Spyware / Malware / Virus Removal

[Resolved]Qwerty12.exe And Others. I Have 2 Computers, Only 1 Infected

16 min read

Looking for the outcome? Ask AI

troubleddude Topic Starter

Post #1July 20, 2007, 2:37 AM UTC

Hello, about 30 hours ago I downloaded and installed LimeWire and through that, downloaded a zip or similarly compressed file. When opening the file, problems started instantly and have persisted since.

Symptoms include:

Pop-ups on the internet
The homepage being in internet options
Key strokes and mouse actions ceasing to work on websites until re-clicking the page
Firewall notices blocking or requesting the blocking or allowing of actions, most notably what seemed to be an attempted remote access attempt – “Remote Service (TCP:80) Remote Address [removed]”
When disconnected from the internet, pop-up boxes appearing - Work offline with the clickable tabs “Work offline” and “Try Again”, and similarly – Web page unavailable with the clickable tabs “Connect” and “Stay Offline”

Looking at msconfig startup showed an item with bank fields under “startup item” and “command”. I unchecked this when found.

Windows Notice pop-up:
“Notice – if your computer has errors in the registry database or file system, it could cause unpredictable or erratic behaviour, freezes and crashes. Fixing these errors can increase your computers performance and prevent data loss. Would you like to install Error Protector to check your computer for free? (recommended)”
Clickable tabs: “OK” and “Cancel”

I have been using Windows Live OneCare and since the problems started have installed Quick Heal Total Security. Both are in the free trial status but are within the trial duration. Between the two, I have identified the following suspect files:

Qwerty12.exe
Tmp8E.exe
TMP1B.TMP.EXE
Trojan Downloader ConHook.bg
Windows\system32\mlljjhi
Browser Modifier:Win32\fotomoto
Windows\system32\DDABX.exe

Having ensured Quick Heal is up to date, it has twice now displayed a popup saying it has detected and removed or perhaps deleted (I forget the exact term) qwerty12.exe.

Here is my Hijackthis log

Logfile of HijackThis v1.99.1
Scan saved at 3:30:47 AM, on 7/20/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Microsoft Windows OneCare Live\Antivirus\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Digidesign\Drivers\MMERefresh.exe
C:\WINDOWS\System32\GEARSec.exe
C:\PROGRA~1\CATCOM~1\QUICKH~1\ONLNSVC.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\PROGRA~1\CATCOM~1\QUICKH~1\EMLPROXY.EXE
C:\Program Files\Cat Computer\Quick Heal Firewall Pro\qhfw.exe
C:\PROGRA~1\CATCOM~1\QUICKH~1\scanwscs.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Microsoft Windows OneCare Live\Firewall\msfwsvc.exe
C:\Program Files\Microsoft Windows OneCare Live\winss.exe
C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\PROGRA~1\CATCOM~1\QUICKH~1\EMLPROUI.EXE
C:\PROGRA~1\CATCOM~1\QUICKH~1\UPSCHD.EXE
C:\PROGRA~1\CATCOM~1\QUICKH~1\SCANMSG.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\CATCOM~1\QUICKH~1\OnlineNT.EXE
C:\Program Files\Microsoft Office\Office\WINWORD.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\You Slag\Application Data\tmp1B.tmp.exe
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.co.uk/ig/dell?hl=en&client=dell-usuk&channel=uk&ibd=6061109
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.co.uk/hws/sb/dell-usuk/e…html?channel=uk
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.co.uk/ig/dell?hl=en&client=dell-usuk&channel=uk&ibd=6061109
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.google.co.uk/ig/dell?hl=en&…amp;ibd=6061109
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: (no name) - {938A8A03-A938-4019-B764-03FF8D167D79} - C:\WINDOWS\system32\tmp1A.tmp.dll
O2 - BHO: (no name) - {afee0f71-81cc-4e02-8168-a1bcf9a180e0} - C:\WINDOWS\system32\dgsdit.dll
O2 - BHO: CBrowserHelperObject Object - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
O2 - BHO: Anti Popup - {EFCA9D4B-F2E8-487d-8505-E4D0E459ABFE} - C:\PROGRA~1\CATCOM~1\QUICKH~1\apop.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [DigidesignMMERefresh] C:\Program Files\Digidesign\Drivers\MMERefresh.exe
O4 - HKLM\..\Run: [SNM] C:\Documents and Settings\You Slag\My Documents\Protection\SNM.exe /startup
O4 - HKLM\..\Run: [OneCareUI] "C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe"
O4 - HKLM\..\Run: [Email Protection] C:\PROGRA~1\CATCOM~1\QUICKH~1\EMLPROUI.EXE
O4 - HKLM\..\Run: [Update Scheduler] C:\PROGRA~1\CATCOM~1\QUICKH~1\UPSCHD.EXE /CHECK
O4 - HKLM\..\Run: [On-Line Protection] C:\PROGRA~1\CATCOM~1\QUICKH~1\CATEYE.EXE
O4 - HKLM\..\Run: [Messenger] C:\PROGRA~1\CATCOM~1\QUICKH~1\SCANMSG.EXE
O4 - HKLM\..\Run: [Startup Scan] C:\PROGRA~1\CATCOM~1\QUICKH~1\Sensor.EXE /LOADRUN
O4 - HKLM\..\Run: [Quick Heal Firewall Pro] "C:\Program Files\Cat Computer\Quick Heal Firewall Pro\qhfw.exe" /waitservice
O4 - HKLM\..\Run: [winehq.org] rundll32.exe "C:\WINDOWS\awwvut.dll",realset
O4 - HKLM\..\RunOnce: [Startup Scan] C:\PROGRA~1\CATCOM~1\QUICKH~1\Sensor.EXE /check
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS…er.cab31267.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by121fd.bay121.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-GB/a-UNO1/GAME_UNO1.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo…otoUploader.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1175598155031
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab31267.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS…er.cab56986.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/Solit…wn.cab31267.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs: c:\windows\system32\mlljjhi.dll
O20 - Winlogon Notify: dgsdit - C:\WINDOWS\SYSTEM32\dgsdit.dll
O20 - Winlogon Notify: MacDrive-iTunes compatibility - C:\Program Files\Common Files\Mediafour\MacDriveiTunesPatch.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Digidesign MME Refresh Service (DigiRefresh) - Digidesign, A Division of Avid Technology, Inc. - C:\Program Files\Digidesign\Drivers\MMERefresh.exe
O23 - Service: digiSPTIService - Digidesign, A Division of Avid Technology, Inc. - C:\Program Files\Digidesign\Pro Tools\digiSPTIService.exe
O23 - Service: DomainService - Unknown owner - C:\WINDOWS\system32\qwerty12.exe (file missing)
O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\System32\GEARSec.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton Ghost - Symantec Corporation - C:\Program Files\Norton Ghost\Agent\VProSvc.exe
O23 - Service: NT Online Protection - CAT Computer Services Pvt. Ltd - C:\PROGRA~1\CATCOM~1\QUICKH~1\ONLNSVC.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Quick Heal Total Security Mail Protection - CAT Computer Services Pvt. Ltd. - C:\PROGRA~1\CATCOM~1\QUICKH~1\EMLPROXY.EXE
O23 - Service: Quick Heal Firewall Service (QuickHealFirewall) - Agnitum Ltd. - C:\Program Files\Cat Computer\Quick Heal Firewall Pro\qhfw.exe
O23 - Service: Total Security Helper Service WSC (ScanWscS) - CAT Computer Services Pvt. Ltd - C:\PROGRA~1\CATCOM~1\QUICKH~1\scanwscs.exe
O23 - Service: Quick Heal Total Security Startup Handler (Startup Handler) - Unknown owner - C:\PROGRA~1\CATCOM~1\QUICKH~1\strtsvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

Any help much appreciated!

Scotty

Post #2July 20, 2007, 10:20 PM UTC

Hi! Welcome to the Tom Coyote forums.
My name is Scotty. I would be glad to take a look at your log and help you with solving any malware problems. HijackThis logs can take a while to research.
Please be patient and I'd be grateful if you would note the following:

I will working be on your Malware issues, this may or may not, solve other issues you have with your machine.
The fixes are specific to your problem and should only be used for this issue on this machine.
Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
It's often worth reading through these instructions and printing them for ease of reference.
If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
Please reply to this thread. Do not start a new topic.

Download and Run ComboFix

Download this file from below:

Here
Then double click combofix.exe & follow the prompts.
When finished, it shall produce a log for you. Post that log in your next reply with a new HijackThis log.

Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall

troubleddude

Post #3July 21, 2007, 11:37 AM UTC

Hi Mac, thanks for taking my problem on!

Ok here is the combofix log

"You Slag" - 2007-07-21 12:12:15 - ComboFix 07-07-21.5 - Service Pack 2 NTFS

(((((((((((((((((((((((((((((((((((((((((((( V Log )))))))))))))))))))))))))))))))))))))))))))))))))))))))

C:\WINDOWS\awwvut.dll
C:\WINDOWS\gebyvw.dll
C:\WINDOWS\tuvwwa.ini
C:\WINDOWS\wvybeg.ini
C:\WINDOWS\system32\dgsdit.dll

* * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

C:\DOCUME~1\YOUSLA~1\APPLIC~1\tmp10.tmp.exe
C:\DOCUME~1\YOUSLA~1\APPLIC~1\tmp12.tmp.exe
C:\DOCUME~1\YOUSLA~1\APPLIC~1\tmp19.tmp.exe
C:\DOCUME~1\YOUSLA~1\APPLIC~1\tmp1A.tmp.exe
C:\DOCUME~1\YOUSLA~1\APPLIC~1\tmp1B.tmp.exe
C:\DOCUME~1\YOUSLA~1\APPLIC~1\tmp1C.tmp.exe
C:\DOCUME~1\YOUSLA~1\APPLIC~1\tmp43.tmp.exe
C:\DOCUME~1\YOUSLA~1\APPLIC~1\tmp46.tmp.exe
C:\DOCUME~1\YOUSLA~1\APPLIC~1\tmp47.tmp.exe
C:\DOCUME~1\YOUSLA~1\APPLIC~1\tmp55.tmp.exe
C:\DOCUME~1\YOUSLA~1\APPLIC~1\tmp8A.tmp.exe
C:\DOCUME~1\YOUSLA~1\APPLIC~1\tmp8D.tmp.exe
C:\DOCUME~1\YOUSLA~1\APPLIC~1\tmp8E.tmp.exe
C:\DOCUME~1\YOUSLA~1\APPLIC~1\tmp98.tmp.exe
C:\DOCUME~1\YOUSLA~1\APPLIC~1\tmpC5.tmp.exe
C:\DOCUME~1\YOUSLA~1\APPLIC~1\tmpC6.tmp.exe
C:\DOCUME~1\YOUSLA~1\APPLIC~1\tmpC7.tmp.exe
C:\DOCUME~1\YOUSLA~1\APPLIC~1\tmpE.tmp.exe
C:\WINDOWS\system32\tmp10.tmp.dll
C:\WINDOWS\system32\tmp1A.tmp.dll
C:\WINDOWS\system32\tmp46.tmp.dll
C:\WINDOWS\system32\tmp8D.tmp.dll
C:\WINDOWS\system32\tmpC6.tmp.dll

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

——-\LEGACY_DOMAINSERVICE
——-\DomainService

((((((((((((((((((((((((( Files Created from 2007-06-21 to 2007-07-21 )))))))))))))))))))))))))))))))

2007-07-21 12:04 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-07-19 11:50 d——– C:\Program Files\Spynomore deleted
2007-07-18 22:38 38,272 –a—— C:\WINDOWS\system32\drivers\ONLINENT.SYS
2007-07-18 22:38 19,456 –a—— C:\WINDOWS\system32\drivers\SCREENNT.SYS
2007-07-18 22:37 12,424 –a—— C:\WINDOWS\system32\drivers\EMLTDI.SYS
2007-07-18 22:37 d——– C:\Program Files\Cat Computer
2007-07-17 16:13 d——– C:\Program Files\iTunes
2007-07-17 16:11 d——– C:\Program Files\Apple Software Update
2007-07-17 16:10 d——– C:\Program Files\Common Files\Apple
2007-07-17 16:10 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple
2007-07-10 12:45 81,024 –a—— C:\WINDOWS\system32\drivers\msfwdrv.sys
2007-07-10 12:45 67,784 –a—— C:\WINDOWS\system32\drivers\MpFilter.sys
2007-07-10 12:45 105,856 –a—— C:\WINDOWS\system32\drivers\msfwhlpr.sys
2007-07-10 12:35 d——– C:\Program Files\Microsoft Windows OneCare Live

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-07-17 15:13:35 ——– d—–w C:\Program Files\iPod
2007-07-17 15:12:42 ——– d—–w C:\Program Files\QuickTime
2007-07-06 10:48:25 ——– d—–w C:\DOCUME~1\YOUSLA~1\APPLIC~1\Digidesign
2007-07-05 11:46:51 32 —-a-w C:\WINDOWS\system32\msvcsv60.dll
2007-07-05 11:46:51 32 —-a-w C:\WINDOWS\msocreg32.dat
2007-06-07 13:02:42 5,798 –sha-w C:\WINDOWS\system32\KGyGaAvL.sys
2007-06-07 13:02:39 88 –sh–r C:\WINDOWS\system32\9F45E9CC44.sys
2007-05-16 15:12:02 683,520 —-a-w C:\WINDOWS\system32\inetcomm.dll
2007-04-28 09:57:37 1,152 —-a-w C:\WINDOWS\system32\windrv.sys
2007-04-25 14:21:15 144,896 —-a-w C:\WINDOWS\system32\schannel.dll
2006-11-22 17:49:34 88 –sh–r C:\WINDOWS\system32\BEFCF62DC9.sys

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SigmatelSysTrayApp"="stsystra.exe" [2006-08-15 11:00 C:\WINDOWS\stsystra.exe]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2004-12-13 16:30]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 17:50]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 17:50]
"DigidesignMMERefresh"="C:\Program Files\Digidesign\Drivers\MMERefresh.exe" [2005-10-26 01:21]
"SNM"="C:\Documents and Settings\You Slag\My Documents\Protection\SNM.exe" []
"OneCareUI"="C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe" [2007-06-11 12:40]
"Email Protection"="C:\PROGRA~1\CATCOM~1\QUICKH~1\EMLPROUI.EXE" [2007-07-18 22:37]
"Update Scheduler"="C:\PROGRA~1\CATCOM~1\QUICKH~1\UPSCHD.exe" [2007-07-18 22:37]
"On-Line Protection"="C:\PROGRA~1\CATCOM~1\QUICKH~1\CATEYE.EXE" [2007-07-18 22:37]
"Messenger"="C:\PROGRA~1\CATCOM~1\QUICKH~1\SCANMSG.EXE" [2007-07-18 22:37]
"Startup Scan"="C:\PROGRA~1\CATCOM~1\QUICKH~1\Sensor.exe" [2007-07-18 22:37]
"Quick Heal Firewall Pro"="C:\Program Files\Cat Computer\Quick Heal Firewall Pro\qhfw.exe" [2007-04-06 13:12]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 06:00]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonce]
"Startup Scan"=C:\PROGRA~1\CATCOM~1\QUICKH~1\Sensor.EXE /check

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [2006-10-04 21:22:36]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\MacDrive-iTunes compatibility]
C:\Program Files\Common Files\Mediafour\MacDriveiTunesPatch.dll 2003-11-07 11:24 61440 C:\Program Files\Common Files\Mediafour\MacDriveiTunesPatch.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=c:\windows\system32\mlljjhi.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\OneCareMP]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^AOL 9.0 Tray Icon.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\AOL 9.0 Tray Icon.lnk
backup=C:\WINDOWS\pss\AOL 9.0 Tray Icon.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Dell Network Assistant.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Dell Network Assistant.lnk
backup=C:\WINDOWS\pss\Dell Network Assistant.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Ralink Wireless Utility.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Ralink Wireless Utility.lnk
backup=C:\WINDOWS\pss\Ralink Wireless Utility.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOLDialer]
C:\Program Files\Common Files\AOL\ACS\AOLDial.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Corel Photo Downloader]
C:\Program Files\Corel\Corel Snapfire Plus\Corel Photo Downloader.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DMXLauncher]
C:\Program Files\Dell\Media Experience\DMXLauncher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
"C:\Program Files\iTunes\iTunesHelper.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCAgentExe]
c:\PROGRA~1\mcafee.com\agent\McAgent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCUpdateExe]
C:\PROGRA~1\mcafee.com\agent\McUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MDDiskProtect.exe]
C:\Program Files\Mediafour\MacDrive\MDDiskProtect.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Mediafour Mac Volume Notifications]
"C:\Program Files\Common Files\Mediafour\MACVNTFY.EXE" /auto

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MediafourGettingStartedWithMacDrive6]
"C:\Program Files\Mediafour\MacDrive\MacDrive.exe" /runonce

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MPFExe]
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSKAGENTEXE]
C:\PROGRA~1\mcafee\SPAMKI~1\mskagent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSKDetectorExe]
C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
"C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Norton Ghost 10.0]
"C:\Program Files\Norton Ghost\Agent\GhostTray.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OASClnt]
C:\Program Files\McAfee.com\VSO\oasclnt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\QTTask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray]
C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
"C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VirusScan Online]
C:\Program Files\McAfee.com\VSO\mcvsshld.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VSOCheckTask]
"C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet

adblock.dll - \??\C:\Program Files\Cat Computer\Quick Heal Firewall Pro\kernel\ADBLOCK.DLL - Quick Heal PlugIn (ADBLOCK.DLL)
agpcpq - \SystemRoot\system32\DRIVERS\agpCPQ.sys - Compaq AGP Bus Filter
amdk8 - system32\DRIVERS\AmdK8.sys - AMD Processor Driver
arp.dll - \??\C:\Program Files\Cat Computer\Quick Heal Firewall Pro\kernel\ARP.DLL - Quick Heal PlugIn (ARP.DLL)
bcm4sbxp - system32\DRIVERS\bcm4sbxp.sys - Broadcom 440x 10/100 Integrated Controller XP Driver
content.dll - \??\C:\Program Files\Cat Computer\Quick Heal Firewall Pro\kernel\CONTENT.DLL - Quick Heal PlugIn (CONTENT.DLL)
dalwdmservice - system32\drivers\dalwdm.sys - dal service
digifilter - system32\drivers\DigiFilt.sys - DigiFilter
dlaboiom - System32\DLA\DLABOIOM.SYS
dlacdbhm - System32\Drivers\DLACDBHM.SYS
dladresn - System32\DLA\DLADResN.SYS
dlaifs_m - System32\DLA\DLAIFS_M.SYS
dlaopiom - System32\DLA\DLAOPIOM.SYS
dlapoolm - System32\DLA\DLAPoolM.SYS
dlartl_n - System32\Drivers\DLARTL_N.SYS
dlaudfam - System32\DLA\DLAUDFAM.SYS
dlaudf_m - System32\DLA\DLAUDF_M.SYS
dnscache.dll - \??\C:\Program Files\Cat Computer\Quick Heal Firewall Pro\kernel\DNSCACHE.DLL - Quick Heal PlugIn (DNSCACHE.DLL)
drvmcdb - System32\Drivers\DRVMCDB.SYS
drvnddm - System32\Drivers\DRVNDDM.SYS
dsproct - \??\C:\Program Files\Dell Support\GTAction\triggers\DSproct.sys - DSproct
e100b - system32\DRIVERS\e100b325.sys - Intel® PRO Adapter Driver
emlss - system32\drivers\emltdi.sys - EMLSS
fax - %systemroot%\system32\fxssvc.exe - Fax
ftpfilt.dll - \??\C:\Program Files\Cat Computer\Quick Heal Firewall Pro\kernel\FTPFILT.DLL - Quick Heal PlugIn (FTPFILT.DLL)
htmlfilt.dll - \??\C:\Program Files\Cat Computer\Quick Heal Firewall Pro\kernel\HTMLFILT.DLL - Quick Heal PlugIn (HTMLFILT.DLL)
httpfilt.dll - \??\C:\Program Files\Cat Computer\Quick Heal Firewall Pro\kernel\HTTPFILT.DLL - Quick Heal PlugIn (HTTPFILT.DLL)
imapfilt.dll - \??\C:\Program Files\Cat Computer\Quick Heal Firewall Pro\kernel\IMAPFILT.DLL - Quick Heal PlugIn (IMAPFILT.DLL)
mailfilt.dll - \??\C:\Program Files\Cat Computer\Quick Heal Firewall Pro\kernel\MAILFILT.DLL - Quick Heal PlugIn (MAILFILT.DLL)
mbx2dfu - SYSTEM32\DRIVERS\MBX2DFU.sys
mbx2midk - system32\drivers\mbx2midk.sys - Digidesign Mbox 2 Midi Driver
mpfilter - system32\DRIVERS\MpFilter.sys - Microsoft Malware Protection Driver
msfwdrv - system32\DRIVERS\msfwdrv.sys - MSFWDrv
msfwhlpr - system32\DRIVERS\msfwhlpr.sys - MSFWHLPR
msfwsvc - OneCare Firewall - "C:\Program Files\Microsoft Windows OneCare Live\Firewall\msfwsvc.exe"
nntpfilt.dll - \??\C:\Program Files\Cat Computer\Quick Heal Firewall Pro\kernel\NNTPFILT.DLL - Quick Heal PlugIn (NNTPFILT.DLL)
onecaremp - "C:\Program Files\Microsoft Windows OneCare Live\Antivirus\MsMpEng.exe" - OneCare AntiSpyware and AntiVirus
onlinent - \??\C:\PROGRA~1\CATCOM~1\QUICKH~1\ONLINENT.SYS - OnlineNT
philcam8116 - system32\DRIVERS\CamDrO21.sys - Logitech QuickCam Pro 3000 (08B0)
pop3filt.dll - \??\C:\Program Files\Cat Computer\Quick Heal Firewall Pro\kernel\POP3FILT.DLL - Quick Heal PlugIn (POP3FILT.DLL)
protect.dll - \??\C:\Program Files\Cat Computer\Quick Heal Firewall Pro\kernel\PROTECT.DLL - Quick Heal PlugIn (PROTECT.DLL)
quick heal total security mail protection - C:\PROGRA~1\CATCOM~1\QUICKH~1\EMLPROXY.EXE - Quick Heal Total Security Mail Protection
qv2kux - system32\DRIVERS\qv2kux.sys - Casio Digital Camera
rt73 - system32\DRIVERS\rt73.sys - RT73 USB Wireless LAN Card Driver
screennt - system32\drivers\ScreenNT.sys - ScreenNT
secret.dll - \??\C:\Program Files\Cat Computer\Quick Heal Firewall Pro\kernel\SECRET.DLL - Quick Heal PlugIn (SECRET.DLL)
ss_bus - system32\DRIVERS\ss_bus.sys - Samsung Mobile USB Device 1.0 driver (WDM)
ss_mdfl - system32\DRIVERS\ss_mdfl.sys - SAMSUNG Mobile USB Modem 1.0 Filter
ss_mdm - system32\DRIVERS\ss_mdm.sys - SAMSUNG Mobile USB Modem 1.0 Drivers
startup handler - C:\PROGRA~1\CATCOM~1\QUICKH~1\strtsvc.exe - Quick Heal Total Security Startup Handler
sthda - system32\drivers\sthda.sys - SigmaTel High Definition Audio CODEC
vfilt - \??\C:\Program Files\Cat Computer\Quick Heal Firewall Pro\kernel\FILTNT.SYS - Quick Heal Kernel Driver
wanatw - system32\DRIVERS\wanatw4.sys - WAN Miniport (ATW)

Contents of the 'Scheduled Tasks' folder
2007-07-17 15:11:21 C:\WINDOWS\tasks\AppleSoftwareUpdate.job

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-21 12:19:01
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden registry entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-07-21 12:20:02 - machine was rebooted
C:\ComboFix-quarantined-files.txt … 2007-07-21 12:19

— E O F —

And here is the new Hijackthis log after the combofix reboot:

Logfile of HijackThis v1.99.1
Scan saved at 12:21:15 PM, on 7/21/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Microsoft Windows OneCare Live\Antivirus\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Digidesign\Drivers\MMERefresh.exe
C:\WINDOWS\System32\GEARSec.exe
C:\PROGRA~1\CATCOM~1\QUICKH~1\ONLNSVC.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\PROGRA~1\CATCOM~1\QUICKH~1\EMLPROXY.EXE
C:\Program Files\Cat Computer\Quick Heal Firewall Pro\qhfw.exe
C:\PROGRA~1\CATCOM~1\QUICKH~1\scanwscs.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Microsoft Windows OneCare Live\Firewall\msfwsvc.exe
C:\Program Files\Microsoft Windows OneCare Live\winss.exe
C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\PROGRA~1\CATCOM~1\QUICKH~1\EMLPROUI.EXE
C:\PROGRA~1\CATCOM~1\QUICKH~1\UPSCHD.EXE
C:\PROGRA~1\CATCOM~1\QUICKH~1\SCANMSG.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.co.uk/ig/dell?hl=en&client=dell-usuk&channel=uk&ibd=6061109
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.google.co.uk/ig/dell?hl=en&…amp;ibd=6061109
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: CBrowserHelperObject Object - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
O2 - BHO: Anti Popup - {EFCA9D4B-F2E8-487d-8505-E4D0E459ABFE} - C:\PROGRA~1\CATCOM~1\QUICKH~1\apop.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [DigidesignMMERefresh] C:\Program Files\Digidesign\Drivers\MMERefresh.exe
O4 - HKLM\..\Run: [SNM] C:\Documents and Settings\You Slag\My Documents\Protection\SNM.exe /startup
O4 - HKLM\..\Run: [OneCareUI] "C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe"
O4 - HKLM\..\Run: [Email Protection] C:\PROGRA~1\CATCOM~1\QUICKH~1\EMLPROUI.EXE
O4 - HKLM\..\Run: [Update Scheduler] C:\PROGRA~1\CATCOM~1\QUICKH~1\UPSCHD.EXE /CHECK
O4 - HKLM\..\Run: [On-Line Protection] C:\PROGRA~1\CATCOM~1\QUICKH~1\CATEYE.EXE
O4 - HKLM\..\Run: [Messenger] C:\PROGRA~1\CATCOM~1\QUICKH~1\SCANMSG.EXE
O4 - HKLM\..\Run: [Startup Scan] C:\PROGRA~1\CATCOM~1\QUICKH~1\Sensor.EXE /LOADRUN
O4 - HKLM\..\Run: [Quick Heal Firewall Pro] "C:\Program Files\Cat Computer\Quick Heal Firewall Pro\qhfw.exe" /waitservice
O4 - HKLM\..\RunOnce: [Startup Scan] C:\PROGRA~1\CATCOM~1\QUICKH~1\Sensor.EXE /check
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS…er.cab31267.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by121fd.bay121.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-GB/a-UNO1/GAME_UNO1.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo…otoUploader.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1175598155031
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab31267.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS…er.cab56986.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/Solit…wn.cab31267.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs: c:\windows\system32\mlljjhi.dll
O20 - Winlogon Notify: MacDrive-iTunes compatibility - C:\Program Files\Common Files\Mediafour\MacDriveiTunesPatch.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Digidesign MME Refresh Service (DigiRefresh) - Digidesign, A Division of Avid Technology, Inc. - C:\Program Files\Digidesign\Drivers\MMERefresh.exe
O23 - Service: digiSPTIService - Digidesign, A Division of Avid Technology, Inc. - C:\Program Files\Digidesign\Pro Tools\digiSPTIService.exe
O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\System32\GEARSec.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton Ghost - Symantec Corporation - C:\Program Files\Norton Ghost\Agent\VProSvc.exe
O23 - Service: NT Online Protection - CAT Computer Services Pvt. Ltd - C:\PROGRA~1\CATCOM~1\QUICKH~1\ONLNSVC.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Quick Heal Total Security Mail Protection - CAT Computer Services Pvt. Ltd. - C:\PROGRA~1\CATCOM~1\QUICKH~1\EMLPROXY.EXE
O23 - Service: Quick Heal Firewall Service (QuickHealFirewall) - Agnitum Ltd. - C:\Program Files\Cat Computer\Quick Heal Firewall Pro\qhfw.exe
O23 - Service: Total Security Helper Service WSC (ScanWscS) - CAT Computer Services Pvt. Ltd - C:\PROGRA~1\CATCOM~1\QUICKH~1\scanwscs.exe
O23 - Service: Quick Heal Total Security Startup Handler (Startup Handler) - Unknown owner - C:\PROGRA~1\CATCOM~1\QUICKH~1\strtsvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

If it is helpful, further symptoms/reactions are:

When I executed the combofix exe quickheal poppped up saying it had Deleted: Trojan.Audoit.D in Combofix/ntp.exe

It also quarantined windows\catchme.exe and windows\system32\swreg.exe

I assumed this was quickheal being over-cautious with regards to the quarantines so I dissabled quickheal and re-executed combofix and the above logs were produced.

On connecting to the internet again to post this (I am posting from the infected computer) another remote action was blocked:
"Remote service )TCP:80)
Remote Address [removed]"

A message popped up saying "Internet explorer is not currently your default browser. Would you like to make it your default bwoser?
*tickbox* Always perform this check when starting Internet Explorer
Clickable boxes Yes, No"

I had to click yes.

I have not seen one internet pop-up since being connected to post this

What's the next step?

Scotty

Post #4July 21, 2007, 2:24 PM UTC

Hello troubledude.

My apologies. I should have had you disable Quickheal. Could you do that now, before following the next instruction?

Download and Run SmitfraudFix
Please download SmitfraudFix (by S!Ri)
Extract the content (a folder named SmitfraudFix) to your Desktop.

Open the SmitfraudFix folder and double-click smitfraudfix.cmd
Select option #1 - Search by typing 1 and press "Enter"; a text file will appear, which lists infected files (if present).
Please copy/paste the content of that report into your next reply.

Note : process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user.

troubleddude

Post #5July 21, 2007, 3:40 PM UTC

Hi Scotty/Mac

Here is the smitfraudfix report: SmitFraudFix v2.205 Scan done at 16:35:43.67, Sat 07/21/2007 Run from C:\Documents and Settings\You Slag\Desktop\HJT\SmitFraud\SmitfraudFix OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT The filesystem type is NTFS Fix run in normal mode »»»»»»»»»»»»»»»»»»»»»»»» Process C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Microsoft Windows OneCare Live\Antivirus\MsMpEng.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Digidesign\Drivers\MMERefresh.exe C:\WINDOWS\System32\GEARSec.exe C:\PROGRA~1\CATCOM~1\QUICKH~1\ONLNSVC.EXE C:\WINDOWS\system32\nvsvc32.exe C:\PROGRA~1\CATCOM~1\QUICKH~1\EMLPROXY.EXE C:\Program Files\Cat Computer\Quick Heal Firewall Pro\qhfw.exe C:\PROGRA~1\CATCOM~1\QUICKH~1\scanwscs.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Microsoft Windows OneCare Live\Firewall\msfwsvc.exe C:\Program Files\Microsoft Windows OneCare Live\winss.exe C:\WINDOWS\stsystra.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe C:\PROGRA~1\CATCOM~1\QUICKH~1\EMLPROUI.EXE C:\PROGRA~1\CATCOM~1\QUICKH~1\UPSCHD.EXE C:\PROGRA~1\CATCOM~1\QUICKH~1\SCANMSG.EXE C:\WINDOWS\system32\ctfmon.exe C:\PROGRA~1\CATCOM~1\QUICKH~1\OnlineNT.EXE C:\WINDOWS\system32\cmd.exe »»»»»»»»»»»»»»»»»»»»»»»» hosts »»»»»»»»»»»»»»»»»»»»»»»» C:\ »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32 »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\You Slag »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\You Slag\Application Data »»»»»»»»»»»»»»»»»»»»»»»» Start Menu »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\YOUSLA~1\FAVORI~1 »»»»»»»»»»»»»»»»»»»»»»»» Desktop »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files »»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys »»»»»»»»»»»»»»»»»»»»»»»» Desktop Components [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components] "Source"="About:Home" "SubscribedURL"="About:Home" "FriendlyName"="My Current Home Page" »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLs"="c:\\windows\\system32\\mlljjhi.dll" »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "System"="" »»»»»»»»»»»»»»»»»»»»»»»» Rustock »»»»»»»»»»»»»»»»»»»»»»»» DNS HKLM\SYSTEM\CCS\Services\Tcpip\..\{1CC347BD-B64E-4D8F-98AD-7CA3686AA98B}: DhcpNameServer=192.168.1.1 HKLM\SYSTEM\CCS\Services\Tcpip\..\{E6599767-4674-4C4B-BB58-8EFD1A4F6722}: DhcpNameServer=192.168.1.1 HKLM\SYSTEM\CS1\Services\Tcpip\..\{1CC347BD-B64E-4D8F-98AD-7CA3686AA98B}: DhcpNameServer=192.168.1.1 HKLM\SYSTEM\CS1\Services\Tcpip\..\{E6599767-4674-4C4B-BB58-8EFD1A4F6722}: DhcpNameServer=192.168.1.1 HKLM\SYSTEM\CS3\Services\Tcpip\..\{1CC347BD-B64E-4D8F-98AD-7CA3686AA98B}: DhcpNameServer=192.168.1.1 HKLM\SYSTEM\CS3\Services\Tcpip\..\{E6599767-4674-4C4B-BB58-8EFD1A4F6722}: DhcpNameServer=192.168.1.1 »»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection »»»»»»»»»»»»»»»»»»»»»»»» End

Scotty

Post #6July 21, 2007, 5:11 PM UTC

Hello troubleddude

Reboot into SAFE MODEBy pressing the F8 key right when Windows starts, usually right after you hear your computer
beep when you reboot it (some versions of windows will display 'Starting Windows' with a grey progress bar)
you will be brought to a menu where you can choose to boot into safe mode.

If it does not work on the first try, reboot and try again, as you have to be quick when you press it.

I have found that during boot up, right after the computer displays the equipment , memory, etc
installed on your computer, if you start lightly tapping the F8 key, the system will usually display the menu.

Run Smitfraudfix
Open the SmitfraudFix folder again and double-click smitfraudfix.cmd
Select option #2 - Clean by typing 2 and press "Enter" to delete infected files.

You will be prompted : "Registry cleaning - Do you want to clean the registry ?"; answer "Yes" by typing Y and press "Enter" in order to remove the Desktop background and clean registry keys associated with the infection.

The tool will now check if wininet.dll is infected. You may be prompted to replace the infected file (if found); answer "Yes" by typing Y and press "Enter".

The tool may need to restart your computer to finish the cleaning process; if it doesn't, please restart it into Normal Windows.
A text file will appear onscreen, with results from the cleaning process; please copy/paste the content of that report into your next reply.
The report can also be found at the root of the system drive, usually at C:\rapport.txt

Warning : running option #2 on a non infected computer will remove your Desktop background.

Post back with the Rapport.txt and a new HijackThis log.

troubleddude

Post #7July 21, 2007, 5:54 PM UTC

Hello again

I did not notice smitfraud checking if wininet.dll was infected but maybe I was not supposed to see that happen? And i was not prompted to replace the infected fil if found.

I had to restart the computer myself afterwards and when I returned, there was no log on the screen, but I saved the log before restarting anyway so hopefuly it is still the same information you need

Here is the Smitfraud log:

SmitFraudFix v2.205

Scan done at 18:40:43.06, Sat 07/21/2007
Run from C:\Documents and Settings\You Slag\Desktop\HJT\SmitFraud\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in safe mode

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Killing process

»»»»»»»»»»»»»»»»»»»»»»»» hosts

127.0.0.1 localhost

»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files

»»»»»»»»»»»»»»»»»»»»»»»» DNS

HKLM\SYSTEM\CCS\Services\Tcpip\..\{1CC347BD-B64E-4D8F-98AD-7CA3686AA98B}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\..\{E6599767-4674-4C4B-BB58-8EFD1A4F6722}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{1CC347BD-B64E-4D8F-98AD-7CA3686AA98B}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{E6599767-4674-4C4B-BB58-8EFD1A4F6722}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\..\{1CC347BD-B64E-4D8F-98AD-7CA3686AA98B}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\..\{E6599767-4674-4C4B-BB58-8EFD1A4F6722}: DhcpNameServer=192.168.1.1

»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""

»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» End

And here is the new Hijackthis log:

Logfile of HijackThis v1.99.1
Scan saved at 6:45:20 PM, on 7/21/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Microsoft Windows OneCare Live\Antivirus\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Digidesign\Drivers\MMERefresh.exe
C:\WINDOWS\System32\GEARSec.exe
C:\PROGRA~1\CATCOM~1\QUICKH~1\ONLNSVC.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\PROGRA~1\CATCOM~1\QUICKH~1\EMLPROXY.EXE
C:\Program Files\Cat Computer\Quick Heal Firewall Pro\qhfw.exe
C:\PROGRA~1\CATCOM~1\QUICKH~1\scanwscs.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Microsoft Windows OneCare Live\Firewall\msfwsvc.exe
C:\Program Files\Microsoft Windows OneCare Live\winss.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe
C:\PROGRA~1\CATCOM~1\QUICKH~1\EMLPROUI.EXE
C:\PROGRA~1\CATCOM~1\QUICKH~1\UPSCHD.EXE
C:\PROGRA~1\CATCOM~1\QUICKH~1\SCANMSG.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\CATCOM~1\QUICKH~1\OnlineNT.EXE
C:\Program Files\Hijackthis\HijackThis.exe
C:\WINDOWS\system32\wuauclt.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.co.uk/ig/dell?hl=en&client=dell-usuk&channel=uk&ibd=6061109
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.google.co.uk/ig/dell?hl=en&…amp;ibd=6061109
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: CBrowserHelperObject Object - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
O2 - BHO: Anti Popup - {EFCA9D4B-F2E8-487d-8505-E4D0E459ABFE} - C:\PROGRA~1\CATCOM~1\QUICKH~1\apop.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [DigidesignMMERefresh] C:\Program Files\Digidesign\Drivers\MMERefresh.exe
O4 - HKLM\..\Run: [SNM] C:\Documents and Settings\You Slag\My Documents\Protection\SNM.exe /startup
O4 - HKLM\..\Run: [OneCareUI] "C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe"
O4 - HKLM\..\Run: [Email Protection] C:\PROGRA~1\CATCOM~1\QUICKH~1\EMLPROUI.EXE
O4 - HKLM\..\Run: [Update Scheduler] C:\PROGRA~1\CATCOM~1\QUICKH~1\UPSCHD.EXE /CHECK
O4 - HKLM\..\Run: [On-Line Protection] C:\PROGRA~1\CATCOM~1\QUICKH~1\CATEYE.EXE
O4 - HKLM\..\Run: [Messenger] C:\PROGRA~1\CATCOM~1\QUICKH~1\SCANMSG.EXE
O4 - HKLM\..\Run: [Startup Scan] C:\PROGRA~1\CATCOM~1\QUICKH~1\Sensor.EXE /LOADRUN
O4 - HKLM\..\Run: [Quick Heal Firewall Pro] "C:\Program Files\Cat Computer\Quick Heal Firewall Pro\qhfw.exe" /waitservice
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\RunOnce: [Startup Scan] C:\PROGRA~1\CATCOM~1\QUICKH~1\Sensor.EXE /check
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS…er.cab31267.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by121fd.bay121.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-GB/a-UNO1/GAME_UNO1.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo…otoUploader.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1175598155031
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab31267.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS…er.cab56986.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/Solit…wn.cab31267.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs: c:\windows\system32\mlljjhi.dll
O20 - Winlogon Notify: MacDrive-iTunes compatibility - C:\Program Files\Common Files\Mediafour\MacDriveiTunesPatch.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Digidesign MME Refresh Service (DigiRefresh) - Digidesign, A Division of Avid Technology, Inc. - C:\Program Files\Digidesign\Drivers\MMERefresh.exe
O23 - Service: digiSPTIService - Digidesign, A Division of Avid Technology, Inc. - C:\Program Files\Digidesign\Pro Tools\digiSPTIService.exe
O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\System32\GEARSec.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton Ghost - Symantec Corporation - C:\Program Files\Norton Ghost\Agent\VProSvc.exe
O23 - Service: NT Online Protection - CAT Computer Services Pvt. Ltd - C:\PROGRA~1\CATCOM~1\QUICKH~1\ONLNSVC.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Quick Heal Total Security Mail Protection - CAT Computer Services Pvt. Ltd. - C:\PROGRA~1\CATCOM~1\QUICKH~1\EMLPROXY.EXE
O23 - Service: Quick Heal Firewall Service (QuickHealFirewall) - Agnitum Ltd. - C:\Program Files\Cat Computer\Quick Heal Firewall Pro\qhfw.exe
O23 - Service: Total Security Helper Service WSC (ScanWscS) - CAT Computer Services Pvt. Ltd - C:\PROGRA~1\CATCOM~1\QUICKH~1\scanwscs.exe
O23 - Service: Quick Heal Total Security Startup Handler (Startup Handler) - Unknown owner - C:\PROGRA~1\CATCOM~1\QUICKH~1\strtsvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

Thanks thanks thanks still

Is there more to do?

Scotty

Post #8July 21, 2007, 6:05 PM UTC

Hi troubleddude Run ComboFix again and post the new log, please.

troubleddude

Post #9July 21, 2007, 6:40 PM UTC

Hi again. I dont think I mentioned before, my homepage has changed. It shows a microsoft address or something before going to msn.com. I'm not sure if this is a bad thing or just a reaction to what we've been doing so far.

Anyhow, here is the combofix log:

"You Slag" - 2007-07-21 19:26:34 - ComboFix 07-07-21.5 - Service Pack 2 NTFS

((((((((((((((((((((((((( Files Created from 2007-06-21 to 2007-07-21 )))))))))))))))))))))))))))))))

2007-07-21 16:35 3,266 –a—— C:\WINDOWS\system32\tmp.reg
2007-07-21 12:04 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-07-19 11:50 d——– C:\Program Files\Spynomore deleted
2007-07-18 22:38 38,272 –a—— C:\WINDOWS\system32\drivers\ONLINENT.SYS
2007-07-18 22:38 19,456 –a—— C:\WINDOWS\system32\drivers\SCREENNT.SYS
2007-07-18 22:37 12,424 –a—— C:\WINDOWS\system32\drivers\EMLTDI.SYS
2007-07-18 22:37 d——– C:\Program Files\Cat Computer
2007-07-17 16:13 d——– C:\Program Files\iTunes
2007-07-17 16:11 d——– C:\Program Files\Apple Software Update
2007-07-17 16:10 d——– C:\Program Files\Common Files\Apple
2007-07-17 16:10 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple
2007-07-10 12:45 81,024 –a—— C:\WINDOWS\system32\drivers\msfwdrv.sys
2007-07-10 12:45 67,784 –a—— C:\WINDOWS\system32\drivers\MpFilter.sys
2007-07-10 12:45 105,856 –a—— C:\WINDOWS\system32\drivers\msfwhlpr.sys
2007-07-10 12:35 d——– C:\Program Files\Microsoft Windows OneCare Live

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-07-17 15:13:35 ——– d—–w C:\Program Files\iPod
2007-07-17 15:12:42 ——– d—–w C:\Program Files\QuickTime
2007-07-06 10:48:25 ——– d—–w C:\DOCUME~1\YOUSLA~1\APPLIC~1\Digidesign
2007-07-05 11:46:51 32 —-a-w C:\WINDOWS\system32\msvcsv60.dll
2007-07-05 11:46:51 32 —-a-w C:\WINDOWS\msocreg32.dat
2007-06-07 13:02:42 5,798 –sha-w C:\WINDOWS\system32\KGyGaAvL.sys
2007-06-07 13:02:39 88 –sh–r C:\WINDOWS\system32\9F45E9CC44.sys
2007-05-16 15:12:02 683,520 —-a-w C:\WINDOWS\system32\inetcomm.dll
2007-04-28 09:57:37 1,152 —-a-w C:\WINDOWS\system32\windrv.sys
2007-04-25 14:21:15 144,896 —-a-w C:\WINDOWS\system32\schannel.dll
2006-11-22 17:49:34 88 –sh–r C:\WINDOWS\system32\BEFCF62DC9.sys

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SigmatelSysTrayApp"="stsystra.exe" [2006-08-15 11:00 C:\WINDOWS\stsystra.exe]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2004-12-13 16:30]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 17:50]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 17:50]
"DigidesignMMERefresh"="C:\Program Files\Digidesign\Drivers\MMERefresh.exe" [2005-10-26 01:21]
"SNM"="C:\Documents and Settings\You Slag\My Documents\Protection\SNM.exe" []
"OneCareUI"="C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe" [2007-06-11 12:40]
"Email Protection"="C:\PROGRA~1\CATCOM~1\QUICKH~1\EMLPROUI.EXE" [2007-07-18 22:37]
"Update Scheduler"="C:\PROGRA~1\CATCOM~1\QUICKH~1\UPSCHD.exe" [2007-07-18 22:37]
"On-Line Protection"="C:\PROGRA~1\CATCOM~1\QUICKH~1\CATEYE.EXE" [2007-07-18 22:37]
"Messenger"="C:\PROGRA~1\CATCOM~1\QUICKH~1\SCANMSG.EXE" [2007-07-18 22:37]
"Startup Scan"="C:\PROGRA~1\CATCOM~1\QUICKH~1\Sensor.exe" [2007-07-18 22:37]
"Quick Heal Firewall Pro"="C:\Program Files\Cat Computer\Quick Heal Firewall Pro\qhfw.exe" [2007-04-06 13:12]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 06:00]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonce]
"Startup Scan"=C:\PROGRA~1\CATCOM~1\QUICKH~1\Sensor.EXE /check

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [2006-10-04 21:22:36]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\MacDrive-iTunes compatibility]
C:\Program Files\Common Files\Mediafour\MacDriveiTunesPatch.dll 2003-11-07 11:24 61440 C:\Program Files\Common Files\Mediafour\MacDriveiTunesPatch.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=c:\windows\system32\mlljjhi.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\OneCareMP]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^AOL 9.0 Tray Icon.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\AOL 9.0 Tray Icon.lnk
backup=C:\WINDOWS\pss\AOL 9.0 Tray Icon.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Dell Network Assistant.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Dell Network Assistant.lnk
backup=C:\WINDOWS\pss\Dell Network Assistant.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Ralink Wireless Utility.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Ralink Wireless Utility.lnk
backup=C:\WINDOWS\pss\Ralink Wireless Utility.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOLDialer]
C:\Program Files\Common Files\AOL\ACS\AOLDial.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Corel Photo Downloader]
C:\Program Files\Corel\Corel Snapfire Plus\Corel Photo Downloader.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DMXLauncher]
C:\Program Files\Dell\Media Experience\DMXLauncher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
"C:\Program Files\iTunes\iTunesHelper.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCAgentExe]
c:\PROGRA~1\mcafee.com\agent\McAgent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCUpdateExe]
C:\PROGRA~1\mcafee.com\agent\McUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MDDiskProtect.exe]
C:\Program Files\Mediafour\MacDrive\MDDiskProtect.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Mediafour Mac Volume Notifications]
"C:\Program Files\Common Files\Mediafour\MACVNTFY.EXE" /auto

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MediafourGettingStartedWithMacDrive6]
"C:\Program Files\Mediafour\MacDrive\MacDrive.exe" /runonce

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MPFExe]
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSKAGENTEXE]
C:\PROGRA~1\mcafee\SPAMKI~1\mskagent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSKDetectorExe]
C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
"C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Norton Ghost 10.0]
"C:\Program Files\Norton Ghost\Agent\GhostTray.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OASClnt]
C:\Program Files\McAfee.com\VSO\oasclnt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\QTTask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray]
C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
"C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VirusScan Online]
C:\Program Files\McAfee.com\VSO\mcvsshld.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VSOCheckTask]
"C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet

adblock.dll - \??\C:\Program Files\Cat Computer\Quick Heal Firewall Pro\kernel\ADBLOCK.DLL - Quick Heal PlugIn (ADBLOCK.DLL)
agpcpq - \SystemRoot\system32\DRIVERS\agpCPQ.sys - Compaq AGP Bus Filter
amdk8 - system32\DRIVERS\AmdK8.sys - AMD Processor Driver
arp.dll - \??\C:\Program Files\Cat Computer\Quick Heal Firewall Pro\kernel\ARP.DLL - Quick Heal PlugIn (ARP.DLL)
bcm4sbxp - system32\DRIVERS\bcm4sbxp.sys - Broadcom 440x 10/100 Integrated Controller XP Driver
content.dll - \??\C:\Program Files\Cat Computer\Quick Heal Firewall Pro\kernel\CONTENT.DLL - Quick Heal PlugIn (CONTENT.DLL)
dalwdmservice - system32\drivers\dalwdm.sys - dal service
digifilter - system32\drivers\DigiFilt.sys - DigiFilter
dlaboiom - System32\DLA\DLABOIOM.SYS
dlacdbhm - System32\Drivers\DLACDBHM.SYS
dladresn - System32\DLA\DLADResN.SYS
dlaifs_m - System32\DLA\DLAIFS_M.SYS
dlaopiom - System32\DLA\DLAOPIOM.SYS
dlapoolm - System32\DLA\DLAPoolM.SYS
dlartl_n - System32\Drivers\DLARTL_N.SYS
dlaudfam - System32\DLA\DLAUDFAM.SYS
dlaudf_m - System32\DLA\DLAUDF_M.SYS
dnscache.dll - \??\C:\Program Files\Cat Computer\Quick Heal Firewall Pro\kernel\DNSCACHE.DLL - Quick Heal PlugIn (DNSCACHE.DLL)
drvmcdb - System32\Drivers\DRVMCDB.SYS
drvnddm - System32\Drivers\DRVNDDM.SYS
dsproct - \??\C:\Program Files\Dell Support\GTAction\triggers\DSproct.sys - DSproct
e100b - system32\DRIVERS\e100b325.sys - Intel® PRO Adapter Driver
emlss - system32\drivers\emltdi.sys - EMLSS
fax - %systemroot%\system32\fxssvc.exe - Fax
ftpfilt.dll - \??\C:\Program Files\Cat Computer\Quick Heal Firewall Pro\kernel\FTPFILT.DLL - Quick Heal PlugIn (FTPFILT.DLL)
htmlfilt.dll - \??\C:\Program Files\Cat Computer\Quick Heal Firewall Pro\kernel\HTMLFILT.DLL - Quick Heal PlugIn (HTMLFILT.DLL)
httpfilt.dll - \??\C:\Program Files\Cat Computer\Quick Heal Firewall Pro\kernel\HTTPFILT.DLL - Quick Heal PlugIn (HTTPFILT.DLL)
imapfilt.dll - \??\C:\Program Files\Cat Computer\Quick Heal Firewall Pro\kernel\IMAPFILT.DLL - Quick Heal PlugIn (IMAPFILT.DLL)
mailfilt.dll - \??\C:\Program Files\Cat Computer\Quick Heal Firewall Pro\kernel\MAILFILT.DLL - Quick Heal PlugIn (MAILFILT.DLL)
mbx2dfu - SYSTEM32\DRIVERS\MBX2DFU.sys
mbx2midk - system32\drivers\mbx2midk.sys - Digidesign Mbox 2 Midi Driver
mpfilter - system32\DRIVERS\MpFilter.sys - Microsoft Malware Protection Driver
msfwdrv - system32\DRIVERS\msfwdrv.sys - MSFWDrv
msfwhlpr - system32\DRIVERS\msfwhlpr.sys - MSFWHLPR
msfwsvc - OneCare Firewall - "C:\Program Files\Microsoft Windows OneCare Live\Firewall\msfwsvc.exe"
nntpfilt.dll - \??\C:\Program Files\Cat Computer\Quick Heal Firewall Pro\kernel\NNTPFILT.DLL - Quick Heal PlugIn (NNTPFILT.DLL)
onecaremp - "C:\Program Files\Microsoft Windows OneCare Live\Antivirus\MsMpEng.exe" - OneCare AntiSpyware and AntiVirus
onlinent - \??\C:\PROGRA~1\CATCOM~1\QUICKH~1\ONLINENT.SYS - OnlineNT
philcam8116 - system32\DRIVERS\CamDrO21.sys - Logitech QuickCam Pro 3000 (08B0)
pop3filt.dll - \??\C:\Program Files\Cat Computer\Quick Heal Firewall Pro\kernel\POP3FILT.DLL - Quick Heal PlugIn (POP3FILT.DLL)
protect.dll - \??\C:\Program Files\Cat Computer\Quick Heal Firewall Pro\kernel\PROTECT.DLL - Quick Heal PlugIn (PROTECT.DLL)
quick heal total security mail protection - C:\PROGRA~1\CATCOM~1\QUICKH~1\EMLPROXY.EXE - Quick Heal Total Security Mail Protection
qv2kux - system32\DRIVERS\qv2kux.sys - Casio Digital Camera
rt73 - system32\DRIVERS\rt73.sys - RT73 USB Wireless LAN Card Driver
screennt - system32\drivers\ScreenNT.sys - ScreenNT
secret.dll - \??\C:\Program Files\Cat Computer\Quick Heal Firewall Pro\kernel\SECRET.DLL - Quick Heal PlugIn (SECRET.DLL)
ss_bus - system32\DRIVERS\ss_bus.sys - Samsung Mobile USB Device 1.0 driver (WDM)
ss_mdfl - system32\DRIVERS\ss_mdfl.sys - SAMSUNG Mobile USB Modem 1.0 Filter
ss_mdm - system32\DRIVERS\ss_mdm.sys - SAMSUNG Mobile USB Modem 1.0 Drivers
startup handler - C:\PROGRA~1\CATCOM~1\QUICKH~1\strtsvc.exe - Quick Heal Total Security Startup Handler
sthda - system32\drivers\sthda.sys - SigmaTel High Definition Audio CODEC
vfilt - \??\C:\Program Files\Cat Computer\Quick Heal Firewall Pro\kernel\FILTNT.SYS - Quick Heal Kernel Driver
wanatw - system32\DRIVERS\wanatw4.sys - WAN Miniport (ATW)

Contents of the 'Scheduled Tasks' folder
2007-07-17 15:11:21 C:\WINDOWS\tasks\AppleSoftwareUpdate.job

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-21 19:29:09
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden registry entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-07-21 19:29:56
C:\ComboFix-quarantined-files.txt … 2007-07-21 19:29
C:\ComboFix2.txt … 2007-07-21 12:20

— E O F —

And here is a fresh Hijackthis log (although I'm not sure if you wanted one)

Logfile of HijackThis v1.99.1
Scan saved at 7:30:30 PM, on 7/21/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Microsoft Windows OneCare Live\Antivirus\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Digidesign\Drivers\MMERefresh.exe
C:\WINDOWS\System32\GEARSec.exe
C:\PROGRA~1\CATCOM~1\QUICKH~1\ONLNSVC.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\PROGRA~1\CATCOM~1\QUICKH~1\EMLPROXY.EXE
C:\Program Files\Cat Computer\Quick Heal Firewall Pro\qhfw.exe
C:\PROGRA~1\CATCOM~1\QUICKH~1\scanwscs.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Microsoft Windows OneCare Live\Firewall\msfwsvc.exe
C:\Program Files\Microsoft Windows OneCare Live\winss.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe
C:\PROGRA~1\CATCOM~1\QUICKH~1\EMLPROUI.EXE
C:\PROGRA~1\CATCOM~1\QUICKH~1\UPSCHD.EXE
C:\PROGRA~1\CATCOM~1\QUICKH~1\SCANMSG.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.co.uk/ig/dell?hl=en&client=dell-usuk&channel=uk&ibd=6061109
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.google.co.uk/ig/dell?hl=en&…amp;ibd=6061109
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: CBrowserHelperObject Object - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
O2 - BHO: Anti Popup - {EFCA9D4B-F2E8-487d-8505-E4D0E459ABFE} - C:\PROGRA~1\CATCOM~1\QUICKH~1\apop.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [DigidesignMMERefresh] C:\Program Files\Digidesign\Drivers\MMERefresh.exe
O4 - HKLM\..\Run: [SNM] C:\Documents and Settings\You Slag\My Documents\Protection\SNM.exe /startup
O4 - HKLM\..\Run: [OneCareUI] "C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe"
O4 - HKLM\..\Run: [Email Protection] C:\PROGRA~1\CATCOM~1\QUICKH~1\EMLPROUI.EXE
O4 - HKLM\..\Run: [Update Scheduler] C:\PROGRA~1\CATCOM~1\QUICKH~1\UPSCHD.EXE /CHECK
O4 - HKLM\..\Run: [On-Line Protection] C:\PROGRA~1\CATCOM~1\QUICKH~1\CATEYE.EXE
O4 - HKLM\..\Run: [Messenger] C:\PROGRA~1\CATCOM~1\QUICKH~1\SCANMSG.EXE
O4 - HKLM\..\Run: [Startup Scan] C:\PROGRA~1\CATCOM~1\QUICKH~1\Sensor.EXE /LOADRUN
O4 - HKLM\..\Run: [Quick Heal Firewall Pro] "C:\Program Files\Cat Computer\Quick Heal Firewall Pro\qhfw.exe" /waitservice
O4 - HKLM\..\RunOnce: [Startup Scan] C:\PROGRA~1\CATCOM~1\QUICKH~1\Sensor.EXE /check
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS…er.cab31267.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by121fd.bay121.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-GB/a-UNO1/GAME_UNO1.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo…otoUploader.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1175598155031
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab31267.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS…er.cab56986.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/Solit…wn.cab31267.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs: c:\windows\system32\mlljjhi.dll
O20 - Winlogon Notify: MacDrive-iTunes compatibility - C:\Program Files\Common Files\Mediafour\MacDriveiTunesPatch.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Digidesign MME Refresh Service (DigiRefresh) - Digidesign, A Division of Avid Technology, Inc. - C:\Program Files\Digidesign\Drivers\MMERefresh.exe
O23 - Service: digiSPTIService - Digidesign, A Division of Avid Technology, Inc. - C:\Program Files\Digidesign\Pro Tools\digiSPTIService.exe
O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\System32\GEARSec.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton Ghost - Symantec Corporation - C:\Program Files\Norton Ghost\Agent\VProSvc.exe
O23 - Service: NT Online Protection - CAT Computer Services Pvt. Ltd - C:\PROGRA~1\CATCOM~1\QUICKH~1\ONLNSVC.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Quick Heal Total Security Mail Protection - CAT Computer Services Pvt. Ltd. - C:\PROGRA~1\CATCOM~1\QUICKH~1\EMLPROXY.EXE
O23 - Service: Quick Heal Firewall Service (QuickHealFirewall) - Agnitum Ltd. - C:\Program Files\Cat Computer\Quick Heal Firewall Pro\qhfw.exe
O23 - Service: Total Security Helper Service WSC (ScanWscS) - CAT Computer Services Pvt. Ltd - C:\PROGRA~1\CATCOM~1\QUICKH~1\scanwscs.exe
O23 - Service: Quick Heal Total Security Startup Handler (Startup Handler) - Unknown owner - C:\PROGRA~1\CATCOM~1\QUICKH~1\strtsvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

How's it looking?

Scotty

Post #10July 21, 2007, 7:15 PM UTC

Hi troubleddude

Remember to disable Quickclean first again.

Open Notepad and Copy/Paste the text in the codebox below into it:

File::
c:\windows\system32\mlljjhi.dll

Folder::
C:\Program Files\Spynomore
C:\Documents and Settings\You Slag\My Documents\Protection

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SNM"=-
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=""

Save this as "CFScript"

[external image: Posted Image]

Refering to the picture above, drag CFScript into ComboFix.exe
Then post the resultant log with a new HijackThis log.

troubleddude

Post #11July 21, 2007, 8:19 PM UTC

Ok Scotty, here is the combofix log:

"You Slag" - 2007-07-21 21:11:45 - ComboFix 07-07-21.5 - Service Pack 2 NTFS
Command switches used :: C:\Documents and Settings\You Slag\Desktop\HJT\CFScript.txt

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

C:\Documents and Settings\You Slag\My Documents\Protection
C:\Documents and Settings\You Slag\My Documents\Protection\kerio.exe
C:\Documents and Settings\You Slag\My Documents\Protection\RegAllowedKeys.cfg
C:\Documents and Settings\You Slag\My Documents\Protection\RegBlockedKeys.cfg
C:\Documents and Settings\You Slag\My Documents\Protection\SetupOneCare.exe
C:\Documents and Settings\You Slag\My Documents\Protection\taskmanager17.exe
C:\Documents and Settings\You Slag\My Documents\Protection\tsnteval.exe
C:\Documents and Settings\You Slag\My Documents\Protection\zaAvSetup_70_302_000_en.exe
C:\Documents and Settings\You Slag\My Documents\Protection\zaAvSetup_70_337_000_en.exe
C:\Documents and Settings\You Slag\My Documents\Protection\zaSuiteSetup_70_302_000_en.exe

((((((((((((((((((((((((( Files Created from 2007-06-21 to 2007-07-21 )))))))))))))))))))))))))))))))

2007-07-21 16:35 3,266 –a—— C:\WINDOWS\system32\tmp.reg
2007-07-21 12:04 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-07-19 11:50 d——– C:\Program Files\Spynomore deleted
2007-07-18 22:38 38,272 –a—— C:\WINDOWS\system32\drivers\ONLINENT.SYS
2007-07-18 22:38 19,456 –a—— C:\WINDOWS\system32\drivers\SCREENNT.SYS
2007-07-18 22:37 12,424 –a—— C:\WINDOWS\system32\drivers\EMLTDI.SYS
2007-07-18 22:37 d——– C:\Program Files\Cat Computer
2007-07-17 16:13 d——– C:\Program Files\iTunes
2007-07-17 16:11 d——– C:\Program Files\Apple Software Update
2007-07-17 16:10 d——– C:\Program Files\Common Files\Apple
2007-07-17 16:10 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple
2007-07-10 12:45 81,024 –a—— C:\WINDOWS\system32\drivers\msfwdrv.sys
2007-07-10 12:45 67,784 –a—— C:\WINDOWS\system32\drivers\MpFilter.sys
2007-07-10 12:45 105,856 –a—— C:\WINDOWS\system32\drivers\msfwhlpr.sys
2007-07-10 12:35 d——– C:\Program Files\Microsoft Windows OneCare Live

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-07-17 15:13:35 ——– d—–w C:\Program Files\iPod
2007-07-17 15:12:42 ——– d—–w C:\Program Files\QuickTime
2007-07-06 10:48:25 ——– d—–w C:\DOCUME~1\YOUSLA~1\APPLIC~1\Digidesign
2007-07-05 11:46:51 32 —-a-w C:\WINDOWS\system32\msvcsv60.dll
2007-07-05 11:46:51 32 —-a-w C:\WINDOWS\msocreg32.dat
2007-06-07 13:02:42 5,798 –sha-w C:\WINDOWS\system32\KGyGaAvL.sys
2007-06-07 13:02:39 88 –sh–r C:\WINDOWS\system32\9F45E9CC44.sys
2007-05-16 15:12:02 683,520 —-a-w C:\WINDOWS\system32\inetcomm.dll
2007-04-28 09:57:37 1,152 —-a-w C:\WINDOWS\system32\windrv.sys
2007-04-25 14:21:15 144,896 —-a-w C:\WINDOWS\system32\schannel.dll
2006-11-22 17:49:34 88 –sh–r C:\WINDOWS\system32\BEFCF62DC9.sys

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SigmatelSysTrayApp"="stsystra.exe" [2006-08-15 11:00 C:\WINDOWS\stsystra.exe]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2004-12-13 16:30]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 17:50]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 17:50]
"DigidesignMMERefresh"="C:\Program Files\Digidesign\Drivers\MMERefresh.exe" [2005-10-26 01:21]
"OneCareUI"="C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe" [2007-06-11 12:40]
"Email Protection"="C:\PROGRA~1\CATCOM~1\QUICKH~1\EMLPROUI.EXE" [2007-07-18 22:37]
"Update Scheduler"="C:\PROGRA~1\CATCOM~1\QUICKH~1\UPSCHD.exe" [2007-07-18 22:37]
"On-Line Protection"="C:\PROGRA~1\CATCOM~1\QUICKH~1\CATEYE.EXE" [2007-07-18 22:37]
"Messenger"="C:\PROGRA~1\CATCOM~1\QUICKH~1\SCANMSG.EXE" [2007-07-18 22:37]
"Startup Scan"="C:\PROGRA~1\CATCOM~1\QUICKH~1\Sensor.exe" [2007-07-18 22:37]
"Quick Heal Firewall Pro"="C:\Program Files\Cat Computer\Quick Heal Firewall Pro\qhfw.exe" [2007-04-06 13:12]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 06:00]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonce]
"Startup Scan"=C:\PROGRA~1\CATCOM~1\QUICKH~1\Sensor.EXE /check

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [2006-10-04 21:22:36]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\MacDrive-iTunes compatibility]
C:\Program Files\Common Files\Mediafour\MacDriveiTunesPatch.dll 2003-11-07 11:24 61440 C:\Program Files\Common Files\Mediafour\MacDriveiTunesPatch.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\OneCareMP]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^AOL 9.0 Tray Icon.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\AOL 9.0 Tray Icon.lnk
backup=C:\WINDOWS\pss\AOL 9.0 Tray Icon.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Dell Network Assistant.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Dell Network Assistant.lnk
backup=C:\WINDOWS\pss\Dell Network Assistant.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Ralink Wireless Utility.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Ralink Wireless Utility.lnk
backup=C:\WINDOWS\pss\Ralink Wireless Utility.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOLDialer]
C:\Program Files\Common Files\AOL\ACS\AOLDial.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Corel Photo Downloader]
C:\Program Files\Corel\Corel Snapfire Plus\Corel Photo Downloader.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DMXLauncher]
C:\Program Files\Dell\Media Experience\DMXLauncher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
"C:\Program Files\iTunes\iTunesHelper.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCAgentExe]
c:\PROGRA~1\mcafee.com\agent\McAgent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCUpdateExe]
C:\PROGRA~1\mcafee.com\agent\McUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MDDiskProtect.exe]
C:\Program Files\Mediafour\MacDrive\MDDiskProtect.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Mediafour Mac Volume Notifications]
"C:\Program Files\Common Files\Mediafour\MACVNTFY.EXE" /auto

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MediafourGettingStartedWithMacDrive6]
"C:\Program Files\Mediafour\MacDrive\MacDrive.exe" /runonce

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MPFExe]
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSKAGENTEXE]
C:\PROGRA~1\mcafee\SPAMKI~1\mskagent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSKDetectorExe]
C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
"C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Norton Ghost 10.0]
"C:\Program Files\Norton Ghost\Agent\GhostTray.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OASClnt]
C:\Program Files\McAfee.com\VSO\oasclnt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\QTTask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray]
C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
"C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VirusScan Online]
C:\Program Files\McAfee.com\VSO\mcvsshld.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VSOCheckTask]
"C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet

adblock.dll - \??\C:\Program Files\Cat Computer\Quick Heal Firewall Pro\kernel\ADBLOCK.DLL - Quick Heal PlugIn (ADBLOCK.DLL)
agpcpq - \SystemRoot\system32\DRIVERS\agpCPQ.sys - Compaq AGP Bus Filter
amdk8 - system32\DRIVERS\AmdK8.sys - AMD Processor Driver
arp.dll - \??\C:\Program Files\Cat Computer\Quick Heal Firewall Pro\kernel\ARP.DLL - Quick Heal PlugIn (ARP.DLL)
bcm4sbxp - system32\DRIVERS\bcm4sbxp.sys - Broadcom 440x 10/100 Integrated Controller XP Driver
content.dll - \??\C:\Program Files\Cat Computer\Quick Heal Firewall Pro\kernel\CONTENT.DLL - Quick Heal PlugIn (CONTENT.DLL)
dalwdmservice - system32\drivers\dalwdm.sys - dal service
digifilter - system32\drivers\DigiFilt.sys - DigiFilter
dlaboiom - System32\DLA\DLABOIOM.SYS
dlacdbhm - System32\Drivers\DLACDBHM.SYS
dladresn - System32\DLA\DLADResN.SYS
dlaifs_m - System32\DLA\DLAIFS_M.SYS
dlaopiom - System32\DLA\DLAOPIOM.SYS
dlapoolm - System32\DLA\DLAPoolM.SYS
dlartl_n - System32\Drivers\DLARTL_N.SYS
dlaudfam - System32\DLA\DLAUDFAM.SYS
dlaudf_m - System32\DLA\DLAUDF_M.SYS
dnscache.dll - \??\C:\Program Files\Cat Computer\Quick Heal Firewall Pro\kernel\DNSCACHE.DLL - Quick Heal PlugIn (DNSCACHE.DLL)
drvmcdb - System32\Drivers\DRVMCDB.SYS
drvnddm - System32\Drivers\DRVNDDM.SYS
dsproct - \??\C:\Program Files\Dell Support\GTAction\triggers\DSproct.sys - DSproct
e100b - system32\DRIVERS\e100b325.sys - Intel® PRO Adapter Driver
emlss - system32\drivers\emltdi.sys - EMLSS
fax - %systemroot%\system32\fxssvc.exe - Fax
ftpfilt.dll - \??\C:\Program Files\Cat Computer\Quick Heal Firewall Pro\kernel\FTPFILT.DLL - Quick Heal PlugIn (FTPFILT.DLL)
htmlfilt.dll - \??\C:\Program Files\Cat Computer\Quick Heal Firewall Pro\kernel\HTMLFILT.DLL - Quick Heal PlugIn (HTMLFILT.DLL)
httpfilt.dll - \??\C:\Program Files\Cat Computer\Quick Heal Firewall Pro\kernel\HTTPFILT.DLL - Quick Heal PlugIn (HTTPFILT.DLL)
imapfilt.dll - \??\C:\Program Files\Cat Computer\Quick Heal Firewall Pro\kernel\IMAPFILT.DLL - Quick Heal PlugIn (IMAPFILT.DLL)
mailfilt.dll - \??\C:\Program Files\Cat Computer\Quick Heal Firewall Pro\kernel\MAILFILT.DLL - Quick Heal PlugIn (MAILFILT.DLL)
mbx2dfu - SYSTEM32\DRIVERS\MBX2DFU.sys
mbx2midk - system32\drivers\mbx2midk.sys - Digidesign Mbox 2 Midi Driver
mpfilter - system32\DRIVERS\MpFilter.sys - Microsoft Malware Protection Driver
msfwdrv - system32\DRIVERS\msfwdrv.sys - MSFWDrv
msfwhlpr - system32\DRIVERS\msfwhlpr.sys - MSFWHLPR
msfwsvc - OneCare Firewall - "C:\Program Files\Microsoft Windows OneCare Live\Firewall\msfwsvc.exe"
nntpfilt.dll - \??\C:\Program Files\Cat Computer\Quick Heal Firewall Pro\kernel\NNTPFILT.DLL - Quick Heal PlugIn (NNTPFILT.DLL)
onecaremp - "C:\Program Files\Microsoft Windows OneCare Live\Antivirus\MsMpEng.exe" - OneCare AntiSpyware and AntiVirus
onlinent - \??\C:\PROGRA~1\CATCOM~1\QUICKH~1\ONLINENT.SYS - OnlineNT
philcam8116 - system32\DRIVERS\CamDrO21.sys - Logitech QuickCam Pro 3000 (08B0)
pop3filt.dll - \??\C:\Program Files\Cat Computer\Quick Heal Firewall Pro\kernel\POP3FILT.DLL - Quick Heal PlugIn (POP3FILT.DLL)
protect.dll - \??\C:\Program Files\Cat Computer\Quick Heal Firewall Pro\kernel\PROTECT.DLL - Quick Heal PlugIn (PROTECT.DLL)
quick heal total security mail protection - C:\PROGRA~1\CATCOM~1\QUICKH~1\EMLPROXY.EXE - Quick Heal Total Security Mail Protection
qv2kux - system32\DRIVERS\qv2kux.sys - Casio Digital Camera
rt73 - system32\DRIVERS\rt73.sys - RT73 USB Wireless LAN Card Driver
screennt - system32\drivers\ScreenNT.sys - ScreenNT
secret.dll - \??\C:\Program Files\Cat Computer\Quick Heal Firewall Pro\kernel\SECRET.DLL - Quick Heal PlugIn (SECRET.DLL)
ss_bus - system32\DRIVERS\ss_bus.sys - Samsung Mobile USB Device 1.0 driver (WDM)
ss_mdfl - system32\DRIVERS\ss_mdfl.sys - SAMSUNG Mobile USB Modem 1.0 Filter
ss_mdm - system32\DRIVERS\ss_mdm.sys - SAMSUNG Mobile USB Modem 1.0 Drivers
startup handler - C:\PROGRA~1\CATCOM~1\QUICKH~1\strtsvc.exe - Quick Heal Total Security Startup Handler
sthda - system32\drivers\sthda.sys - SigmaTel High Definition Audio CODEC
vfilt - \??\C:\Program Files\Cat Computer\Quick Heal Firewall Pro\kernel\FILTNT.SYS - Quick Heal Kernel Driver
wanatw - system32\DRIVERS\wanatw4.sys - WAN Miniport (ATW)

Contents of the 'Scheduled Tasks' folder
2007-07-17 15:11:21 C:\WINDOWS\tasks\AppleSoftwareUpdate.job

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-21 21:14:07
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden registry entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-07-21 21:14:49
C:\ComboFix-quarantined-files.txt … 2007-07-21 21:14
C:\ComboFix2.txt … 2007-07-21 19:29
C:\ComboFix3.txt … 2007-07-21 12:20

— E O F —

And here is the new hijackthis log:

Logfile of HijackThis v1.99.1
Scan saved at 9:15:19 PM, on 7/21/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Microsoft Windows OneCare Live\Antivirus\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Digidesign\Drivers\MMERefresh.exe
C:\WINDOWS\System32\GEARSec.exe
C:\PROGRA~1\CATCOM~1\QUICKH~1\ONLNSVC.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\PROGRA~1\CATCOM~1\QUICKH~1\EMLPROXY.EXE
C:\Program Files\Cat Computer\Quick Heal Firewall Pro\qhfw.exe
C:\PROGRA~1\CATCOM~1\QUICKH~1\scanwscs.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Microsoft Windows OneCare Live\Firewall\msfwsvc.exe
C:\Program Files\Microsoft Windows OneCare Live\winss.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe
C:\PROGRA~1\CATCOM~1\QUICKH~1\EMLPROUI.EXE
C:\PROGRA~1\CATCOM~1\QUICKH~1\UPSCHD.EXE
C:\PROGRA~1\CATCOM~1\QUICKH~1\SCANMSG.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\CATCOM~1\QUICKH~1\OnlineNT.EXE
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.co.uk/ig/dell?hl=en&client=dell-usuk&channel=uk&ibd=6061109
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.google.co.uk/ig/dell?hl=en&…amp;ibd=6061109
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: CBrowserHelperObject Object - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
O2 - BHO: Anti Popup - {EFCA9D4B-F2E8-487d-8505-E4D0E459ABFE} - C:\PROGRA~1\CATCOM~1\QUICKH~1\apop.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [DigidesignMMERefresh] C:\Program Files\Digidesign\Drivers\MMERefresh.exe
O4 - HKLM\..\Run: [OneCareUI] "C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe"
O4 - HKLM\..\Run: [Email Protection] C:\PROGRA~1\CATCOM~1\QUICKH~1\EMLPROUI.EXE
O4 - HKLM\..\Run: [Update Scheduler] C:\PROGRA~1\CATCOM~1\QUICKH~1\UPSCHD.EXE /CHECK
O4 - HKLM\..\Run: [On-Line Protection] C:\PROGRA~1\CATCOM~1\QUICKH~1\CATEYE.EXE
O4 - HKLM\..\Run: [Messenger] C:\PROGRA~1\CATCOM~1\QUICKH~1\SCANMSG.EXE
O4 - HKLM\..\Run: [Startup Scan] C:\PROGRA~1\CATCOM~1\QUICKH~1\Sensor.EXE /LOADRUN
O4 - HKLM\..\Run: [Quick Heal Firewall Pro] "C:\Program Files\Cat Computer\Quick Heal Firewall Pro\qhfw.exe" /waitservice
O4 - HKLM\..\RunOnce: [Startup Scan] C:\PROGRA~1\CATCOM~1\QUICKH~1\Sensor.EXE /check
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS…er.cab31267.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by121fd.bay121.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-GB/a-UNO1/GAME_UNO1.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo…otoUploader.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1175598155031
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab31267.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS…er.cab56986.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/Solit…wn.cab31267.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: MacDrive-iTunes compatibility - C:\Program Files\Common Files\Mediafour\MacDriveiTunesPatch.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Digidesign MME Refresh Service (DigiRefresh) - Digidesign, A Division of Avid Technology, Inc. - C:\Program Files\Digidesign\Drivers\MMERefresh.exe
O23 - Service: digiSPTIService - Digidesign, A Division of Avid Technology, Inc. - C:\Program Files\Digidesign\Pro Tools\digiSPTIService.exe
O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\System32\GEARSec.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton Ghost - Symantec Corporation - C:\Program Files\Norton Ghost\Agent\VProSvc.exe
O23 - Service: NT Online Protection - CAT Computer Services Pvt. Ltd - C:\PROGRA~1\CATCOM~1\QUICKH~1\ONLNSVC.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Quick Heal Total Security Mail Protection - CAT Computer Services Pvt. Ltd. - C:\PROGRA~1\CATCOM~1\QUICKH~1\EMLPROXY.EXE
O23 - Service: Quick Heal Firewall Service (QuickHealFirewall) - Agnitum Ltd. - C:\Program Files\Cat Computer\Quick Heal Firewall Pro\qhfw.exe
O23 - Service: Total Security Helper Service WSC (ScanWscS) - CAT Computer Services Pvt. Ltd - C:\PROGRA~1\CATCOM~1\QUICKH~1\scanwscs.exe
O23 - Service: Quick Heal Total Security Startup Handler (Startup Handler) - Unknown owner - C:\PROGRA~1\CATCOM~1\QUICKH~1\strtsvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

troubleddude

Post #12July 21, 2007, 10:17 PM UTC

Is there more to do Scotty? I see you are from Scotland?

Scotty

Post #13July 22, 2007, 9:39 AM UTC

Hi troubleddude

Aye, Im from Scotland. And it's pouring with rain again.

I would advise updating Adobe Reader, as the latest version clears up any vulnerabilities of previous versions.
First uninstall the version you have on your computer then download and install Adobe Reader 8.1.

Delete the older versions of Java and download the newest.
Please follow these steps to remove older version Java components.

Close any programmes you may have running, ESPECIALLY your web browser
Click Start > Control Panel.
Click Add/Remove Programs.
Check any item with Java Runtime Environment (JRE or J2SE) in the name.
Click the Remove or Change/Remove button.
Repeat as many times as necessary to remove all versions of Java.
Reboot your computer once all Java components are removed.

Then download the latest version of Java Runtime Environment (JRE) (4th one down the list), which is JRE6u2, and click Yes at the page warning, then accept the Licence Agreement before downloading the Offline file.

This is my usual speech for when you are clean, which you appear to be.

Please follow these simple steps in order to keep your computer clean and secure:

Disable and Enable System Restore. - If you are using Windows ME or XP then you should disable
and reenable system restore to make sure there are no infected files found in a restore point.

You can find instructions on how to enable and reenable system restore here:

Managing Windows Millenium System Restore

or

Windows XP System Restore Guide

Re-enable system restore with instructions from tutorial above
Make your Internet Explorer more secure - This can be done by following these simple instructions:
- From within Internet Explorer click on the Tools menu and then click on Options.
- Click once on the Security tab
- Click once on the Internet icon so it becomes highlighted.
- Click once on the Custom Level button.
  - Change the Download signed ActiveX controls to Prompt
  - Change the Download unsigned ActiveX controls to Disable
  - Change the Initialize and script ActiveX controls not marked as safe to Disable
  - Change the Installation of desktop items to Prompt
  - Change the Launching programs and files in an IFRAME to Prompt
  - Change the Navigate sub-frames across different domains to Prompt
  - When all these settings have been made, click on the OK button.
  - If it prompts you as to whether or not you want to save the settings, press the Yes button.
- Next press the Apply button and then the OK to exit the Internet Properties page.
Use an AntiVirus Software - It is very important that your computer has an anti-virus software running on your machine.
This alone can save you a lot of trouble with malware in the future.

See this link for a listing of some online & their stand-alone antivirus programs:

Virus, Spyware, and Malware Protection and Removal Resources
Update your AntiVirus Software - It is imperative that you update your Antivirus software at least once a week
(Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.
Use a Firewall - I can not stress how important it is that you use a Firewall on your computer.
Without a firewall your computer is succeptible to being hacked and taken over.
I am very serious about this and see it happen almost every day with my clients.
Simply using a Firewall in its default configuration can lower your risk greatly.

For a tutorial on Firewalls and a listing of some available ones see the link below:

Understanding and Using Firewalls
Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly.
This will ensure your computer has always the latest security updates available installed on your computer.
If there are new updates to install, install them immediately, reboot your computer, and revisit the site
until there are no more critical updates.
Install Spybot - Search and Destroy - Install and download Spybot - Search and Destroy with its TeaTimer option.
This will provide realtime spyware & hijacker protection on your computer alongside your virus protection.
You should also scan your computer with this program on a regular basis just as you would an antivirus software.

A tutorial on installing & using this product can be found here:

Using Spybot - Search & Destroy to remove Spyware , Malware, and Hijackers
Install SpywareBlaster - SpywareBlaster will add a large list of programs and sites into your Internet Explorer
settings that will protect you from running and downloading known malicious programs.

A tutorial on installing & using this product can be found here:

Using SpywareBlaster to protect your computer from Spyware and Malware
IE-SPYAD puts over 5000 sites in your restricted zone so you'll be protected when you visit innocent-looking sites that aren't actually innocent at all.

Using IE-SPYAD to help block unwanted sites and activities
Update all these programs regularly - Make sure you update all the programs I have listed regularly.
Without regular updates you WILL NOT be protected when new malicious programs are released.

Follow this list and your potential for being infected again will reduce dramatically.

Glad I was able to help.

troubleddude

Post #14July 22, 2007, 1:40 PM UTC

awesome! thankyou so much Scotty. You have saved my computer

On the lines of spyware, I have Spynomore - is this adequet for real time anit spyware and similar activities? Pouring with rain? It's been like that the last couple of days down south! Floods and the like. This is a great site, what compells someone like you to help people like this?

Scotty

Post #15July 22, 2007, 2:41 PM UTC

Hi troubleddude Ive never used Quickheal or Spynomore but as long as you keep them updated they should give you adequete protection. Always remember, you'll never be 100% protected, though. Why do we do this? Different reasons. Some because they have suffered, some because they want the knowledge to help at other forums, and the few like me, who stumbled upon a forum one day, saw it had a classroom, so joined up out of curiosity.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved]Qwerty12.exe And Others. I Have 2 Computers, Only 1 Infected

✨ Ask AI

Ask AI