What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved]Suspected Malware Problems... Please Help!

89 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1 last edited
I am trying to help a friend with what I suspect is malware problems. Basically, they have broadband internet, but for the last COUPLE MONTHS it has been constantly dropping out all the time and running incredibly slow…
They say they can only load webpages by resetting their modem… and after a little while it slows right down again…
I don't think it is the fault of their ISP, as they are reliable (Optus), and I don't believe it is their hardware…
I have included their Hijackthis log…
Please help! :unsure:
Thanks in advance to anyone who can help! I would really appreciate it!
Peter.

Logfile of HijackThis v1.99.1
Scan saved at 2:26:02 PM, on 7/17/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\System32\hphmon05.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\InterVideo\Common\bin\WinCinemaMgr.exe
C:\Program Files\Multimedia Card Reader\shwicon2k.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\WINDOWS\System32\rundll32.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\MessengerPlus! 3\MsgPlus.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\System32\svch.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\mscmtl32.exe
C:\WINDOWS\System32\icq6.exe
C:\WINDOWS\System32\NSecurity.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Owner\Local Settings\Temp\Temporary Directory 4 for HijackThis.zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://au10.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://desktop.optusnet.com.au/dsl/favorites/search
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotinfolink.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://desktop.optusnet.com.au/dsl/favorites/homepage
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://au10.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by OptusNet
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\system32\88.tmp
F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\userinit.exe,C:\WINDOWS\system32\88.tmp
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: IE Assistant - {B08D32DE-64B2-4137-8345-87293E70D40B} - C:\WINDOWS\System32\iea.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\hpdtlk02.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [WinCinemaMgr] "C:\Program Files\InterVideo\Common\bin\WinCinemaMgr.exe"
O4 - HKLM\..\Run: [Home Theater SchSvr] "C:\Program Files\Common Files\InterVideo\SchSvr\SchSvr.exe"
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
O4 - HKLM\..\Run: [Sunkist2k] C:\Program Files\Multimedia Card Reader\shwicon2k.exe
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKLM\..\Run: [OptusNet DSL Setup] E:\OptusNet.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Office Monitor Word Exel R] C:\WINDOWS\System32\svch.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [Microsoft Device Manager] C:\WINDOWS\mscmtl32.exe
O4 - HKLM\..\Run: [ICQ Agent] C:\WINDOWS\System32\icq6.exe
O4 - HKLM\..\Run: [Network Security] C:\WINDOWS\System32\NSecurity.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Office Monitor Word Exel R] C:\WINDOWS\System32\svch.exe
O4 - HKCU\..\Run: [BackupNotify] c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe
O4 - HKCU\..\Run: [ICQ Agent] C:\WINDOWS\System32\icq6.exe
O4 - HKCU\..\Run: [Network Security] C:\WINDOWS\System32\NSecurity.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: icq agent.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Updates from HP.lnk = C:\Program Files\Updates from HP\137903\Program\BackWeb-137903.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O14 - IERESET.INF: START_PAGE_URL=http://desktop.optusnet.com.au/dsl/favorites/homepage
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab
O20 - AppInit_DLLs: MsgPlusLoader.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Integrated Windows Authentication - Unknown owner - C:\Program Files\Common Files\System\MSIWA32.exe (file missing)
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Windows Protocol Deployment Manager (PDM) - Unknown owner - C:\WINDOWS\system32\88.tmp (file missing)
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Windows Process Sevices - Unknown owner - C:\WINDOWS\System32\dllcache\prsc32.exe (file missing)
O23 - Service: Windows Service Monitor (winsvcmon) - Unknown owner - C:\WINDOWS\System32\winsvcmon.exe (file missing)
O23 - Service: ¾2:¡/
wù:GŸ·siÖ (€?
) - Unknown owner - C:\WINDOWS\iexplor.exe (file missing)
Post #2
Hello Paul and welcome to the TomCoyote Forums

My name is Trevuren and I will be helping you with your problem.


Your computer appears to have been severely infected by a backdoor trojan. These programs have the ability to steal passwords and other information from your system. If you use your computer for sensitive purposes such as internet banking then I recommend you take the following steps immediately:

* Use another, uninfected computer to change all your internet passwords, especially ones with financial implications such as banks, paypal, ebay, etc. You should also change the passwords for any other site you use.
* Call your bank(s), credit card company or any other institution which may be affected and advise them that your login/password or credit card information may have been stolen and ask what steps to take with regard to your account.
* Consider what other private information could possibly have been taken from your computer and take appropriate steps

This infection can almost certainly be cleaned, but as the malware could be configured to run any program a remote attacker requires, it will be impossible to be 100% sure that the machine is clean, if this is unacceptable to you then you should consider reformatting the system partition and reinstalling Windows as this is the only 100% sure answer.

If you wish to reformat then please let me know in your next response, I'll now continue with instructions for cleaning.


I need to get you to move HijackThis to a folder of its own so that nothing gets deleted by mistake. A Temporary folder gets deleted by our tools

1. Right click in an empty space on your desktop.

2. From the Menu, click New, then Folder and a folder will appear on your desktop.

3. Name the folder HJT

4. Copy HijackThis.exe from its current location C:\Documents and Settings\Owner\Local Settings\Temp\Temporary Directory 4 for HijackThis.zip\HijackThis.exe into the new Folder on your Desktop that was just created.
Post #3
Thanks for the fast reply! I really appreciate your help! :thumbup: My names Peter by the way, not Paul :weee: hehe… =P I just wanted to check one thing - once this trojan is removed and all other problems are solved, would that fix the internet? I'm just curious… OK, so those steps are completed… Could you please continue? Thanks alot! Peter.
Post #4
Sorry about the mistake in your name. I must have been thinking about someone else.

I just wanted to check one thing - once this trojan is removed and all other problems are solved, would that fix the internet? I'm just curious…


Perhaps yes, perhaps no. The problems may be due to malware or they may be due to a faulty router. They could also be due to a combination of both. There is only one way to find out….

Would you please post a fresh HijackThis log. I must be sure that the tool is where I want it to be before I dare make any changes to the registry and file/folder deletions.


Trevuren
Post #5
No problem about the name =D hehe…
Thanks for such a fast reply! I really appreciate it!
OK here's the new HJT log:

Logfile of HijackThis v1.99.1
Scan saved at 3:24:52 PM, on 7/18/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\System32\hphmon05.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\InterVideo\Common\bin\WinCinemaMgr.exe
C:\Program Files\Common Files\InterVideo\SchSvr\SchSvr.exe
C:\Program Files\Multimedia Card Reader\shwicon2k.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\MessengerPlus! 3\MsgPlus.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\System32\svch.exe
C:\WINDOWS\System32\NSecurity.exe
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Documents and Settings\Owner\My Documents\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://au10.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://desktop.optusnet.com.au/dsl/favorites/search
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotinfolink.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://desktop.optusnet.com.au/dsl/favorites/homepage
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://au10.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by OptusNet
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
F2 - REG:System.ini: Shell=Explorer.exe C:\WINDOWS\system32\88.tmp
F2 - REG:System.ini: UserInit=C:\WINDOWS\System32\userinit.exe,C:\WINDOWS\system32\88.tmp
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: IE Assistant - {B08D32DE-64B2-4137-8345-87293E70D40B} - C:\WINDOWS\System32\iea.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\hpdtlk02.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [WinCinemaMgr] "C:\Program Files\InterVideo\Common\bin\WinCinemaMgr.exe"
O4 - HKLM\..\Run: [Home Theater SchSvr] "C:\Program Files\Common Files\InterVideo\SchSvr\SchSvr.exe"
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
O4 - HKLM\..\Run: [Sunkist2k] C:\Program Files\Multimedia Card Reader\shwicon2k.exe
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKLM\..\Run: [OptusNet DSL Setup] E:\OptusNet.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Office Monitor Word Exel R] C:\WINDOWS\System32\svch.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [Network Security] C:\WINDOWS\System32\NSecurity.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Office Monitor Word Exel R] C:\WINDOWS\System32\svch.exe
O4 - HKCU\..\Run: [BackupNotify] c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe
O4 - HKCU\..\Run: [Network Security] C:\WINDOWS\System32\NSecurity.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Updates from HP.lnk = C:\Program Files\Updates from HP\137903\Program\BackWeb-137903.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O14 - IERESET.INF: START_PAGE_URL=http://desktop.optusnet.com.au/dsl/favorites/homepage
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab
O20 - AppInit_DLLs: MsgPlusLoader.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Integrated Windows Authentication - Unknown owner - C:\Program Files\Common Files\System\MSIWA32.exe (file missing)
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Windows Protocol Deployment Manager (PDM) - Unknown owner - C:\WINDOWS\system32\88.tmp (file missing)
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Windows Process Sevices - Unknown owner - C:\WINDOWS\System32\dllcache\prsc32.exe (file missing)
O23 - Service: Windows Service Monitor (winsvcmon) - Unknown owner - C:\WINDOWS\System32\winsvcmon.exe (file missing)
O23 - Service: ¾2 :¡/
wù:GŸ·siÖ (€?
) - Unknown owner - C:\WINDOWS\iexplor.exe (file missing)
Post #6
A. Download SDFix and save it to your Desktop.

Double click SDFix.exe and it will extract the files to %systemdrive%
(Drive that contains the Windows Directory, typically C:\SDFix)

Please then reboot your computer in Safe Mode by doing the following :
  • Restart your computer
  • After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
  • Instead of Windows loading as normal, the Advanced Options Menu should appear;
  • Select the first option, to run Windows in Safe Mode, then press Enter.
  • Choose your usual account.
  • Open the extracted SDFix folder and double click RunThis.bat to start the script.
  • Type Y to begin the cleanup process.
  • It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
  • Press any Key and it will restart the PC.
  • When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
  • Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt
    (Report.txt will also be copied to Clipboard ready for posting back on the forum).
  • Finally paste the contents of the Report.txt back


B. Please download this file - combofix.exe by sUBs
  • Double click combofix.exe & follow the prompts.
  • When finished, it will produce a log. Please save that log to post in your next reply along with a fresh HJT log.
Note:
Do not mouse-click combofix's window while it is running. That may cause it to stall.


C. Reports/Logs to Post:
  • SDFix Report.txt
  • ComboFix.txt
  • Freah HijackThis log
Post #7
Unfortunately my friend could not download/run SDFix (step A) as the website is down :unsure: Sorry!

Here are the other logs you requested:

ComboFix:

"Owner" - 2007-07-19 11:31:57 - ComboFix 07-07-19.3 - Service Pack 1 NTFS


((((((((((((((((((((((((((((((((((((((( Other Deletions
)))))))))))))))))))))))))))))))))))))))))))))))))


C:\DOCUME~1\Owner\Desktop.\internet explorer.lnk
C:\DOCUME~1\Owner\STARTM~1\Programs.\ucmore - the search accelerator
C:\DOCUME~1\Owner\STARTM~1\Programs.\ucmore - the search accelerator\How To
Uninstall.lnk
C:\DOCUME~1\Owner\STARTM~1\Programs.\ucmore - the search accelerator\UCmore
- The Search Accelerator.lnk
C:\DOCUME~1\Owner\STARTM~1\Programs.\ucmore - the search accelerator\UCmore
Tour.lnk
C:\Program Files\internet optimizer
C:\Program Files\spamblockerutility
C:\Program Files\spamblockerutility\bin\4.6.1.0\sbuinst.exe
C:\Program Files\thesearchaccelerator
C:\Program Files\thesearchaccelerator\INSTALL.LOG
C:\Program Files\thesearchaccelerator\IUCmore.dll
C:\Program Files\thesearchaccelerator\logo.ico
C:\Program Files\thesearchaccelerator\TBlogin.users.ucmore.com.4.5.40.0
C:\Program Files\thesearchaccelerator\toolbar.cfg
C:\Program Files\thesearchaccelerator\UCMTSAIE.dll
C:\Program Files\thesearchaccelerator\UNWISE.EXE
C:\WINDOWS\btgrab.dll
C:\WINDOWS\system32\test.exe
C:\WINDOWS\system32\wn.exe


((((((((((((((((((((((((( Files Created from 2007-06-19 to 2007-07-19
)))))))))))))))))))))))))))))))


2007-07-19 11:30 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-07-13 09:47 1,291,264 –a—— C:\WINDOWS\system32\NSecurity.exe
2007-07-12 10:54 107,008 –a—— C:\WINDOWS\system32\iea.dll
2007-07-05 15:06 58,952 –a—— C:\WINDOWS\system32\MsgPlusLoader.dll
2007-06-30 20:21 25,600 –a—— C:\WINDOWS\system32\svch.exe


(((((((((((((((((((((((((((((((((((((((( Find3M Report
))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-07-13 01:05:32 ——– d—–w C:\Program Files\Common Files\Real
2007-07-13 01:05:21 ——– d—–w C:\Program Files\Common Files\xing
shared
2007-07-13 01:05:12 ——– d—–w C:\DOCUME~1\Owner\APPLIC~1\Real
2005-12-21 08:46:42 284 —-a-w C:\DOCUME~1\Owner\APPLIC~1\ViewerApp.dat
2005-06-16
09:37:54 93,232 —-a-w C:\DOCUME~1\Owner\APPLIC~1\GDIPFONTCACHEV1.DAT


((((((((((((((((((((((((((((((((((((( Reg Loading Points
))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper
Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
2003-05-15 06:47 50376 –a—— C:\Program Files\Adobe\Acrobat
6.0\Reader\ActiveX\AcroIEHelper.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper
Objects\{549B5CA7-4A86-11D7-A4DF-000874180BB3}]

[HKEY_LOCAL_MACHINE\~\Browser Helper
Objects\{B08D32DE-64B2-4137-8345-87293E70D40B}]
2007-07-17 10:33 107008 –a—— C:\WINDOWS\System32\iea.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper
Objects\{FDD3B846-8D59-4ffb-8758-209B6AD74ACC}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe"
[2004-02-03 20:22]
"HPHUPD05"="c:\Program
Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe" [2003-08-21
02:23]
"KBD"="C:\HP\KBD\KBD.EXE" [2003-02-11 18:02]
"UpdateManager"="C:\Program Files\Common Files\Sonic\Update
Manager\sgtray.exe" [2003-08-19 07:01]
"WinCinemaMgr"="C:\Program Files\InterVideo\Common\bin\WinCinemaMgr.exe"
[2003-09-16 16:01]
"Home Theater SchSvr"="C:\Program Files\Common
Files\InterVideo\SchSvr\SchSvr.exe" [2003-11-24 16:40]
"nwiz"="nwiz.exe" [2003-12-05 18:50 C:\WINDOWS\system32\nwiz.exe]
"Sunkist2k"="C:\Program Files\Multimedia Card Reader\shwicon2k.exe"
[2003-10-29 11:17]
"AlcxMonitor"="ALCXMNTR.EXE" [2003-04-03 19:35 C:\WINDOWS\ALCXMNTR.EXE]
"mmtask"="C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe" []
"OptusNet DSL Setup"="E:\OptusNet.exe" []
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2005-09-16 07:43]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-03-15 20:22]
"MessengerPlus3"="C:\Program Files\MessengerPlus! 3\MsgPlus.exe" [2007-03-19
18:33]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-04-02 18:17]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\System32\ctfmon.exe" [2003-09-24 14:54]
"Office Monitor Word Exel R"="C:\WINDOWS\System32\svch.exe" [2007-06-30
20:21]
"BackupNotify"="c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe"
[2004-01-09 00:34]
"Network Security"="C:\WINDOWS\System32\NSecurity.exe" [2007-07-13 09:47]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"MS Domain Name System"=MSWDNS32.exe
"Nex"=C:\WINDOWS\System32\nex.exe
"Office Monitor Word Exel R"=C:\WINDOWS\System32\u.exe
"ICQ Agent"=C:\WINDOWS\System32\icq6.exe

C:\DOCUME~1\ALLUSE~1\STARTM~1\Programs\Startup
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital
Imaging\bin\hpqtra08.exe [2003-09-16 11:19:24]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE
[2001-02-13 01:01:04]
Updates from HP.lnk - C:\Program Files\Updates from
HP\137903\Program\BackWeb-137903.exe [2004-02-03 22:42:19]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=MsgPlusLoader.dll


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d41a5df2-d135-11db-bdbe-806d6172696f}]
AutoRun\command- D:\Info.exe folder.htt 480 480


**************************************************************************

catchme 0.3.1040 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2007-07-19 11:38:58
Windows 5.1.2600 Service Pack 1 NTFS

scanning hidden processes …

scanning hidden registry entries …

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher]
"TracesProcessed"=dword:0000053e

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-07-19 11:40:18
C:\ComboFix-quarantined-files.txt … 2007-07-19 11:39

— E O F —

HJT:

Logfile of HijackThis v1.99.1
Scan saved at 11:51:56 AM, on 7/19/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\System32\hphmon05.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\InterVideo\Common\bin\WinCinemaMgr.exe
C:\Program Files\Common Files\InterVideo\SchSvr\SchSvr.exe
C:\Program Files\Multimedia Card Reader\shwicon2k.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\MessengerPlus! 3\MsgPlus.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\System32\svch.exe
C:\WINDOWS\System32\NSecurity.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\WINDOWS\System32\HPZipm12.exe
C:\WINDOWS\explorer.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Documents and Settings\Owner\My Documents\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotinfolink.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://desktop.optusnet.com.au/dsl/favorites/homepage
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: IE Assistant - {B08D32DE-64B2-4137-8345-87293E70D40B} - C:\WINDOWS\System32\iea.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\hpdtlk02.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [WinCinemaMgr] "C:\Program Files\InterVideo\Common\bin\WinCinemaMgr.exe"
O4 - HKLM\..\Run: [Home Theater SchSvr] "C:\Program Files\Common Files\InterVideo\SchSvr\SchSvr.exe"
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
O4 - HKLM\..\Run: [Sunkist2k] C:\Program Files\Multimedia Card Reader\shwicon2k.exe
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKLM\..\Run: [OptusNet DSL Setup] E:\OptusNet.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Office Monitor Word Exel R] C:\WINDOWS\System32\svch.exe
O4 - HKCU\..\Run: [BackupNotify] c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe
O4 - HKCU\..\Run: [Network Security] C:\WINDOWS\System32\NSecurity.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Updates from HP.lnk = C:\Program Files\Updates from HP\137903\Program\BackWeb-137903.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O14 - IERESET.INF: START_PAGE_URL=http://desktop.optusnet.com.au/dsl/favorites/homepage
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab
O20 - AppInit_DLLs: MsgPlusLoader.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Integrated Windows Authentication - Unknown owner - C:\Program Files\Common Files\System\MSIWA32.exe (file missing)
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Windows Protocol Deployment Manager (PDM) - Unknown owner - C:\WINDOWS\system32\88.tmp (file missing)
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Windows Process Sevices - Unknown owner - C:\WINDOWS\System32\dllcache\prsc32.exe (file missing)
O23 - Service: Windows Service Monitor (winsvcmon) - Unknown owner - C:\WINDOWS\System32\winsvcmon.exe (file missing)
O23 - Service: ¾2:¡/
wù:GŸ·siÖ (€?
) - Unknown owner - C:\WINDOWS\iexplor.exe (file missing)
Post #8
I have just tried the link and it is working. I can not stress enough the importance of running this tool. Please try until it can be downloaded and run. Trevuren
Post #9
Sorry yes the website is working now :weee: it had "technical problems" before… OK here's the report: SDFix: Version 1.92 Run by [removed] on Thu 07/19/2007 at 01:06 PM Microsoft Windows XP [Version 5.1.2600] Running From: C:\SDFix Safe Mode: Checking Services: Name: PDM Windows Process Sevices winsvcmon ImagePath: C:\WINDOWS\system32\88.tmp "C:\WINDOWS\System32\dllcache\prsc32.exe" C:\WINDOWS\System32\winsvcmon.exe PDM - Deleted Windows Process Sevices - Deleted winsvcmon - Deleted Restoring Windows Registry Values Restoring Windows Default Hosts File Rebooting… Normal Mode: Checking Files: Trojan Files Found: C:\WINDOWS\SYSTEM32\WC.EXE - Deleted C:\WINDOWS\system32\13C.tmp - Deleted C:\WINDOWS\system32\file.exe - Deleted C:\WINDOWS\system32\NSecurity.exe - Deleted Removing Temp Files… ADS Check: C:\WINDOWS No streams found. C:\WINDOWS\system32 No streams found. C:\WINDOWS\system32\svchost.exe No streams found. C:\WINDOWS\system32\ntoskrnl.exe No streams found. Final Check: Remaining Services: —————— Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] Remaining Files: ————— Backups Folder: - C:\SDFix\backups\backups.zip Files with Hidden Attributes: C:\Documents and Settings\Default User\Local Settings\Temp\C27D8FEF-D7AE-42c0-82E6-F30598265639.exe C:\hp\patches\42WW1REC\src\App00153.exe C:\hp\patches\42WW1REC\src\App00292.exe C:\hp\patches\42WW1REC\src\App00491.exe C:\hp\patches\42WW1REC\src\App02995.exe C:\hp\patches\42WW1REC\src\App04827.exe C:\hp\patches\42WW1REC\src\App05447.exe C:\hp\patches\42WW1REC\src\App05705.exe C:\hp\patches\42WW1REC\src\App09961.exe C:\hp\patches\42WW1REC\src\App14604.exe C:\hp\patches\42WW1REC\src\App16827.exe C:\hp\patches\42WW1REC\src\App17421.exe C:\hp\patches\42WW1REC\src\App18716.exe C:\hp\patches\42WW1REC\src\App19169.exe C:\hp\patches\42WW1REC\src\App19718.exe C:\hp\patches\42WW1REC\src\App19895.exe C:\hp\patches\42WW1REC\src\App23281.exe C:\hp\patches\42WW1REC\src\App24464.exe C:\hp\patches\42WW1REC\src\App26962.exe C:\hp\patches\42WW1REC\src\App29358.exe C:\hp\patches\42WW1REC\src\App32391.exe C:\hp\patches\42WW1REC\src\App99990.exe C:\hp\patches\42WW1REC\src\App99992.exe C:\hp\patches\42WW1REC\src\App99993.exe C:\hp\patches\42WW1REC\src\xApp14604.exe C:\Program Files\Common Files\WinTools\WSup.exe C:\Program Files\Toolbar\PIB.exe C:\Documents and Settings\Default User\Local Settings\Temp\BIT62.tmp C:\Documents and Settings\Default User\My Documents\~WRL0866.tmp C:\Documents and Settings\Default User\My Documents\~WRL3942.tmp C:\Documents and Settings\Default User\My Documents\?îr¤ ??L\~WRL0001.tmp C:\Documents and Settings\Default User\My Documents\?îr¤ ??L\~WRL0005.tmp C:\Documents and Settings\Default User\My Documents\?îr¤ ??L\~WRL0758.tmp C:\Documents and Settings\Default User\My Documents\?îr¤ ??L\~WRL1007.tmp C:\Documents and Settings\Default User\My Documents\?îr¤ ??L\~WRL1546.tmp C:\Documents and Settings\Default User\My Documents\?îr¤ ??L\~WRL1716.tmp C:\Documents and Settings\Default User\My Documents\?îr¤ ??L\~WRL1959.tmp C:\Documents and Settings\Default User\My Documents\?îr¤ ??L\~WRL2182.tmp C:\Documents and Settings\Default User\My Documents\?îr¤ ??L\~WRL2445.tmp C:\Documents and Settings\Default User\My Documents\?îr¤ ??L\~WRL2574.tmp C:\Documents and Settings\Default User\My Documents\?îr¤ ??L\~WRL2893.tmp C:\Documents and Settings\Default User\My Documents\?îr¤ ??L\~WRL2952.tmp C:\Documents and Settings\Default User\My Documents\?îr¤ ??L\~WRL3410.tmp C:\Documents and Settings\Default User\My Documents\?îr¤ ??L\~WRL3526.tmp C:\Documents and Settings\Default User\My Documents\?îr¤ ??L\~WRL3614.tmp C:\Documents and Settings\Default User\My Documents\?îr¤ ??L\~WRL3675.tmp C:\Documents and Settings\Default User\My Documents\?îr¤ ??L\~WRL3807.tmp C:\Documents and Settings\Default User\My Documents\?îr¤ ??L\~WRL3849.tmp C:\Documents and Settings\Owner\My Documents\~WRL0866.tmp C:\Documents and Settings\Owner\My Documents\~WRL3942.tmp C:\Documents and Settings\Owner\My Documents\VernZ sKoOL FiLe\~WRL0005.tmp C:\Documents and Settings\Owner\My Documents\VernZ sKoOL FiLe\~WRL1537.tmp C:\Documents and Settings\Owner\My Documents\VernZ sKoOL FiLe\~WRL1700.tmp C:\Documents and Settings\Owner\My Documents\VernZ sKoOL FiLe\~WRL1707.tmp C:\Documents and Settings\Owner\My Documents\VernZ sKoOL FiLe\~WRL2770.tmp C:\Documents and Settings\Owner\My Documents\VernZ sKoOL FiLe\~WRL3141.tmp C:\Documents and Settings\Owner\My Documents\VernZ sKoOL FiLe\~WRL3450.tmp C:\Documents and Settings\Owner\My Documents\VernZ sKoOL FiLe\~WRL3854.tmp C:\WINDOWS\SoftwareDistribution\Download\S-1-5-181dd15d61e1738450c8e3cf6335fc094\BIT96.tmp C:\WINDOWS\SoftwareDistribution\Download\S-1-5-1888cc7a2d384933a5ebb143795c0edd5\BIT9C.tmp C:\WINDOWS\SoftwareDistribution\Download\S-1-5-18da4d07f1c0daddae341154d5c5618e8\BIT98.tmp C:\WINDOWS\SoftwareDistribution\Download\S-1-5-18\2fd1475c658b5f3d7119d195bcf03673\BIT9B.tmp C:\WINDOWS\SoftwareDistribution\Download\S-1-5-18\550b1142f7e1f8ec32b1cdb4c5b12158\download\BITB2.tmp C:\WINDOWS\SoftwareDistribution\Download\S-1-5-18\56225cba9b3c535893d03d6b7c75044f\BIT80.tmp C:\WINDOWS\SoftwareDistribution\Download\S-1-5-18\87984ff3f5f258c3fb76f77aed6cd4ee\BIT99.tmp C:\WINDOWS\SoftwareDistribution\Download\S-1-5-18\8cd6b657df2be1875bba5acbd76b9294\BIT95.tmp C:\WINDOWS\SoftwareDistribution\Download\S-1-5-18\a457e75c5a9739cc361e8142d870bb7f\BIT93.tmp C:\WINDOWS\SoftwareDistribution\Download\S-1-5-18\b698fa070be2bb519363d15b488fcca8\BIT9A.tmp C:\WINDOWS\SoftwareDistribution\Download\S-1-5-18\c2127dcc8bf292b100f1f5c57af251dd\BIT97.tmp C:\WINDOWS\system32\config\systemprofile\My Documents\~WRL0866.tmp C:\WINDOWS\system32\config\systemprofile\My Documents\~WRL3942.tmp C:\WINDOWS\system32\config\systemprofile\My Documents\?îr¤ ??L\~WRL0001.tmp C:\WINDOWS\system32\config\systemprofile\My Documents\?îr¤ ??L\~WRL0005.tmp C:\WINDOWS\system32\config\systemprofile\My Documents\?îr¤ ??L\~WRL0758.tmp C:\WINDOWS\system32\config\systemprofile\My Documents\?îr¤ ??L\~WRL1007.tmp C:\WINDOWS\system32\config\systemprofile\My Documents\?îr¤ ??L\~WRL1546.tmp C:\WINDOWS\system32\config\systemprofile\My Documents\?îr¤ ??L\~WRL1716.tmp C:\WINDOWS\system32\config\systemprofile\My Documents\?îr¤ ??L\~WRL1959.tmp C:\WINDOWS\system32\config\systemprofile\My Documents\?îr¤ ??L\~WRL2182.tmp C:\WINDOWS\system32\config\systemprofile\My Documents\?îr¤ ??L\~WRL2445.tmp C:\WINDOWS\system32\config\systemprofile\My Documents\?îr¤ ??L\~WRL2574.tmp C:\WINDOWS\system32\config\systemprofile\My Documents\?îr¤ ??L\~WRL2893.tmp C:\WINDOWS\system32\config\systemprofile\My Documents\?îr¤ ??L\~WRL2952.tmp C:\WINDOWS\system32\config\systemprofile\My Documents\?îr¤ ??L\~WRL3410.tmp C:\WINDOWS\system32\config\systemprofile\My Documents\?îr¤ ??L\~WRL3526.tmp C:\WINDOWS\system32\config\systemprofile\My Documents\?îr¤ ??L\~WRL3614.tmp C:\WINDOWS\system32\config\systemprofile\My Documents\?îr¤ ??L\~WRL3675.tmp C:\WINDOWS\system32\config\systemprofile\My Documents\?îr¤ ??L\~WRL3807.tmp C:\WINDOWS\system32\config\systemprofile\My Documents\?îr¤ ??L\~WRL3849.tmp Finished
Post #10
Excellent :thumbup: Unfortunately, I must now ask you to run ComboFix again as the results will be different and to also post a new HJT log after you have finished running CFix. Regards, Trevuren
Post #11
No problem :weee:
Thank you so much for your help! :thumbup:

Here are the fresh logs:

ComboFix:

"Owner" - 2007-07-19 13:45:03 - ComboFix 07-07-19.3 - Service Pack 1 NTFS


((((((((((((((((((((((((( Files Created from 2007-06-19 to 2007-07-19
)))))))))))))))))))))))))))))))


2007-07-19 13:05 d——– C:\WINDOWS\ERUNT
2007-07-19 11:30 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-07-12 10:54 107,008 –a—— C:\WINDOWS\system32\iea.dll
2007-07-05 15:06 58,952 –a—— C:\WINDOWS\system32\MsgPlusLoader.dll
2007-06-30 20:21 25,600 –a—— C:\WINDOWS\system32\svch.exe


(((((((((((((((((((((((((((((((((((((((( Find3M Report
))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-07-13 01:05:32 ——– d—–w C:\Program Files\Common Files\Real
2007-07-13 01:05:21 ——– d—–w C:\Program Files\Common Files\xing
shared
2007-07-13 01:05:12 ——– d—–w C:\DOCUME~1\Owner\APPLIC~1\Real
2005-12-21 08:46:42 284 —-a-w C:\DOCUME~1\Owner\APPLIC~1\ViewerApp.dat
2005-06-16
09:37:54 93,232 —-a-w C:\DOCUME~1\Owner\APPLIC~1\GDIPFONTCACHEV1.DAT


((((((((((((((((((((((((((((((((((((( Reg Loading Points
))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper
Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
2003-05-15 06:47 50376 –a—— C:\Program Files\Adobe\Acrobat
6.0\Reader\ActiveX\AcroIEHelper.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper
Objects\{549B5CA7-4A86-11D7-A4DF-000874180BB3}]

[HKEY_LOCAL_MACHINE\~\Browser Helper
Objects\{B08D32DE-64B2-4137-8345-87293E70D40B}]
2007-07-17 10:33 107008 –a—— C:\WINDOWS\System32\iea.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper
Objects\{FDD3B846-8D59-4ffb-8758-209B6AD74ACC}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe"
[2004-02-03 20:22]
"HPHUPD05"="c:\Program
Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe" [2003-08-21
02:23]
"KBD"="C:\HP\KBD\KBD.EXE" [2003-02-11 18:02]
"UpdateManager"="C:\Program Files\Common Files\Sonic\Update
Manager\sgtray.exe" [2003-08-19 07:01]
"WinCinemaMgr"="C:\Program Files\InterVideo\Common\bin\WinCinemaMgr.exe"
[2003-09-16 16:01]
"Home Theater SchSvr"="C:\Program Files\Common
Files\InterVideo\SchSvr\SchSvr.exe" [2003-11-24 16:40]
"nwiz"="nwiz.exe" [2003-12-05 18:50 C:\WINDOWS\system32\nwiz.exe]
"Sunkist2k"="C:\Program Files\Multimedia Card Reader\shwicon2k.exe"
[2003-10-29 11:17]
"AlcxMonitor"="ALCXMNTR.EXE" [2003-04-03 19:35 C:\WINDOWS\ALCXMNTR.EXE]
"mmtask"="C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe" []
"OptusNet DSL Setup"="E:\OptusNet.exe" []
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2005-09-16 07:43]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-03-15 20:22]
"MessengerPlus3"="C:\Program Files\MessengerPlus! 3\MsgPlus.exe" [2007-03-19
18:33]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-04-02 18:17]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\System32\ctfmon.exe" [2003-09-24 14:54]
"BackupNotify"="c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe"
[2004-01-09 00:34]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"MS Domain Name System"=MSWDNS32.exe
"Nex"=C:\WINDOWS\System32\nex.exe
"Office Monitor Word Exel R"=C:\WINDOWS\System32\u.exe
"ICQ Agent"=C:\WINDOWS\System32\icq6.exe

C:\DOCUME~1\ALLUSE~1\STARTM~1\Programs\Startup
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital
Imaging\bin\hpqtra08.exe [2003-09-16 11:19:24]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE
[2001-02-13 01:01:04]
Updates from HP.lnk - C:\Program Files\Updates from
HP\137903\Program\BackWeb-137903.exe [2004-02-03 22:42:19]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=MsgPlusLoader.dll

*Newly Created Service* - ALG
*Newly Created Service* - IPNAT

**************************************************************************

catchme 0.3.1040 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2007-07-19 13:49:51
Windows 5.1.2600 Service Pack 1 NTFS

scanning hidden processes …

scanning hidden registry entries …

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher]
"TracesProcessed"=dword:00000503

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-07-19 13:50:36
C:\ComboFix-quarantined-files.txt … 2007-07-19 13:50

— E O F —

HJT:

Logfile of HijackThis v1.99.1
Scan saved at 1:54:20 PM, on 7/19/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\InterVideo\Common\bin\WinCinemaMgr.exe
C:\Program Files\Common Files\InterVideo\SchSvr\SchSvr.exe
C:\Program Files\Multimedia Card Reader\shwicon2k.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\MessengerPlus! 3\MsgPlus.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Updates from HP\137903\Program\BackWeb-137903.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Owner\My Documents\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotinfolink.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://desktop.optusnet.com.au/dsl/favorites/homepage
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: IE Assistant - {B08D32DE-64B2-4137-8345-87293E70D40B} - C:\WINDOWS\System32\iea.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\hpdtlk02.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [WinCinemaMgr] "C:\Program Files\InterVideo\Common\bin\WinCinemaMgr.exe"
O4 - HKLM\..\Run: [Home Theater SchSvr] "C:\Program Files\Common Files\InterVideo\SchSvr\SchSvr.exe"
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
O4 - HKLM\..\Run: [Sunkist2k] C:\Program Files\Multimedia Card Reader\shwicon2k.exe
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKLM\..\Run: [OptusNet DSL Setup] E:\OptusNet.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [BackupNotify] c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Updates from HP.lnk = C:\Program Files\Updates from HP\137903\Program\BackWeb-137903.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O14 - IERESET.INF: START_PAGE_URL=http://desktop.optusnet.com.au/dsl/favorites/homepage
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab
O20 - AppInit_DLLs: MsgPlusLoader.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Integrated Windows Authentication - Unknown owner - C:\Program Files\Common Files\System\MSIWA32.exe (file missing)
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: ¾2:¡/
wù:GŸ·siÖ (€?
) - Unknown owner - C:\WINDOWS\iexplor.exe (file missing)
Post #12
There is a service (o23 entry) in your HJT log that appears with strange characters. This has to be investigated in depth.

Download Gmer
  • Disconnect from internet and close running programs.
  • There is a small chance this application may crash your computer so save any work you have open.
  • Double click gmer.exe
  • Let the gmer.sys driver load if asked.
  • If it gives you a warning at program start about rootkit activity and asks if you want to run scan…say Ok.
  • If no warning….
  • Click "Rootkit" tab and click "Scan"
  • Once done, click "Copy"
  • Open Notepad and hit "ctrl+v" to paste the log.
  • Reconnect to the internet and post the log back to this thread please.
Post #13
Here is the Gmer log:


GMER 1.0.13.12551 - http://www.gmer.net
Rootkit scan 2007-07-19 14:36:34
Windows 5.1.2600 Service Pack 1


—- Kernel code sections - GMER 1.0.13 —-

? C:\WINDOWS\System32\Drivers\PROCEXP90.SYS
The system cannot find the file
specified.
? C:\DOCUME~1\Owner\LOCALS~1\Temp\catchme.sys
The system cannot find the file
specified.

—- User code sections - GMER 1.0.13 —-

.text C:\Program Files\MSN Messenger\msnmsgr.exe[1708]
WS2_32.dll!closesocket 71AB1A6D 14 Bytes JMP
01494408 C:\Program Files\MessengerPlus! 3\MsgPlusH.dll
.text C:\Program Files\MSN Messenger\msnmsgr.exe[1708]
WS2_32.dll!send 71AB1AF4 6 Bytes JMP 014948E8
C:\Program Files\MessengerPlus! 3\MsgPlusH.dll
.text C:\Program Files\MSN Messenger\msnmsgr.exe[1708]
WS2_32.dll!recv 71AB5690 6 Bytes JMP 014948A6
C:\Program Files\MessengerPlus! 3\MsgPlusH.dll
.text C:\Program Files\MSN Messenger\msnmsgr.exe[1708]
SHELL32.dll!Shell_NotifyIcon 77477FC0 9 Bytes JMP 01491163
C:\Program Files\MessengerPlus! 3\MsgPlusH.dll

AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_CREATE
[F9F68404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_CREATE_NAMED_PIPE
[F9F68404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_CLOSE
[F9F68404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_READ
[F9F68404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_WRITE
[F9F68404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_INFORMATION
[F9F68404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SET_INFORMATION
[F9F68404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_EA
[F9F68404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SET_EA
[F9F68404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_FLUSH_BUFFERS
[F9F68404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_VOLUME_INFORMATION
[F9F68404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SET_VOLUME_INFORMATION
[F9F68404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_DIRECTORY_CONTROL
[F9F68404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_FILE_SYSTEM_CONTROL
[F9F68404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_DEVICE_CONTROL
[F9F68404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_INTERNAL_DEVICE_CONTROL
[F9F68404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SHUTDOWN
[F9F68404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_LOCK_CONTROL
[F9F68404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_CLEANUP
[F9F68404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_CREATE_MAILSLOT
[F9F68404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_SECURITY
[F9F68404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SET_SECURITY
[F9F68404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_POWER
[F9F68404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SYSTEM_CONTROL
[F9F68404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_DEVICE_CHANGE
[F9F68404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_QUOTA
[F9F68404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SET_QUOTA
[F9F68404] avg7rsw.sys

Device \Driver\Tcpip \Device\Ip IRP_MJ_INTERNAL_DEVICE_CONTROL
[F9F9485A] avgtdi.sys
Device \Driver\Tcpip \Device\Tcp IRP_MJ_INTERNAL_DEVICE_CONTROL
[F9F9485A] avgtdi.sys
Device \Driver\Tcpip \Device\Udp IRP_MJ_INTERNAL_DEVICE_CONTROL
[F9F9485A] avgtdi.sys
Device \Driver\Tcpip \Device\RawIp IRP_MJ_INTERNAL_DEVICE_CONTROL
[F9F9485A] avgtdi.sys
Device \Driver\Tcpip \Device\IPMULTICAST
IRP_MJ_INTERNAL_DEVICE_CONTROL [F9F9485A]
avgtdi.sys

AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_CREATE
[F9F68404] avg7rsw.sys
AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_CREATE_NAMED_PIPE
[F9F68404] avg7rsw.sys
AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_CLOSE
[F9F68404] avg7rsw.sys
AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_READ
[F9F68404] avg7rsw.sys
AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_WRITE
[F9F68404] avg7rsw.sys
AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_QUERY_INFORMATION
[F9F68404] avg7rsw.sys
AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_SET_INFORMATION
[F9F68404] avg7rsw.sys
AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_QUERY_EA
[F9F68404] avg7rsw.sys
AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_SET_EA
[F9F68404] avg7rsw.sys
AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_FLUSH_BUFFERS
[F9F68404] avg7rsw.sys
AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_QUERY_VOLUME_INFORMATION
[F9F68404] avg7rsw.sys
AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_SET_VOLUME_INFORMATION
[F9F68404] avg7rsw.sys
AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_DIRECTORY_CONTROL
[F9F68404] avg7rsw.sys
AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_FILE_SYSTEM_CONTROL
[F9F68404] avg7rsw.sys
AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_DEVICE_CONTROL
[F9F68404] avg7rsw.sys
AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_INTERNAL_DEVICE_CONTROL
[F9F68404] avg7rsw.sys
AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_SHUTDOWN
[F9F68404] avg7rsw.sys
AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_LOCK_CONTROL
[F9F68404] avg7rsw.sys
AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_CLEANUP
[F9F68404] avg7rsw.sys
AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_CREATE_MAILSLOT
[F9F68404] avg7rsw.sys
AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_QUERY_SECURITY
[F9F68404] avg7rsw.sys
AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_SET_SECURITY
[F9F68404] avg7rsw.sys
AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_POWER
[F9F68404] avg7rsw.sys
AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_SYSTEM_CONTROL
[F9F68404] avg7rsw.sys
AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_DEVICE_CHANGE
[F9F68404] avg7rsw.sys
AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_QUERY_QUOTA
[F9F68404] avg7rsw.sys
AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_SET_QUOTA
[F9F68404] avg7rsw.sys

—- Files - GMER 1.0.13 —-

ADS C:\Documents and Settings\Default User\My
Documents\:SummaryInformation
ADS C:\Documents and Settings\Default User\My
Documents\:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
ADS C:\Documents and Settings\Default User\My
Documents\:SummaryInformation
ADS C:\Documents and Settings\Default User\My
Documents\:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
ADS C:\Documents and Settings\Default User\My
Documents\:SummaryInformation
ADS C:\Documents and Settings\Default User\My
Documents\:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
ADS C:\Documents and Settings\Default User\My
Documents\:SummaryInformation
ADS C:\Documents and Settings\Default User\My
Documents\:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
ADS C:\Documents and Settings\Owner\My
Documents\:SummaryInformation
ADS C:\Documents and Settings\Owner\My
Documents\:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
ADS C:\Documents and Settings\Owner\My
Documents\:SummaryInformation
ADS C:\Documents and Settings\Owner\My
Documents\:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
ADS C:\Documents and Settings\Owner\My
Documents\:SummaryInformation
ADS C:\Documents and Settings\Owner\My
Documents\:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
ADS C:\Documents and Settings\Owner\My
Documents\:SummaryInformation
ADS C:\Documents and Settings\Owner\My
Documents\:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
ADS C:\WINDOWS\system32\config\systemprofile\My
Documents\:SummaryInformation
ADS C:\WINDOWS\system32\config\systemprofile\My
Documents\:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
ADS C:\WINDOWS\system32\config\systemprofile\My
Documents\:SummaryInformation
ADS C:\WINDOWS\system32\config\systemprofile\My
Documents\:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
ADS C:\WINDOWS\system32\config\systemprofile\My
Documents\:SummaryInformation
ADS C:\WINDOWS\system32\config\systemprofile\My
Documents\:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
ADS C:\WINDOWS\system32\config\systemprofile\My
Documents\:SummaryInformation
ADS C:\WINDOWS\system32\config\systemprofile\My
Documents\:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}

—- EOF - GMER 1.0.13 —-
Post #14
1. Please open Notepad
  • Click Start , then Run
  • Type notepad .exe in the Run Box.
2. Now copy/paste the entire content of the codebox below into the Notepad window:

File::
C:\WINDOWS\System32\u.exe
C:\WINDOWS\System32\nex.exe
C:\Windows\system32\MSWDNS32.exe
C:\WINDOWS\iexplor.exe
C:\WINDOWS\System32\icq6.exe
C:\WINDOWS\iexplor.exe 

Driver::
¾2:¡/wù:GŸ·siÖ 

Registry::
[HKEY_Current_User\Software\Microsoft\Windows\CurrentVersion\Run]
"MS Domain Name System"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MS Domain Name System"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
"MS Domain Name System"=-
[-HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedAppl"
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{549B5CA7-4A86-11D7-A4DF-000874180BB3}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FDD3B846-8D59-4ffb-8758-209B6AD74ACC}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B08D32DE-64B2-4137-8345-87293E70D40B}]
[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"MS Domain Name System"=-
"Nex"==-
"Office Monitor Word Exel R"=-
"ICQ Agent"=-
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\€?]


3. Save the above as CFScript.txt

4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

[external image: Posted Image]


5. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:
  • Combofix.txt
  • A new HijackThis log.
Post #15
Here are the new logs:

ComboFix:

"Owner" - 2007-07-20 10:41:38 - ComboFix 07-07-19.3 - Service Pack 1 NTFS
Command switches used :: C:\Documents and Settings\Owner\My
Documents\Downloads\Programs\CFScript.txt


((((((((((((((((((((((((( Files Created from 2007-06-20 to 2007-07-20
)))))))))))))))))))))))))))))))


2007-07-19 18:34 499,712 –a—— C:\winegne.exe
2007-07-19 13:05 d——– C:\WINDOWS\ERUNT
2007-07-19 11:30 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-07-12 10:54 107,008 –a—— C:\WINDOWS\system32\iea.dll
2007-07-05 15:06 58,952 –a—— C:\WINDOWS\system32\MsgPlusLoader.dll
2007-06-30 20:21 25,600 –a—— C:\WINDOWS\system32\svch.exe


(((((((((((((((((((((((((((((((((((((((( Find3M Report
))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-07-13 01:05:32 ——– d—–w C:\Program Files\Common Files\Real
2007-07-13 01:05:21 ——– d—–w C:\Program Files\Common Files\xing
shared
2007-07-13 01:05:12 ——– d—–w C:\DOCUME~1\Owner\APPLIC~1\Real
2005-12-21 08:46:42 284 —-a-w C:\DOCUME~1\Owner\APPLIC~1\ViewerApp.dat
2005-06-16
09:37:54 93,232 —-a-w C:\DOCUME~1\Owner\APPLIC~1\GDIPFONTCACHEV1.DAT


((((((((((((((((((((((((((((((((((((( Reg Loading Points
))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper
Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
2003-05-15 06:47 50376 –a—— C:\Program Files\Adobe\Acrobat
6.0\Reader\ActiveX\AcroIEHelper.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe"
[2004-02-03 20:22]
"HPHUPD05"="c:\Program
Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe" [2003-08-21
02:23]
"KBD"="C:\HP\KBD\KBD.EXE" [2003-02-11 18:02]
"UpdateManager"="C:\Program Files\Common Files\Sonic\Update
Manager\sgtray.exe" [2003-08-19 07:01]
"WinCinemaMgr"="C:\Program Files\InterVideo\Common\bin\WinCinemaMgr.exe"
[2003-09-16 16:01]
"Home Theater SchSvr"="C:\Program Files\Common
Files\InterVideo\SchSvr\SchSvr.exe" [2003-11-24 16:40]
"nwiz"="nwiz.exe" [2003-12-05 18:50 C:\WINDOWS\system32\nwiz.exe]
"Sunkist2k"="C:\Program Files\Multimedia Card Reader\shwicon2k.exe"
[2003-10-29 11:17]
"AlcxMonitor"="ALCXMNTR.EXE" [2003-04-03 19:35 C:\WINDOWS\ALCXMNTR.EXE]
"mmtask"="C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe" []
"OptusNet DSL Setup"="E:\OptusNet.exe" []
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2005-09-16 07:43]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-03-15 20:22]
"MessengerPlus3"="C:\Program Files\MessengerPlus! 3\MsgPlus.exe" [2007-03-19
18:33]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-04-02 18:17]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\System32\ctfmon.exe" [2003-09-24 14:54]
"BackupNotify"="c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe"
[2004-01-09 00:34]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"Nex"=C:\WINDOWS\System32\nex.exe

C:\DOCUME~1\ALLUSE~1\STARTM~1\Programs\Startup
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital
Imaging\bin\hpqtra08.exe [2003-09-16 11:19:24]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE
[2001-02-13 01:01:04]
Updates from HP.lnk - C:\Program Files\Updates from
HP\137903\Program\BackWeb-137903.exe [2004-02-03 22:42:19]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=MsgPlusLoader.dll


**************************************************************************

catchme 0.3.1040 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2007-07-20 10:46:17
Windows 5.1.2600 Service Pack 1 NTFS

scanning hidden processes …

scanning hidden registry entries …

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher]
"TracesProcessed"=dword:0000046b

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-07-20 10:47:10
C:\ComboFix-quarantined-files.txt … 2007-07-20 10:46

— E O F —

HJK:

Logfile of HijackThis v1.99.1
Scan saved at 10:48:46 AM, on 7/20/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\InterVideo\Common\bin\WinCinemaMgr.exe
C:\Program Files\Common Files\InterVideo\SchSvr\SchSvr.exe
C:\Program Files\Multimedia Card Reader\shwicon2k.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\MessengerPlus! 3\MsgPlus.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Documents and Settings\Owner\My Documents\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotinfolink.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://desktop.optusnet.com.au/dsl/favorites/homepage
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\hpdtlk02.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [WinCinemaMgr] "C:\Program Files\InterVideo\Common\bin\WinCinemaMgr.exe"
O4 - HKLM\..\Run: [Home Theater SchSvr] "C:\Program Files\Common Files\InterVideo\SchSvr\SchSvr.exe"
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
O4 - HKLM\..\Run: [Sunkist2k] C:\Program Files\Multimedia Card Reader\shwicon2k.exe
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKLM\..\Run: [OptusNet DSL Setup] E:\OptusNet.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [BackupNotify] c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Updates from HP.lnk = C:\Program Files\Updates from HP\137903\Program\BackWeb-137903.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O14 - IERESET.INF: START_PAGE_URL=http://desktop.optusnet.com.au/dsl/favorites/homepage
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab
O20 - AppInit_DLLs: MsgPlusLoader.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Integrated Windows Authentication - Unknown owner - C:\Program Files\Common Files\System\MSIWA32.exe (file missing)
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: ¾2:¡/
wù:GŸ·siÖ (€?
) - Unknown owner - C:\WINDOWS\iexplor.exe (file missing)

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI