Ok...I did everthing as instructed...Here are my logs:
VundoFix V5.1.6
Checking Java version...
Java version is 1.4.2.3
Scan started at 9:28:53 AM 8/1/2006
Listing files found while scanning....
VundoFix V5.1.6
Checking Java version...
Java version is 1.4.2.3
Scan started at 12:10:19 PM 8/1/2006
Listing files found while scanning....
C:\windows\system32\vtutt.dll
C:\windows\system32\ttutv.ini
C:\windows\system32\ttutv.bak1
C:\windows\system32\ttutv.bak2
C:\windows\system32\ttutv.ini2
C:\windows\system32\ttutv.tmp
Beginning removal...
The process smss.exe was successfully stopped
The process winlogon.exe was successfully stopped
The process explorer.exe was successfully stopped
The process iexplore.exe was successfully stopped
The process rundll32.exe was successfully stopped
Attempting to delete C:\windows\system32\vtutt.dll
C:\windows\system32\vtutt.dll Has been deleted!
Attempting to delete C:\windows\system32\ttutv.ini
C:\windows\system32\ttutv.ini Has been deleted!
Attempting to delete C:\windows\system32\ttutv.bak1
C:\windows\system32\ttutv.bak1 Has been deleted!
Attempting to delete C:\windows\system32\ttutv.bak2
C:\windows\system32\ttutv.bak2 Has been deleted!
Attempting to delete C:\windows\system32\ttutv.ini2
C:\windows\system32\ttutv.ini2 Has been deleted!
Attempting to delete C:\windows\system32\ttutv.tmp
C:\windows\system32\ttutv.tmp Has been deleted!
Performing Repairs to the registry.
Done!
VundoFix V6.5.6
Checking Java version...
Java version is 1.4.2.3
Old versions of java are exploitable and should be removed.
Scan started at 7:55:12 AM 7/19/2007
Listing files found while scanning....
C:\windows\system32\bpvjqdmm.dll
C:\WINDOWS\system32\cbeeg.bak1
C:\WINDOWS\system32\cbeeg.bak2
C:\WINDOWS\system32\cbeeg.ini
C:\WINDOWS\system32\cbeeg.ini2
C:\WINDOWS\system32\cbeeg.tmp
C:\windows\system32\cvqtuejg.exe
C:\WINDOWS\system32\dpxclmbu.dll
C:\windows\system32\ejfmiywc.exe
C:\windows\system32\enxhgcst.exe
C:\windows\system32\fietujox.ini
C:\WINDOWS\system32\geebc.dll
C:\windows\system32\gtsnkrmb.exe
C:\windows\system32\hlsqffrh.dll
C:\windows\system32\iempsucn.dll
C:\windows\system32\ivlttuij.dll
C:\windows\system32\jilymixt.dll
C:\windows\system32\jyiyqxvw.exe
C:\windows\system32\kejswtbw.dll
C:\WINDOWS\system32\khfghhf.dll
C:\windows\system32\mljklmj.dll
C:\windows\system32\mwumtwio.dll
C:\windows\system32\ncuspmei.ini
C:\windows\system32\oiwtmuwm.ini
C:\windows\system32\oymhqvne.exe
C:\windows\system32\pkylqogu.exe
C:\windows\system32\pvhievnj.exe
C:\windows\system32\qlkxlrbo.dll
C:\windows\system32\rbthfaft.dll
C:\windows\system32\rqqaiqhq.exe
C:\windows\system32\ssqonnk.dll
C:\windows\system32\svyrdtuf.exe
C:\windows\system32\sxowsags.exe
C:\windows\system32\tmbtnemb.exe
C:\windows\system32\vteoquct.exe
C:\windows\system32\vyqkimex.exe
C:\windows\system32\vyvcjlyi.dll
C:\windows\system32\vyvywjdm.exe
C:\windows\system32\wbtwsjek.ini
C:\windows\system32\xkjbybaw.exe
C:\WINDOWS\system32\xojuteif.dll
Beginning removal...
Attempting to delete C:\windows\system32\bpvjqdmm.dll
C:\windows\system32\bpvjqdmm.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\cbeeg.bak1
C:\WINDOWS\system32\cbeeg.bak1 Has been deleted!
Attempting to delete C:\WINDOWS\system32\cbeeg.bak2
C:\WINDOWS\system32\cbeeg.bak2 Has been deleted!
Attempting to delete C:\WINDOWS\system32\cbeeg.ini
C:\WINDOWS\system32\cbeeg.ini Has been deleted!
Attempting to delete C:\WINDOWS\system32\cbeeg.ini2
C:\WINDOWS\system32\cbeeg.ini2 Has been deleted!
Attempting to delete C:\WINDOWS\system32\cbeeg.tmp
C:\WINDOWS\system32\cbeeg.tmp Has been deleted!
Attempting to delete C:\windows\system32\cvqtuejg.exe
C:\windows\system32\cvqtuejg.exe Has been deleted!
Attempting to delete C:\WINDOWS\system32\dpxclmbu.dll
C:\WINDOWS\system32\dpxclmbu.dll Has been deleted!
Attempting to delete C:\windows\system32\ejfmiywc.exe
C:\windows\system32\ejfmiywc.exe Has been deleted!
Attempting to delete C:\windows\system32\enxhgcst.exe
C:\windows\system32\enxhgcst.exe Has been deleted!
Attempting to delete C:\windows\system32\fietujox.ini
C:\windows\system32\fietujox.ini Has been deleted!
Attempting to delete C:\WINDOWS\system32\geebc.dll
C:\WINDOWS\system32\geebc.dll Has been deleted!
Attempting to delete C:\windows\system32\gtsnkrmb.exe
C:\windows\system32\gtsnkrmb.exe Could not be deleted.
Attempting to delete C:\windows\system32\hlsqffrh.dll
C:\windows\system32\hlsqffrh.dll Has been deleted!
Attempting to delete C:\windows\system32\iempsucn.dll
C:\windows\system32\iempsucn.dll Has been deleted!
Attempting to delete C:\windows\system32\ivlttuij.dll
C:\windows\system32\ivlttuij.dll Has been deleted!
Attempting to delete C:\windows\system32\jilymixt.dll
C:\windows\system32\jilymixt.dll Has been deleted!
Attempting to delete C:\windows\system32\jyiyqxvw.exe
C:\windows\system32\jyiyqxvw.exe Has been deleted!
Attempting to delete C:\windows\system32\kejswtbw.dll
C:\windows\system32\kejswtbw.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\khfghhf.dll
C:\WINDOWS\system32\khfghhf.dll Has been deleted!
Attempting to delete C:\windows\system32\mljklmj.dll
C:\windows\system32\mljklmj.dll Has been deleted!
Attempting to delete C:\windows\system32\mwumtwio.dll
C:\windows\system32\mwumtwio.dll Has been deleted!
Attempting to delete C:\windows\system32\ncuspmei.ini
C:\windows\system32\ncuspmei.ini Has been deleted!
Attempting to delete C:\windows\system32\oiwtmuwm.ini
C:\windows\system32\oiwtmuwm.ini Has been deleted!
Attempting to delete C:\windows\system32\oymhqvne.exe
C:\windows\system32\oymhqvne.exe Has been deleted!
Attempting to delete C:\windows\system32\pkylqogu.exe
C:\windows\system32\pkylqogu.exe Could not be deleted.
Attempting to delete C:\windows\system32\pvhievnj.exe
C:\windows\system32\pvhievnj.exe Has been deleted!
Attempting to delete C:\windows\system32\qlkxlrbo.dll
C:\windows\system32\qlkxlrbo.dll Has been deleted!
Attempting to delete C:\windows\system32\rbthfaft.dll
C:\windows\system32\rbthfaft.dll Has been deleted!
Attempting to delete C:\windows\system32\rqqaiqhq.exe
C:\windows\system32\rqqaiqhq.exe Has been deleted!
Attempting to delete C:\windows\system32\ssqonnk.dll
C:\windows\system32\ssqonnk.dll Has been deleted!
Attempting to delete C:\windows\system32\svyrdtuf.exe
C:\windows\system32\svyrdtuf.exe Has been deleted!
Attempting to delete C:\windows\system32\sxowsags.exe
C:\windows\system32\sxowsags.exe Could not be deleted.
Attempting to delete C:\windows\system32\tmbtnemb.exe
C:\windows\system32\tmbtnemb.exe Has been deleted!
Attempting to delete C:\windows\system32\vteoquct.exe
C:\windows\system32\vteoquct.exe Has been deleted!
Attempting to delete C:\windows\system32\vyqkimex.exe
C:\windows\system32\vyqkimex.exe Has been deleted!
Attempting to delete C:\windows\system32\vyvcjlyi.dll
C:\windows\system32\vyvcjlyi.dll Has been deleted!
Attempting to delete C:\windows\system32\vyvywjdm.exe
C:\windows\system32\vyvywjdm.exe Has been deleted!
Attempting to delete C:\windows\system32\wbtwsjek.ini
C:\windows\system32\wbtwsjek.ini Has been deleted!
Attempting to delete C:\windows\system32\xkjbybaw.exe
C:\windows\system32\xkjbybaw.exe Has been deleted!
Attempting to delete C:\WINDOWS\system32\xojuteif.dll
C:\WINDOWS\system32\xojuteif.dll Could not be deleted.
Performing Repairs to the registry.
Done!
Beginning removal...
Attempting to delete C:\windows\system32\gtsnkrmb.exe
C:\windows\system32\gtsnkrmb.exe Has been deleted!
Attempting to delete C:\windows\system32\pkylqogu.exe
C:\windows\system32\pkylqogu.exe Could not be deleted.
Attempting to delete C:\windows\system32\sxowsags.exe
C:\windows\system32\sxowsags.exe Has been deleted!
Attempting to delete C:\WINDOWS\system32\xojuteif.dll
C:\WINDOWS\system32\xojuteif.dll Has been deleted!
Performing Repairs to the registry.
Done!
VundoFix V6.5.6
Checking Java version...
Java version is 1.4.2.3
Old versions of java are exploitable and should be removed.
Scan started at 8:04:05 AM 7/19/2007
Listing files found while scanning....
C:\windows\system32\pkylqogu.exe
Beginning removal...
Attempting to delete C:\windows\system32\pkylqogu.exe
C:\windows\system32\pkylqogu.exe Could not be deleted.
Performing Repairs to the registry.
Done!
"Whitney" - 2007-07-19 8:13:07 - ComboFix 07-07-14.6 - Service Pack 2 NTFS
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
C:\DOCUME~1\Whitney\APPLIC~1.\ymante~1
C:\DOCUME~1\Whitney\APPLIC~1.\ymante~1\?canregw.exe
C:\Program Files\MSN Gaming Zone\nipy83122.dll
C:\tempb9
C:\tempb9\tmpTF.log
C:\temp\iee
C:\temp\tn3
C:\WINDOWS\acdt-pid67n.exe
C:\WINDOWS\b122.exe
C:\WINDOWS\mcroso~1
C:\WINDOWS\mcroso~1\winword.exe
C:\WINDOWS\system32\drivers\core.cache.dsk
C:\WINDOWS\system32\drivers\core.sys
C:\WINDOWS\system32\F2
C:\WINDOWS\system32\F2\mwspasrt83122.exe
C:\WINDOWS\system32\F3
C:\WINDOWS\system32\F3\626wr.exe
C:\WINDOWS\system32\F4
C:\WINDOWS\system32\F4\wen2.exe
C:\WINDOWS\system32\F9
C:\WINDOWS\system32\kwd.dll
C:\WINDOWS\system32\o02PrEz
C:\WINDOWS\system32\o02PrEz\o02PrEz1065.exe
C:\WINDOWS\system32\pkylqogu.exe
C:\WINDOWS\system32\wcpicomsv32.exe
C:\WINDOWS\system32\win
C:\WINDOWS\system32\winnb58.dll
C:\WINDOWS\wr.txt
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
-------\LEGACY_CORE
-------\LEGACY_DOMAINSERVICE
-------\core
-------\DomainService
((((((((((((((((((((((((( Files Created from 2007-06-19 to 2007-07-19 )))))))))))))))))))))))))))))))
2007-07-19 08:12 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-07-16 06:29 786,432 --ah----- C:\DOCUME~1\ADMINI~1\NTUSER.DAT
2007-07-16 06:29 <DIR> d--h----- C:\DOCUME~1\ADMINI~1\APPLIC~1\Gtek
2007-07-16 06:29 <DIR> d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\Symantec
2007-07-16 06:29 <DIR> d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\Sonic
2007-07-16 06:29 <DIR> d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\Jasc Software Inc
2007-07-08 14:24 3,504 --a------ C:\WINDOWS\system32\tmp.reg
2007-07-08 14:23 53,248 --a------ C:\WINDOWS\system32\Process.exe
2007-07-08 14:23 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2007-07-08 14:23 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2007-07-01 18:56 76,560 --a------ C:\WINDOWS\system32\drivers\tmcomm.sys
2007-07-01 18:54 <DIR> d-------- C:\DOCUME~1\Whitney\.housecall6.6
2007-07-01 18:27 234,718 --a------ C:\Temp\aZ001.exe
2007-07-01 18:27 <DIR> d-------- C:\Temp
2007-07-01 18:27 <DIR> d-------- C:\Program Files\Kill
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
2007-07-19 15:16:23 -------- d-----w C:\Program Files\MSN Gaming Zone
2007-07-02 18:57:09 -------- d--h--w C:\DOCUME~1\Whitney\APPLIC~1\Move Networks
2007-05-16 15:12:02 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
2007-04-25 14:21:15 144,896 ----a-w C:\WINDOWS\system32\schannel.dll
2006-01-27 01:24:52 952 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}]
C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2E9D4C81-9F27-4c14-B804-7B0F6BC88A4F}]
C:\Program Files\Outerinfo\Outerinfo.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
2005-05-31 01:04 853672 --a------ C:\PROGRA~1\SPYBOT~1\SDHelper.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A6702926-5DF1-4785-802A-FE4A03F3B910}]
C:\WINDOWS\system32\geebc.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
2007-03-09 23:37 2403392 -ra------ c:\program files\google\googletoolbar1.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="C:\Program Files\Apoint\Apoint.exe" [2004-09-13 14:33]
"SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe" [2003-11-19 15:48]
"PCMService"="C:\Program Files\Dell\Media Experience\PCMService.exe" [2004-04-11 18:15]
"Dell QuickSet"="C:\Program Files\Dell\QuickSet\quickset.exe" [2005-03-04 09:26]
"HP Software Update"="C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" [2004-02-18 10:55]
"McRegWiz"="C:\PROGRA~1\mcafee.com\agent\mcregwiz.exe" [2003-09-02 15:41]
"VSOCheckTask"="c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" [2003-08-08 18:02]
"VirusScan Online"="c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe" [2003-08-17 21:50]
"MCAgentExe"="c:\PROGRA~1\mcafee.com\agent\mcagent.exe" [2003-08-27 11:00]
"MCUpdateExe"="C:\PROGRA~1\mcafee.com\agent\mcupdate.exe" [2003-08-21 18:10]
"MPFExe"="C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe" [2003-09-02 14:00]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-05-29 13:59]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-03-29 13:10]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AIM"="C:\Program Files\AIM\aim.exe" [2005-08-05 15:08]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 09:24]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 03:00]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2007-03-09 23:37]
"Mocgpy"="C:\Documents and Settings\Whitney\Application Data\?ymantec\?canregw.exe" []
"Sen"="C:\WINDOWS\MCROSO~1\winword.exe" []
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WB]
C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\fastload.dll --a------ 2001-12-20 22:34 24576 C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\fastload.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=wbsys.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 9.0 Tray Icon.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\America Online 9.0 Tray Icon.lnk
backup=C:\WINDOWS\pss\America Online 9.0 Tray Icon.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk
backup=C:\WINDOWS\pss\Digital Line Detect.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech Desktop Messenger.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Logitech Desktop Messenger.lnk
backup=C:\WINDOWS\pss\Logitech Desktop Messenger.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^NkbMonitor.exe.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\NkbMonitor.exe.lnk
backup=C:\WINDOWS\pss\NkbMonitor.exe.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^QuickBooks Update Agent.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\QuickBooks Update Agent.lnk
backup=C:\WINDOWS\pss\QuickBooks Update Agent.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Dell Wireless Manager UI]
C:\WINDOWS\system32\WLTRAY
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupport]
"C:\Program Files\Dell Support\DSAgnt.exe" /startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dla]
C:\WINDOWS\system32\dla\tfswctrl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDLauncher]
"C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ErrorGuard]
C:\Program Files\ErrorGuard\ErrorGuard.Exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager]
C:\Program Files\Common Files\AOL\1124546517\ee\AOLHostManager.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Component Manager]
"C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
C:\Program Files\iTunes\iTunesHelper.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LDM]
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechVideoRepair]
C:\Program Files\Logitech\Video\ISStart.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechVideoTray]
C:\Program Files\Logitech\Video\LogiTray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LVCOMSX]
C:\WINDOWS\system32\LVCOMSX.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mmtask]
"C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MMTray]
"C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"C:\Program Files\Messenger\msmsgs.exe" /background
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe" -atboottime
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray]
C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdateManager]
"C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
AutoRun\command- E:\LaunchU3.exe -a
Contents of the 'Scheduled Tasks' folder
2007-07-19 14:56:42 C:\WINDOWS\tasks\McAfee.com Update Check (BEN-Whitney).job
2007-07-19 15:17:00 C:\WINDOWS\tasks\Symantec NetDetect.job
**************************************************************************
catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer,
http://www.gmer.net
Rootkit scan 2007-07-19 08:19:01
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
Completion time: 2007-07-19 8:21:04 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-07-19 08:20
--- E O F ---
Logfile of HijackThis v1.99.1
Scan saved at 8:24:38 AM, on 7/19/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wltrysvc.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
C:\WINDOWS\system32\svchost.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\Program Files\Stardock\Object Desktop\WindowBlinds\wbload.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
C:\Program Files\Apoint\Apntex.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Whitney\My Documents\hijackthis\Scanner.exe.exe
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext =
http://v4.windowsupdate.microsoft.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)
O2 - BHO: (no name) - {2E9D4C81-9F27-4c14-B804-7B0F6BC88A4F} - C:\Program Files\Outerinfo\Outerinfo.dll (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {A6702926-5DF1-4785-802A-FE4A03F3B910} - C:\WINDOWS\system32\geebc.dll (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [McRegWiz] C:\PROGRA~1\mcafee.com\agent\mcregwiz.exe /autorun
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Mocgpy] "C:\Documents and Settings\Whitney\Application Data\?ymantec\?canregw.exe"
O4 - HKCU\..\Run: [Sen] "C:\WINDOWS\MCROSO~1\winword.exe" -vt ndrv
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} -
http://wwws.musicmat...enWebRadio.html (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) -
http://by108fd.bay10...es/MsnPUpld.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) -
http://upload.facebo...otoUploader.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WB - C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\fastload.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Automatic LiveUpdate Scheduler - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - Networks Associates Technology, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe