07-07 13:40 49,152 –a—— C:\WINDOWS\SYSTEM32\KILLAPPS.EXE
2007-07-07 13:40 49,152 –a—— C:\WINDOWS\CTDCRES.DLL
2007-07-07 13:40 44,055 –a—— C:\WINDOWS\SYSTEM32\ctdaught.dat
2007-07-07 13:40 36,864 –a—— C:\WINDOWS\SYSTEM32\REGPLIB.EXE
2007-07-07 13:40 36,864 –a—— C:\WINDOWS\SYSTEM32\CTEMUPIA.DLL
2007-07-07 13:40 319,488 –a—— C:\WINDOWS\SYSTEM32\CTDEVCON.DLL
2007-07-07 13:40 28,672 –a—— C:\WINDOWS\SYSTEM32\CTSPKHLP.DLL
2007-07-07 13:40 270,336 –a—— C:\WINDOWS\SYSTEM32\SFMS32.DLL
2007-07-07 13:40 26,768 ——— C:\WINDOWS\SYSTEM32\CTL3D.DLL
2007-07-07 13:40 24,576 –a—— C:\WINDOWS\SYSTEM32\CTHELPER.EXE
2007-07-07 13:40 213,860 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\ctsfm2k.sys
2007-07-07 13:40 20,480 –a—— C:\WINDOWS\INRES.DLL
2007-07-07 13:40 195,432 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\ctoss2k.sys
2007-07-07 13:40 184,320 –a—— C:\WINDOWS\PSCONV.EXE
2007-07-07 13:40 179,669 –a—— C:\WINDOWS\SYSTEM32\ctstatic.dat
2007-07-07 13:40 176,128 –a—— C:\WINDOWS\READREG.EXE
2007-07-07 13:40 164,044 –a—— C:\WINDOWS\SYSTEM32\ctdlang.dat
2007-07-07 13:40 156,604 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\emupia2k.sys
2007-07-07 13:40 155,648 –a—— C:\WINDOWS\SYSTEM32\CTOSUSER.DLL
2007-07-07 13:40 135,168 –a—— C:\WINDOWS\SYSTEM32\OPENAL32.DLL
2007-07-07 13:40 127,948 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\ctac32k.sys
2007-07-07 13:40 113,373 –a—— C:\WINDOWS\SYSTEM32\ctbasicw.dat
2007-07-07 13:40 113,273 –a—— C:\WINDOWS\SYSTEM32\CTBAS2W.DAT
2007-07-07 13:40 110,592 –a—— C:\WINDOWS\SYSTEM32\PIAPROXY.DLL
2007-07-07 13:40 110,592 –a—— C:\WINDOWS\SYSTEM32\COMMONFX.DLL
2007-07-07 13:40 11,068 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\ctprxy2k.sys
2007-07-07 13:40 106,496 –a—— C:\WINDOWS\SYSTEM32\CTDPROXY.DLL
2007-07-07 13:40 106,496 –a—— C:\WINDOWS\SYSTEM32\CTASIO.DLL
2007-07-07 13:40 1,048,576 ——— C:\WINDOWS\SYSTEM32\SFMAN.DAT
2007-07-07 13:40 d——– C:\WINDOWS\SYSTEM32\Defaults
2007-07-07 13:40 d——– C:\WINDOWS\SYSTEM32\Data
2007-07-07 13:39 6,752 ——— C:\WINDOWS\SYSTEM32\PFMODNT.SYS
2007-07-07 12:14 21,504 –a—— C:\WINDOWS\SYSTEM32\hidserv.dll
2007-07-07 12:14 14,848 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\kbdhid.sys
2007-07-07 12:14 11,440 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\WacomVKHid.sys
2007-07-07 12:14 d——– C:\DOCUME~1\default\APPLIC~1\WTablet
2007-07-07 12:13 12,848 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\wacomvhid.sys
2007-07-07 12:13 12,160 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\mouhid.sys
2007-07-07 12:13 11,312 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\wacommousefilter.sys
2007-07-07 12:13 d——– C:\WINDOWS\SYSTEM32\WTablet
2007-07-07 12:13 d——– C:\Program Files\Tablet
2007-07-07 12:11 d–hs—- C:\DOCUME~1\default\UserData
2007-07-07 11:42 d–hs—- C:\FOUND.018
2007-07-07 11:17 d–hs—- C:\FOUND.017
2007-07-07 10:35 d–hs—- C:\FOUND.016
2007-07-07 10:30 d–hs—- C:\FOUND.015
2007-07-07 10:05 d–hs—- C:\FOUND.014
2007-07-07 09:59 d–hs—- C:\FOUND.013
2007-07-07 09:09 d–hs—- C:\FOUND.012
2007-07-07 09:04 d–hs—- C:\FOUND.011
2007-07-07 08:59 d–hs—- C:\FOUND.010
2007-07-06 22:36 86,016 –a—— C:\WINDOWS\SYSTEM32\nvmctray.dll
2007-07-06 22:36 81,920 –a—— C:\WINDOWS\SYSTEM32\nvwddi.dll
2007-07-06 22:36 5,500,928 –a—— C:\WINDOWS\SYSTEM32\nvcpl.dll
2007-07-06 22:36 4,274,816 –a—— C:\WINDOWS\SYSTEM32\nv4_disp.dll
2007-07-06 22:36 208,896 –a—— C:\WINDOWS\SYSTEM32\NVUNINST.EXE


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-07-14 17:24:50 32 –sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2007-07-08 18:11:34 4,212 —h–w C:\WINDOWS\system32\zllictbl.dat
2007-07-07 18:39:10 152,552 —-a-w C:\DOCUME~1\default\APPLIC~1\GDIPFONTCACHEV1.DAT
2007-07-07 03:38:00 1,448 —-a-w C:\WINDOWS\DOSSTART.BAT
2007-07-07 01:34:42 289 —-a-w C:\WINDOWS\wacom.dat
2007-07-07 01:31:30 0 —-a-w C:\CONFIG.SYS
2007-05-19 18:48:48 ——– d—–w C:\Program Files\Image ActiveX Access
2007-04-17 03:45:20 43,352 —-a-w C:\WINDOWS\system32\wups2.dll
2005-03-31 23:46:08 271 –sh–w C:\Program Files\DESKTOP.INI
2005-03-31 23:46:08 23,357 —h–w C:\Program Files\FOLDER.HTT
2004-12-26 19:49:48 420,974 —-a-w C:\Program Files\XviD-04102002-1.exe
2004-05-05 23:43:12 53,248 —-a-w C:\DOCUME~1\default\APPLIC~1\poker.exe
2004-05-05 23:43:12 110,886 —-a-w C:\DOCUME~1\default\APPLIC~1\casino.exe
2003-08-15 00:14:22 40,072 —-a-w C:\Program Files\uninstal.log
1998-09-10 21:39:50 1,230,321 —-a-w C:\Program Files\janes-savers.exe


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]
2004-09-29 12:02 292947 –a—— C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN2\YCOMP5_5_7_0.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
2003-11-03 14:17 54248 –a—— C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
2005-05-31 01:04 853672 –a—— C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
2007-03-14 03:43 501400 –a—— C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SystemTray"="SysTray.Exe" [2006-02-28 12:00 C:\WINDOWS\SYSTEM32\systray.exe]
"nwiz"="nwiz.exe" [2006-10-22 12:22 C:\WINDOWS\SYSTEM32\nwiz.exe]
"WINDVDPatch"="CTHELPER.EXE" [2002-07-02 17:56 C:\WINDOWS\SYSTEM32\CTHELPER.EXE]
"Jet Detection"="C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe" [2001-11-29 01:00]
"IntelliPoint"="c:\Program Files\Microsoft IntelliPoint\ipoint.exe" [2007-02-05 15:52]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-06-21 21:54]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-07-08 20:11]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2006-02-28 12:00]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"Printing Migration"=rundll32.exe C:\WINDOWS\system32\spool\migrate.dll,ProcessWin9xNetworkPrinters

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"EditLevel"=0 (0x0)
"NoClose"=0 (0x0)
"NoSaveSettings"=0 (0x0)
"NoFileMenu"=0 (0x0)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"EditLevel"=0 (0x0)
"NoRun"=0 (0x0)
"NoClose"=0 (0x0)
"NoSaveSettings"=0 (0x0)
"NoFileMenu"=0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\setup\disabledrunkeys]
"TCASUTIEXE"=TCAUDIAG -off
"AudioHQ"=C:\Program Files\Creative\SBLive\AudioHQ\AHQTB.EXE
"DellSC"=C:\Program Files\Dell\Solution Center\service.exe
"Speed racer"=C:\Program Files\Creative\PlayCenter\CTSRReg.exe
"LTWinModem1"=ltmsg.exe 9
"RoxioEngineUtility"="C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
"Sunkist"=C:\Program Files\Multimedia Card Reader\shwicon98.exe
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
"NvCplDaemon"=RUNDLL32.EXE C:\WINDOWS\SYSTEM32\NVCPL.DLL,NvStartup
"nwiz"=nwiz.exe /install
"NvMediaCenter"=RUNDLL32.EXE C:\WINDOWS\SYSTEM32\NVMCTRAY.DLL,NvTaskbarInit
"AVG7_CC"=C:\PROGRA~1\GRISOFT\AVG7\AVGCC.EXE /STARTUP
"AVG7_EMC"=C:\PROGRA~1\GRISOFT\AVG7\AVGEMC.EXE
"AVG7_AMSVR"=C:\PROGRA~1\GRISOFT\AVG7\AVGAMSVR.EXE
"LoadPowerProfile"=Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
"QuickTime Task"="C:\WINDOWS\SYSTEM32\qttask.exe" -atboottime
"Zone Labs Client"=C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe


HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CA0A4247-44BE-11d1-A005-00805F8ABE06}
RunDLL setupx.dll,InstallHinfSection PowerCfg.user 0 powercfg.inf

Contents of the 'Scheduled Tasks' folder
2007-07-08 04:00:02 C:\WINDOWS\tasks\Tune-up Application Start.job
2007-07-14 17:41:00 C:\WINDOWS\tasks\PCHealth Scheduler for Data Collection.job
2001-08-27 14:07:08 C:\WINDOWS\tasks\Symantec NetDetect.job
2001-08-27 16:15:10 C:\WINDOWS\tasks\Video Reminder.job
2007-07-07 03:34:32 C:\WINDOWS\tasks\Uninstall Expiration Reminder.job

**************************************************************************

catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-14 12:42:33
Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-07-14 12:44:50
C:\ComboFix-quarantined-files.txt … 2007-07-14 12:44

— E O F —


Logfile of HijackThis v1.99.1
Scan saved at 12:51:19 PM, on 7/14/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\Tablet.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\WTablet\TabUserW.exe
C:\WINDOWS\system32\Tablet.exe
C:\WINDOWS\system32\CTHELPER.EXE
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\All Users\Desktop\System Integrity\hijackthis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN2\YCOMP5_5_7_0.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN2\YCOMP5_5_7_0.DLL
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe"
O4 - HKLM\..\Run: [IntelliPoint] "c:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: POWERR~1.EXE
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\All Users\Start Menu\Programs\>IMVU\Run IMVU.lnk (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: WebWorks Help 2.0 - file://C:\Program Files\procreate Painter Classic\Help\wwhelp2.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/SSC/SharedCon…bin/AvSniff.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst20040510.cab
O16 - DPF: {3FE16C08-D6A7-4133-84FC-D5BFB4F7D886} (WebGameLoader Class) - http://zone.msn.com/bingame/rtlw/default/R…bGameLoader.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {64D01C7F-810D-446E-A07E-16C764235644} (AtlAtomadersCtlAttrib Class) - http://zone.msn.com/bingame/amad/default/atomaders.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {9D190AE6-C81E-4039-8061-978EBAD10073} (F-Secure Online Scanner 3.0) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
Post #9
Well that was not a complete waste of time afte rall. The tool eliminated some bad stuff.

1. Please open Notepad
  • Click Start , then Run
  • Type notepad .exe in the Run Box.
2. Now copy/paste the entire content of the codebox below into the Notepad window:

File::
C:\WINDOWS\SYSTEM32\DRIVERS\klick.dat
C:\WINDOWS\SYSTEM32\DRIVERS\klin.dat
C:\WINDOWS\SYSTEM32\DRIVERS\kl1.sys


3. Save the above as CFScript.txt

4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

[external image: Posted Image]


5. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:
  • Combofix.txt
  • A new HijackThis log.
Post #10
Trevuren:

Ran ComboFix per your instructions. The system did reboot.

Here are the files. CF first, then HJT.


"default" - 2007-07-14 18:11:19 - ComboFix 07-07-14.6 - Service Pack 2 FAT32
Command switches used :: C:\Documents and Settings\default\Desktop\CFScript.txt


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\WINDOWS\SYSTEM32\DRIVERS\kl1.sys
C:\WINDOWS\SYSTEM32\DRIVERS\klick.dat
C:\WINDOWS\SYSTEM32\DRIVERS\klin.dat


((((((((((((((((((((((((( Files Created from 2007-06-14 to 2007-07-14 )))))))))))))))))))))))))))))))


2007-07-14 10:39 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-07-12 22:28 d——– C:\WINDOWS\SYSTEM32\Kaspersky Lab
2007-07-12 22:28 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kaspersky Lab
2007-07-10 20:09 d——– C:\DOCUME~1\default\APPLIC~1\Lavasoft
2007-07-10 16:43 d——– C:\Program Files\Microsoft FrontPage Express
2007-07-08 22:44 2,621,440 –ah—– C:\DOCUME~1\GRACEV~1\ntuser.dat
2007-07-08 22:44 d——– C:\DOCUME~1\GRACEV~1\APPLIC~1\WTablet
2007-07-08 19:56 d——– C:\DOCUME~1\default\APPLIC~1\{7148F0A6-6813-11D6-A77B-00B0D0142150}
2007-07-08 12:57 75,248 –a—— C:\WINDOWS\zllsputility.exe
2007-07-08 12:57 32 –ahs—- C:\WINDOWS\SYSTEM32\DRIVERS\fidbox.dat
2007-07-08 12:57 11,264 –a—— C:\WINDOWS\SYSTEM32\SpOrder.dll
2007-07-08 12:57 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\MailFrontier
2007-07-08 12:56 1,086,952 –a—— C:\WINDOWS\SYSTEM32\zpeng24.dll
2007-07-08 11:46 d——– C:\WINDOWS\network diagnostic
2007-07-08 11:36 d——– C:\Program Files\Windows Media Connect 2
2007-07-08 11:35 d——– C:\WINDOWS\SYSTEM32\LogFiles
2007-07-08 11:35 d——– C:\WINDOWS\SYSTEM32\DRIVERS\UMDF
2007-07-08 11:28 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
2007-07-08 11:10 d–hs—- C:\FOUND.019
2007-07-08 09:57 2,621,440 –a—— C:\DOCUME~1\ROSEVO~1\NTUSER.DAT
2007-07-08 09:57 d——– C:\DOCUME~1\ROSEVO~1\APPLIC~1\WTablet
2007-07-08 03:07 d——– C:\Program Files\MSXML 4.0
2007-07-07 15:12 d–hs—- C:\Recycled
2007-07-07 14:40 23,856 –a—— C:\WINDOWS\SYSTEM32\spupdsvc.exe
2007-07-07 14:40 d——– C:\WINDOWS\SYSTEM32\PreInstall
2007-07-07 14:37 d——– C:\DOCUME~1\LOCALS~1\APPLIC~1\WTablet
2007-07-07 14:35 d——– C:\Program Files\Microsoft IntelliPoint
2007-07-07 14:11 d——– C:\DOCUME~1\default\APPLIC~1\Help
2007-07-07 13:58 24 –a—— C:\WINDOWS\SYSTEM32\DVCStateBkp-{00000002-00000000-0000000A-00001102-00000002-80221102}.dat
2007-07-07 13:58 24 –a—— C:\WINDOWS\SYSTEM32\DVCState-{00000002-00000000-0000000A-00001102-00000002-80221102}.dat
2007-07-07 13:43 d——– C:\WINDOWS\SYSTEM32\SoftwareDistribution
2007-07-07 13:40 998,004 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\ha10kx2k.sys
2007-07-07 13:40 94,208 –a—— C:\WINDOWS\DEVREG.DLL
2007-07-07 13:40 90,112 ——— C:\WINDOWS\Updreg.EXE
2007-07-07 13:40 837,548 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\ctaud2k.sys
2007-07-07 13:40 77,824 –a—— C:\WINDOWS\SYSTEM32\EAXAC3.DLL
2007-07-07 13:40 65,536 –a—— C:\WINDOWS\SYSTEM32\a3d.dll
2007-07-07 13:40 643,072 –a—— C:\WINDOWS\SYSTEM32\CTSBLFX.DLL
2007-07-07 13:40 61,440 –a—— C:\WINDOWS\SYSTEM32\CTAGENT.DLL
2007-07-07 13:40 61,440 –a—— C:\WINDOWS\MIDIDEF.EXE
2007-07-07 13:40 53,248 –a—— C:\WINDOWS\SYSTEM32\ac3api.dll
2007-07-07 13:40 49,152 –a—— C:\WINDOWS\SYSTEM32\KILLAPPS.EXE
2007-07-07 13:40 49,152 –a—— C:\WINDOWS\CTDCRES.DLL
2007-07-07 13:40 44,055 –a—— C:\WINDOWS\SYSTEM32\ctdaught.dat
2007-07-07 13:40 36,864 –a—— C:\WINDOWS\SYSTEM32\REGPLIB.EXE
2007-07-07 13:40 36,864 –a—— C:\WINDOWS\SYSTEM32\CTEMUPIA.DLL
2007-07-07 13:40 319,488 –a—— C:\WINDOWS\SYSTEM32\CTDEVCON.DLL
2007-07-07 13:40 28,672 –a—— C:\WINDOWS\SYSTEM32\CTSPKHLP.DLL
2007-07-07 13:40 270,336 –a—— C:\WINDOWS\SYSTEM32\SFMS32.DLL
2007-07-07 13:40 26,768 ——— C:\WINDOWS\SYSTEM32\CTL3D.DLL
2007-07-07 13:40 24,576 –a—— C:\WINDOWS\SYSTEM32\CTHELPER.EXE
2007-07-07 13:40 213,860 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\ctsfm2k.sys
2007-07-07 13:40 20,480 –a—— C:\WINDOWS\INRES.DLL
2007-07-07 13:40 195,432 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\ctoss2k.sys
2007-07-07 13:40 184,320 –a—— C:\WINDOWS\PSCONV.EXE
2007-07-07 13:40 179,669 –a—— C:\WINDOWS\SYSTEM32\ctstatic.dat
2007-07-07 13:40 176,128 –a—— C:\WINDOWS\READREG.EXE
2007-07-07 13:40 164,044 –a—— C:\WINDOWS\SYSTEM32\ctdlang.dat
2007-07-07 13:40 156,604 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\emupia2k.sys
2007-07-07 13:40 155,648 –a—— C:\WINDOWS\SYSTEM32\CTOSUSER.DLL
2007-07-07 13:40 135,168 –a—— C:\WINDOWS\SYSTEM32\OPENAL32.DLL
2007-07-07 13:40 127,948 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\ctac32k.sys
2007-07-07 13:40 113,373 –a—— C:\WINDOWS\SYSTEM32\ctbasicw.dat
2007-07-07 13:40 113,273 –a—— C:\WINDOWS\SYSTEM32\CTBAS2W.DAT
2007-07-07 13:40 110,592 –a—— C:\WINDOWS\SYSTEM32\PIAPROXY.DLL
2007-07-07 13:40 110,592 –a—— C:\WINDOWS\SYSTEM32\COMMONFX.DLL
2007-07-07 13:40 11,068 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\ctprxy2k.sys
2007-07-07 13:40 106,496 –a—— C:\WINDOWS\SYSTEM32\CTDPROXY.DLL
2007-07-07 13:40 106,496 –a—— C:\WINDOWS\SYSTEM32\CTASIO.DLL
2007-07-07 13:40 1,048,576 ——— C:\WINDOWS\SYSTEM32\SFMAN.DAT
2007-07-07 13:40 d——– C:\WINDOWS\SYSTEM32\Defaults
2007-07-07 13:40 d——– C:\WINDOWS\SYSTEM32\Data
2007-07-07 13:39 6,752 ——— C:\WINDOWS\SYSTEM32\PFMODNT.SYS
2007-07-07 12:14 21,504 –a—— C:\WINDOWS\SYSTEM32\hidserv.dll
2007-07-07 12:14 14,848 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\kbdhid.sys
2007-07-07 12:14 11,440 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\WacomVKHid.sys
2007-07-07 12:14 d——– C:\DOCUME~1\default\APPLIC~1\WTablet
2007-07-07 12:13 12,848 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\wacomvhid.sys
2007-07-07 12:13 12,160 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\mouhid.sys
2007-07-07 12:13 11,312 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\wacommousefilter.sys
2007-07-07 12:13 d——– C:\WINDOWS\SYSTEM32\WTablet
2007-07-07 12:13 d——– C:\Program Files\Tablet
2007-07-07 12:11 d–hs—- C:\DOCUME~1\default\UserData
2007-07-07 11:42 d–hs—- C:\FOUND.018
2007-07-07 11:17 d–hs—- C:\FOUND.017
2007-07-07 10:35 d–hs—- C:\FOUND.016
2007-07-07 10:30 d–hs—- C:\FOUND.015
2007-07-07 10:05 d–hs—- C:\FOUND.014
2007-07-07 09:59 d–hs—- C:\FOUND.013
2007-07-07 09:09 d–hs—- C:\FOUND.012
2007-07-07 09:04 d–hs—- C:\FOUND.011
2007-07-07 08:59 d–hs—- C:\FOUND.010
2007-07-06 22:36 86,016 –a—— C:\WINDOWS\SYSTEM32\nvmctray.dll
2007-07-06 22:36 81,920 –a—— C:\WINDOWS\SYSTEM32\nvwddi.dll
2007-07-06 22:36 5,500,928 –a—— C:\WINDOWS\SYSTEM32\nvcpl.dll
2007-07-06 22:36 4,274,816 –a—— C:\WINDOWS\SYSTEM32\nv4_disp.dll
2007-07-06 22:36 208,896 –a—— C:\WINDOWS\SYSTEM32\NVUNINST.EXE
2007-07-06 22:36 1,897,408 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\nv4_mini.sys
2007-07-06 22:36 d——– C:\WINDOWS\SYSTEM32\ReinstallBackups
2007-07-06 22:29 d–hs—- C:\System Volume Information


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-07-14 23:17:22 32 –sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2007-07-08 18:11:34 4,212 —h–w C:\WINDOWS\system32\zllictbl.dat
2007-07-07 18:39:10 152,552 —-a-w C:\DOCUME~1\default\APPLIC~1\GDIPFONTCACHEV1.DAT
2007-07-07 03:38:00 1,448 —-a-w C:\WINDOWS\DOSSTART.BAT
2007-07-07 01:34:42 289 —-a-w C:\WINDOWS\wacom.dat
2007-07-07 01:31:30 0 —-a-w C:\CONFIG.SYS
2007-05-19 18:48:48 ——– d—–w C:\Program Files\Image ActiveX Access
2007-04-17 03:45:20 43,352 —-a-w C:\WINDOWS\system32\wups2.dll
2005-03-31 23:46:08 271 –sh–w C:\Program Files\DESKTOP.INI
2005-03-31 23:46:08 23,357 —h–w C:\Program Files\FOLDER.HTT
2004-12-26 19:49:48 420,974 —-a-w C:\Program Files\XviD-04102002-1.exe
2004-05-05 23:43:12 53,248 —-a-w C:\DOCUME~1\default\APPLIC~1\poker.exe
2004-05-05 23:43:12 110,886 —-a-w C:\DOCUME~1\default\APPLIC~1\casino.exe
2003-08-15 00:14:22 40,072 —-a-w C:\Program Files\uninstal.log
1998-09-10 21:39:50 1,230,321 —-a-w C:\Program Files\janes-savers.exe


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]
2004-09-29 12:02 292947 –a—— C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN2\YCOMP5_5_7_0.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
2003-11-03 14:17 54248 –a—— C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
2005-05-31 01:04 853672 –a—— C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
2007-03-14 03:43 501400 –a—— C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SystemTray"="SysTray.Exe" [2006-02-28 12:00 C:\WINDOWS\SYSTEM32\systray.exe]
"nwiz"="nwiz.exe" [2006-10-22 12:22 C:\WINDOWS\SYSTEM32\nwiz.exe]
"WINDVDPatch"="CTHELPER.EXE" [2002-07-02 17:56 C:\WINDOWS\SYSTEM32\CTHELPER.EXE]
"Jet Detection"="C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe" [2001-11-29 01:00]
"IntelliPoint"="c:\Program Files\Microsoft IntelliPoint\ipoint.exe" [2007-02-05 15:52]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-06-21 21:54]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-07-08 20:11]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2006-02-28 12:00]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"Printing Migration"=rundll32.exe C:\WINDOWS\system32\spool\migrate.dll,ProcessWin9xNetworkPrinters

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"EditLevel"=0 (0x0)
"NoClose"=0 (0x0)
"NoSaveSettings"=0 (0x0)
"NoFileMenu"=0 (0x0)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"EditLevel"=0 (0x0)
"NoClose"=0 (0x0)
"NoSaveSettings"=0 (0x0)
"NoFileMenu"=0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\setup\disabledrunkeys]
"TCASUTIEXE"=TCAUDIAG -off
"AudioHQ"=C:\Program Files\Creative\SBLive\AudioHQ\AHQTB.EXE
"DellSC"=C:\Program Files\Dell\Solution Center\service.exe
"Speed racer"=C:\Program Files\Creative\PlayCenter\CTSRReg.exe
"LTWinModem1"=ltmsg.exe 9
"RoxioEngineUtility"="C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
"Sunkist"=C:\Program Files\Multimedia Card Reader\shwicon98.exe
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
"NvCplDaemon"=RUNDLL32.EXE C:\WINDOWS\SYSTEM32\NVCPL.DLL,NvStartup
"nwiz"=nwiz.exe /install
"NvMediaCenter"=RUNDLL32.EXE C:\WINDOWS\SYSTEM32\NVMCTRAY.DLL,NvTaskbarInit
"AVG7_CC"=C:\PROGRA~1\GRISOFT\AVG7\AVGCC.EXE /STARTUP
"AVG7_EMC"=C:\PROGRA~1\GRISOFT\AVG7\AVGEMC.EXE
"AVG7_AMSVR"=C:\PROGRA~1\GRISOFT\AVG7\AVGAMSVR.EXE
"LoadPowerProfile"=Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
"QuickTime Task"="C:\WINDOWS\SYSTEM32\qttask.exe" -atboottime
"Zone Labs Client"=C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe


HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CA0A4247-44BE-11d1-A005-00805F8ABE06}
RunDLL setupx.dll,InstallHinfSection PowerCfg.user 0 powercfg.inf

Contents of the 'Scheduled Tasks' folder
2007-07-08 04:00:02 C:\WINDOWS\tasks\Tune-up Application Start.job
2007-07-14 22:55:02 C:\WINDOWS\tasks\PCHealth Scheduler for Data Collection.job
2001-08-27 14:07:08 C:\WINDOWS\tasks\Symantec NetDetect.job
2001-08-27 16:15:10 C:\WINDOWS\tasks\Video Reminder.job
2007-07-07 03:34:32 C:\WINDOWS\tasks\Uninstall Expiration Reminder.job

**************************************************************************

catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-14 18:19:22
Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-07-14 18:24:50 - machine was rebooted
C:\ComboFix-quarantined-files.txt … 2007-07-14 18:24
C:\ComboFix3.txt … 2007-07-14 12:44
C:\ComboFix2.txt … 2007-07-14 13:01

— E O F —


Logfile of HijackThis v1.99.1
Scan saved at 6:28:00 PM, on 7/14/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\CTHELPER.EXE
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\Tablet.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\WTablet\TabUserW.exe
C:\WINDOWS\system32\Tablet.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\All Users\Desktop\System Integrity\hijackthis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN2\YCOMP5_5_7_0.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN2\YCOMP5_5_7_0.DLL
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe"
O4 - HKLM\..\Run: [IntelliPoint] "c:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: POWERR~1.EXE
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\All Users\Start Menu\Programs\>IMVU\Run IMVU.lnk (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: WebWorks Help 2.0 - file://C:\Program Files\procreate Painter Classic\Help\wwhelp2.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/SSC/SharedCon…bin/AvSniff.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst20040510.cab
O16 - DPF: {3FE16C08-D6A7-4133-84FC-D5BFB4F7D886} (WebGameLoader Class) - http://zone.msn.com/bingame/rtlw/default/R…bGameLoader.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {64D01C7F-810D-446E-A07E-16C764235644} (AtlAtomadersCtlAttrib Class) - http://zone.msn.com/bingame/amad/default/atomaders.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {9D190AE6-C81E-4039-8061-978EBAD10073} (F-Secure Online Scanner 3.0) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
Post #11
Please download F2Ts.exe from HERE
  • Copy/Paste the full path of the following file/folder into the Path box, the one that contains the writing in red:

    C:\WINDOWS\system32\notepad.exe

  • Run the tool by clicking GO. This will generate a report.
  • Next, remove the existing path in the path box by clicking the Clear button.
  • Copy/Pastethe path to the second file/folder that I have asked you to query into the Path Box and click Go.
  • Repeat the above sequence of procedures for every file/folder on the following list:

    C:\WINDOWS\system32\systray.exe

  • Once all the queries have been done,press "SelectF2t-list" to select the content of the entire report.
  • Copy the selected text to the clipboard by hitting [CTRL]+C.
  • Finally paste the content of the report into your next reply by hitting
    [CTRL]+V
  • Now, EXIT the program
Post #12
Trevuren: Here's the F2T list, as you've asked. I thought the info for both would be on the list, but that's not how it turned out. I copied it anyway, and here it is: F2Ts version 1.1 (april 5, 2006) Date: 7/14/2007 9:14:23 PM F2Ts File-Properties of C:\WINDOWS\system32\notepad.exe ——————————————————-F2Ts File-Properties of C:\WINDOWS\system32\systray.exe ——————————————————- Company Name: Microsoft Corporation File Description:Systray .exe stub Product version: File Version:5.1.2600.0 (xpclient.010817-1148) Internal Name: systray Legal Copyright: © Microsoft Corporation. All rights reserved. Original FileName:systray.exe Product Name:Microsoft® Windows® Operating System Original FileName:Product Version: 5.1.2600.0 –TvH
Post #13
Your log looks good. If you have no more malware-related problems that you are aware of, just give me the OK and we can start the final but essential cleanup procedures and recommendations.

Trevuren
Post #14
Other than the original problem that eventually led me to here–not being able to call up my Control Panel and getting it to either appear or stay, and almost always ending up with a DrWatson message and having to go into the Task Manager and stopping DrWatson so I can use the machine again, I'm fine. I don't think I have any malware problems, so let's get on to the rest of the show. Thanks for your assistance so far–TvH
Post #15 last edited
Let's look at some of your registry settings in another way:

Go Start>>Run>> and copy/paste the following into the run type box:

cmd /c reg query "HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel" /s >> %systemdrive%\Result.txt && notepad %systemdrive%\Result.txt


Click on OK

A Notepad text file should open on your desktop. Please post the content in your reply.

If the Notepad file does not open,

Using Windows Explorer, navigate to the root of your C: drive where you will find C:\Result.txt

Please copy/paste the content of that text file into your reply

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI