[Resolved]Win32.trojan.rx Hellllllllp

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:24:14 PM, on 7/22/2007
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\HPZipm12.exe
C:\Program Files\Spyware Doctor\svcntaux.exe
C:\Program Files\Spyware Doctor\swdsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Spyware Doctor\SDTrayApp.exe
C:\WINDOWS\NOTEDAD.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Trend Micro\spyware.exe\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
F2 - REG:system.ini: UserInit=userinit.exe,
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: (no name) - {DCD53738-C4F9-414A-A03C-C7405A4AC844} - C:\WINDOWS\system32\nnnoomm.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [SDTray] "C:\Program Files\Spyware Doctor\SDTrayApp.exe"
O4 - HKLM\..\Run: [IESet] IExplorer.dll .dbt
O4 - HKLM\..\RunServices: [IESet] IExplorer.dll .dbt
O4 - HKCU\..\Run: [IESet] IExplorer.dll .dbt
O4 - HKUS\S-1-5-18\..\Run: [IESet] IExplorer.dll .dbt (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [IESet] IExplorer.dll .dbt (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O16 - DPF: {1B4F9DD7-2D7C-44B5-9126-73206DA0AE75} (CNavigationManager Object) - http://www3.authentium.com/cssrelease/bin/wizard.exe
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst20040510.cab
O16 - DPF: {4CCA4E80-9259-11D9-AC6E-444553544200} (FixController Control) - http://h30155.www3.hp.com/ediags/dd/instal…llMgr_v01_5.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1180293109453
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1180293096415
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secur…loadManager.ocx
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pub/shock…ash/swflash.cab
O20 - Winlogon Notify: nnnoomm - C:\WINDOWS\SYSTEM32\nnnoomm.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Unknown owner - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Spyware Doctor Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: Spyware Doctor Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe

–
End of file - 5493 bytes


My computer seems to be running better . but i still cannot connect. to the internet. And i still see the bho file ending with nnnoomm.dll….. I dont think im getting rid of it …

"Susan" - 2007-07-22 15:01:11 - ComboFix 07-07-14.6 NTFS


(((((((((((((((((((((((((((((((((((((((((((( V Log )))))))))))))))))))))))))))))))))))))))))))))))))))))))


C:\WINDOWS\system32\nnnoomm.dll
C:\WINDOWS\system32\nnnoomm.dll


* * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *



((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1.\salesmonitor
C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1.\winantispyware 2007
C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1.\winantispyware 2007\Data\Abbr
C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1.\winantispyware 2007\Data\ProductCode
C:\Program Files\Common Files\dobe~1
C:\Program Files\Common Files\winantispyware 2007
C:\Program Files\Common Files\winantispyware 2007\err.log
C:\Program Files\Common Files\winantispyware 2007\WAS7Mon.exe
C:\Program Files\curity~1
C:\Program Files\poolsv
C:\Program Files\poolsv\k11u72.exe
C:\Program Files\poolsv\svhost.exe
C:\Program Files\poolsv\wr-1-0000077.exe
C:\Program Files\poolsv\YazzleBundle-1549.exe
C:\tempb9
C:\temp\tn3
C:\WINDOWS\b136.exe
C:\WINDOWS\csrss.exe
C:\WINDOWS\DOWNLO~1.\ODCTOOLS
C:\WINDOWS\l.exe
C:\WINDOWS\notedad.exe
C:\WINDOWS\poolsv.exe
C:\WINDOWS\racle~1
C:\WINDOWS\retadpu572.exe
C:\WINDOWS\saiemod.dll
C:\WINDOWS\system32\180ax.exe
C:\WINDOWS\system32\2_exception.nls
C:\WINDOWS\system32\explorer.exe
C:\WINDOWS\system32\gtv_sd.bin
C:\WINDOWS\system32\iexplorer.dll .dbt
C:\WINDOWS\system32\koos.exe
C:\WINDOWS\system32\msdn_lib.dll
C:\WINDOWS\system32\msixu.dll
C:\WINDOWS\system32\pfxzmtaim.dll
C:\WINDOWS\system32\pfxzmtforum.dll
C:\WINDOWS\system32\pfxzmtgtal.dll
C:\WINDOWS\system32\pfxzmticq.dll
C:\WINDOWS\system32\pfxzmtsmt.dll
C:\WINDOWS\system32\pfxzmtsmtspm.dll
C:\WINDOWS\system32\pfxzmtwbmail.dll
C:\WINDOWS\system32\pfxzmtymsg.dll
C:\WINDOWS\system32\rsvp32_2.dllr55675et
C:\WINDOWS\system32\salm.exe
C:\WINDOWS\system32\sl.bin
C:\WINDOWS\system32\updatetc.exe
C:\WINDOWS\system32\wer8274.dll
C:\WINDOWS\system32\wmvds32.dll


((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))


——-\LEGACY_ASC3550U
——-\LEGACY_CORE
——-\LEGACY_DOMAINSERVICE
——-\LEGACY_FWDRV.SYS
——-\LEGACY_POOF
——-\LEGACY_RUNTIME
——-\LEGACY_RUNTIME2
——-\DomainService
——-\fwdrv.sys


((((((((((((((((((((((((( Files Created from 2007-06-22 to 2007-07-22 )))))))))))))))))))))))))))))))


2007-07-22 15:00 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-07-22 12:54 d——– C:\VundoFix Backups
2007-07-22 00:30 1 –a—— C:\WINDOWS\system32\ps.dat
2007-07-21 19:44 0 –a—— C:\WINDOWS\nsreg.dat
2007-07-21 19:44 d——– C:\DOCUME~1\Susan\APPLIC~1\Talkback
2007-07-21 19:42 d——– C:\Program Files\Mozilla Firefox(2)
2007-07-21 19:36 d——– C:\DOCUME~1\Susan\APPLIC~1\MSN6
2007-07-21 19:33 d——– C:\Program Files\Microsoft CAPICOM 2.1.0.2
2007-07-21 18:36 d——– C:\WINDOWS\ERUNT
2007-07-21 18:21 732 –a—— C:\WINDOWS\system32\tmp.reg
2007-07-21 18:20 53,248 –a—— C:\WINDOWS\system32\Process.exe
2007-07-21 18:20 51,200 –a—— C:\WINDOWS\system32\dumphive.exe
2007-07-21 18:20 288,417 –a—— C:\WINDOWS\system32\SrchSTS.exe
2007-07-21 17:51 d——– C:\Program Files\Trend Micro
2007-07-21 15:24 1,835,008 –a—— C:\DOCUME~1\Susan\ntuser.dat
2007-07-21 00:34 83,024 –a—— C:\WINDOWS\system32\drivers\iksyssec.sys
2007-07-21 00:34 626,688 –a—— C:\WINDOWS\system32\msvcr80.dll
2007-07-21 00:34 57,424 –a—— C:\WINDOWS\system32\drivers\iksysflt.sys
2007-07-21 00:34 53,840 –a—— C:\WINDOWS\system32\drivers\ikfilesec.sys
2007-07-21 00:34 39,376 –a—— C:\WINDOWS\system32\drivers\ikfileflt.sys
2007-07-21 00:34 29,264 –a—— C:\WINDOWS\system32\drivers\kcom.sys
2007-07-21 00:34 d——– C:\Program Files\Spyware Doctor
2007-07-21 00:34 d——– C:\DOCUME~1\Susan\APPLIC~1\PC Tools
2007-07-20 18:40 d——– C:\WINDOWS\system32\NtmsData
2007-07-20 18:39 d——– C:\DOCUME~1\Susan\APPLIC~1\Yahoo!
2007-07-20 18:39 d——– C:\DOCUME~1\Susan\APPLIC~1\Google
2007-07-18 23:26 18,432 –a—— C:\WINDOWS\sysrlb32.exe
2007-07-18 23:01 d——– C:\WINDOWS\CSC
2007-07-18 22:09 1,101,824 –a—— C:\DOCUME~1\LOCALS~1.000\NTUSER.DAT
2007-07-18 21:22 8,704 –a—— C:\WINDOWS\system32\sporder.dll
2007-07-18 21:18 50,688 –a—— C:\WINDOWS\system32\zoox1.dll
2007-07-18 21:17 34,289 –a—— C:\WINDOWS\govwef.exe
2007-07-18 20:01 d——– C:\WINDOWS\Downloaded Installations
2007-07-18 17:53 d–h—– C:\WINDOWS\system32\GroupPolicy
2007-07-18 17:51 d——– C:\WINDOWS\system32\b10FdUe
2007-07-18 17:51 d——– C:\DOCUME~1\LINDAD~1.000\APPLIC~1\??curity
2007-07-18 14:33 2,560 –a—— C:\WINDOWS\_MSRSTRT.EXE
2007-07-18 13:55 d——– C:\Program Files\Symantec
2007-07-18 01:26 d——– C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Lavasoft
2007-07-17 22:45 524,288 –ah—– C:\DOCUME~1\ADMINI~1.DAV\ntuser.dat
2007-07-17 14:26 d——– C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Symantec
2007-07-17 13:26 d——– C:\DOCUME~1\LINDAD~1.000\APPLIC~1\Image Zone Express
2007-07-17 10:28 d——– C:\Program Files\Common Files\Scanner
2007-07-17 10:27 d——– C:\DOCUME~1\LINDAD~1.000\APPLIC~1\Yahoo!
2007-07-17 10:27 d——– C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Yahoo! Companion
2007-07-17 10:26 dr-h—– C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\yahoo!
2007-07-16 22:59 29,696 –a—— C:\WINDOWS\mickey32.dll
2007-07-16 22:14 d——– C:\WINDOWS\system32\driver
2007-07-16 22:14 d——– C:\WINDOWS\system32\b02FdUe
2007-07-16 13:13 d——– C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\HP
2007-07-16 13:11 d——– C:\Program Files\Common Files\HP
2007-07-16 13:00 13,824 –a—— C:\WINDOWS\system32\drivers\usbscan.sys
2007-07-16 12:59 94,208 –a—— C:\WINDOWS\system32\HPZipt12.dll
2007-07-16 12:59 69,632 –a—— C:\WINDOWS\system32\HPZipm12.exe
2007-07-16 12:59 65,536 –a—— C:\WINDOWS\system32\HPZinw12.exe
2007-07-16 12:59 57,344 –a—— C:\WINDOWS\system32\HPZisn12.dll
2007-07-16 12:59 306,688 –a—— C:\WINDOWS\IsUninst.exe
2007-07-16 12:59 282,680 –a—— C:\WINDOWS\system32\HPZidr12.dll
2007-07-16 12:59 204,800 –a—— C:\WINDOWS\system32\HPZipr12.dll
2007-07-16 12:56 16,496 -ra—— C:\WINDOWS\system32\drivers\HPZipr12.sys
2007-07-16 12:55 77,824 -ra—— C:\WINDOWS\system32\HPZIDS01.dll
2007-07-16 12:55 38,400 –a—— C:\WINDOWS\system32\hpz3l054.dll
2007-07-16 11:59 d——– C:\DOCUME~1\LINDAD~1.000\APPLIC~1\FunWebProducts
2007-07-16 09:36 1,931,816 –ahs—- C:\WINDOWS\system32\opppo.bak2
2007-07-15 23:10 d——– C:\Program Files\Common Files\Aluria
2007-07-15 23:08 d——– C:\Program Files\Common Files\Authentium
2007-07-15 20:30 6,369 –ahs—- C:\WINDOWS\system32\opppo.bak1
2007-07-15 20:24 d——– C:\Temp\brr
2007-07-15 20:24 d——– C:\Tempc2
2007-07-15 17:49 d——– C:\DOCUME~1\LINDAD~1.000\APPLIC~1\HP
2007-07-15 17:12 d——– C:\Program Files\Common Files\Hewlett-Packard
2007-07-15 17:04 d——– C:\Program Files\HP
2007-07-15 17:03 117,158 –a—— C:\WINDOWS\hpoins11.dat
2007-07-11 05:29 22,016 –a—— C:\WINDOWS\b138.exe
2007-07-03 18:13 2,097,152 –a—— C:\DOCUME~1\LINDAD~1.000\ntuser.dat
2007-06-25 15:10 d——– C:\DOCUME~1\LINDAD~1.000\APPLIC~1\MSN6
2007-06-25 15:10 d——– C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\MSN6
2007-06-24 20:09 d——– C:\WINDOWS\.jagex_cache_32


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-07-22 19:58:01 ——– d—–w C:\Program Files\Microsoft AntiSpyware
2007-07-22 05:14:57 ——– d—–w C:\Program Files\Online Services
2007-07-21 19:46:43 ——– d—–w C:\Program Files\Common Files\Wise Installation Wizard
2007-07-21 18:52:18 ——– d—–w C:\Program Files\Common Files\Symantec Shared
2007-07-21 04:49:35 29,696 –sha-w C:\WINDOWS\system32\drivers\Thumbs.db
2007-07-17 15:28:04 ——– d—–w C:\Program Files\Yahoo!
2007-07-17 01:45:28 ——– d—–w C:\Program Files\Hewlett-Packard
2007-07-16 14:49:00 246 —-a-w C:\Program Files\Common Files\zysig250
2007-07-16 04:11:48 ——– d—–w C:\Program Files\Common Files\RuleSpace
2007-07-16 03:41:35 ——– d—–w C:\Program Files\Common Files\Authentium Shared
2007-07-16 01:25:29 ——– d—–w C:\Program Files\MSN Gaming Zone
2007-07-16 01:24:28 164,787 —-a-w C:\WINDOWS\system32\drivers\core.cache(5).dsk
2007-07-16 01:24:28 164,787 —-a-w C:\WINDOWS\system32\drivers\core.cache(4).dsk
2007-07-16 01:24:28 164,787 —-a-w C:\WINDOWS\system32\drivers\core.cache(3).dsk
2007-07-16 01:24:28 164,787 —-a-w C:\WINDOWS\system32\drivers\core.cache(2).dsk
2007-07-13 07:26:28 ——– d—–w C:\Program Files\LimeWire
2007-06-16 04:18:43 ——– d—–w C:\Program Files\Google
2007-06-14 19:11:57 ——– d—–w C:\Program Files\Common Files\InstallShield
2007-06-13 20:08:59 ——– d-sh–w C:\Program Files\outlook
2007-06-12 21:55:47 376 —-a-w C:\WINDOWS\mozregistry.dat
2007-06-12 17:42:26 ——– d—–w C:\Program Files\Common Files\Command Software
2007-06-08 04:48:53 ——– d–h–w C:\Program Files\InstallShield Installation Information
2007-06-08 04:28:47 ——– d—–w C:\Program Files\Sony
2007-05-28 16:40:30 ——– d—–w C:\Program Files\iTunes
2007-05-28 16:40:07 ——– d—–w C:\Program Files\iPod
2007-05-28 16:38:49 ——– d—–w C:\Program Files\QuickTime
2007-05-28 16:36:52 ——– d—–w C:\Program Files\Apple Software Update
2007-05-27 19:12:06 ——– d–h–w C:\Program Files\WindowsUpdate
2007-05-27 19:11:00 ——– d—–w C:\Program Files\Common Files\PestPatrol
2007-05-27 18:44:51 ——– d—–w C:\Program Files\Windows NT
2007-05-27 18:44:36 ——– d—–w C:\Program Files\Movie Maker
2007-05-26 03:50:45 ——– d—–w C:\Program Files\MSXML 4.0
2004-08-16 14:00:00 2,994,176 —-a-w C:\Program Files\Paint Shop Pro 9.exe
1998-12-09 02:53:54 99,840 -c–a-w C:\Program Files\Common Files\IRAABOUT.DLL
1998-12-09 02:53:54 70,144 -c–a-w C:\Program Files\Common Files\IRAMDMTR.DLL
1998-12-09 02:53:54 48,640 -c–a-w C:\Program Files\Common Files\IRALPTTR.DLL
1998-12-09 02:53:54 31,744 -c–a-w C:\Program Files\Common Files\IRAWEBTR.DLL
1998-12-09 02:53:54 186,368 -c–a-w C:\Program Files\Common Files\IRAREG.DLL
1998-12-09 02:53:54 17,920 -c–a-w C:\Program Files\Common Files\IRASRIAL.DLL


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]
2007-05-30 16:18 808472 –a—— C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
2006-10-22 23:08 62080 –a—— C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
2005-05-31 01:04 853672 –a—— C:\PROGRA~1\SPYBOT~1\SDHelper.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
2007-03-14 03:43 501400 –a—— C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
2007-06-15 23:18 2403392 -ra—— c:\program files\google\googletoolbar3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-03-14 22:10]
"SDTray"="C:\Program Files\Spyware Doctor\SDTrayApp.exe" [2007-06-27 13:54]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\aawservice]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\sdauxservice]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\sdcoreservice]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
path=C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk
backup=C:\WINDOWS\pss\Adobe Reader Synchronizer.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Cleanup]
C:\Documents and Settings\Linda.DAVID-5DYLJRM82.000\Application Data\CCleanup\compind.bat

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\icq.com]
rundll32.exe "C:\WINDOWS\System32\gncuopap.dll",forkonce

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
"C:\Program Files\iTunes\iTunesHelper.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"C:\Program Files\Messenger\msmsgs.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\poolsv]
"C:\WINDOWS\poolsv.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Salestart]
"C:\Program Files\Common Files\WinAntiSpyware 2007\WAS7Mon.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
"C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\svhost]
"C:\WINDOWS\svhost.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Tbcw]
"C:\DOCUME~1\LINDAD~1.000\APPLIC~1\RACLE~1\mshta.exe" -vt yazb

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yqmkyhdq]
"C:\Documents and Settings\Linda.DAVID-5DYLJRM82.000\Application Data\??curity\dvdplay.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\YSearchProtection]
C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"Messenger"=2 (0x2)
"iPod Service"=3 (0x3)
"DomainService"=2 (0x2)
"comHost"=3 (0x3)


HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{ACC563BC-4266-43f0-B6ED-9D38C4202C7E}
rundll32 iesetup.dll,IEAccessUserInst

Contents of the 'Scheduled Tasks' folder
2007-07-13 16:47:00 C:\WINDOWS\tasks\AppleSoftwareUpdate.job
2007-07-16 22:10:16 C:\WINDOWS\tasks\WebReg psc C3100 series.job

**************************************************************************

catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-22 15:18:22
Windows 5.1.2600 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

**************************************************************************

Completion time: 2007-07-22 15:21:50 - machine was rebooted
C:\ComboFix-quarantined-files.txt … 2007-07-22 15:21

— E O F —



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:31:23 PM, on 7/22/2007
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\Program Files\Spyware Doctor\svcntaux.exe
C:\Program Files\Spyware Doctor\swdsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Spyware Doctor\SDTrayApp.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Trend Micro\spyware.exe\HijackThis.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SDTray] "C:\Program Files\Spyware Doctor\SDTrayApp.exe"
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {1B4F9DD7-2D7C-44B5-9126-73206DA0AE75} (CNavigationManager Object) - http://www3.authentium.com/cssrelease/bin/wizard.exe
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst20040510.cab
O16 - DPF: {4CCA4E80-9259-11D9-AC6E-444553544200} (FixController Control) - http://h30155.www3.hp.com/ediags/dd/instal…llMgr_v01_5.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1180293109453
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1180293096415
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secur…loadManager.ocx
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pub/shock…ash/swflash.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Unknown owner - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Spyware Doctor Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: Spyware Doctor Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe

–
End of file - 4788 bytes

"Susan" - 2007-07-22 17:16:29 - ComboFix 07-07-14.6 - Service Pack 2 NTFS
Command switches used :: C:\Documents and Settings\Susan\Desktop\Shortcut to cfscript.lnk


((((((((((((((((((((((((( Files Created from 2007-06-22 to 2007-07-22 )))))))))))))))))))))))))))))))


2007-07-22 16:50 16,128 –a—— C:\WINDOWS\system32\drivers\MODEMCSA.sys
2007-07-22 16:50 d——– C:\WINDOWS\LastGood
2007-07-22 16:45 d——– C:\WINDOWS\Prefetch
2007-07-22 16:16 9,728 ——— C:\WINDOWS\system32\rwnh.dll
2007-07-22 16:16 9,728 ——— C:\WINDOWS\system32\comsdupd.exe
2007-07-22 16:16 40,832 ——— C:\WINDOWS\system32\drivers\irbus.sys
2007-07-22 16:16 32,768 ——— C:\WINDOWS\system32\asr_pfu.exe
2007-07-22 16:16 12,800 ——— C:\WINDOWS\system32\spiisupd.exe
2007-07-22 16:16 10,752 ——— C:\WINDOWS\system32\smtpapi.dll
2007-07-22 16:16 d——– C:\Program Files\messenger
2007-07-22 16:15 95,424 ——— C:\WINDOWS\system32\drivers\slnthal.sys
2007-07-22 16:15 937,984 ——— C:\WINDOWS\system32\winbrand.dll
2007-07-22 16:15 88,064 ——— C:\WINDOWS\system32\p2pnetsh.dll
2007-07-22 16:15 870,784 ——— C:\WINDOWS\system32\ati3d1ag.dll
2007-07-22 16:15 86,016 ——— C:\WINDOWS\system32\p2pgasvc.dll
2007-07-22 16:15 86,016 ——— C:\WINDOWS\system32\mdmxsdk.dll
2007-07-22 16:15 81,920 ——— C:\WINDOWS\system32\ieencode.dll
2007-07-22 16:15 81,408 ——— C:\WINDOWS\system32\wscsvc.dll
2007-07-22 16:15 8,192 ——— C:\WINDOWS\system32\smbinst.exe
2007-07-22 16:15 78,464 ——— C:\WINDOWS\system32\drivers\usbvideo.sys
2007-07-22 16:15 75,776 ——— C:\WINDOWS\system32\strmfilt.dll
2007-07-22 16:15 73,832 ——— C:\WINDOWS\system32\slcoinst.dll
2007-07-22 16:15 73,796 ——— C:\WINDOWS\system32\slserv.exe
2007-07-22 16:15 73,216 ——— C:\WINDOWS\system32\drivers\atintuxx.sys
2007-07-22 16:15 71,680 ——— C:\WINDOWS\system32\blastcln.exe
2007-07-22 16:15 701,440 ——— C:\WINDOWS\system32\drivers\ati2mtag.sys
2007-07-22 16:15 7,680 ——— C:\WINDOWS\system32\kbdsmsno.dll
2007-07-22 16:15 7,680 ——— C:\WINDOWS\system32\kbdsmsfi.dll
2007-07-22 16:15 7,168 ——— C:\WINDOWS\system32\kbdukx.dll
2007-07-22 16:15 7,168 ——— C:\WINDOWS\system32\kbdno1.dll
2007-07-22 16:15 7,168 ——— C:\WINDOWS\system32\kbdfi1.dll
2007-07-22 16:15 7,168 ——— C:\WINDOWS\system32\hccoin.dll
2007-07-22 16:15 685,056 ——— C:\WINDOWS\system32\drivers\hsfcxts2.sys
2007-07-22 16:15 67,584 ——— C:\WINDOWS\system32\drivers\sdbus.sys
2007-07-22 16:15 63,663 ——— C:\WINDOWS\system32\drivers\ati1rvxx.sys
2007-07-22 16:15 63,488 ——— C:\WINDOWS\system32\drivers\atinxsxx.sys
2007-07-22 16:15 60,416 ——— C:\WINDOWS\system32\fwcfg.dll
2007-07-22 16:15 6,656 ——— C:\WINDOWS\system32\kbdinmal.dll
2007-07-22 16:15 6,656 ——— C:\WINDOWS\system32\kbdinben.dll
2007-07-22 16:15 6,144 ——— C:\WINDOWS\system32\kbdmlt48.dll
2007-07-22 16:15 6,144 ——— C:\WINDOWS\system32\kbdmlt47.dll
2007-07-22 16:15 6,144 ——— C:\WINDOWS\system32\kbdinbe1.dll
2007-07-22 16:15 6,016 ——— C:\WINDOWS\system32\drivers\smbali.sys
2007-07-22 16:15 59,648 ——— C:\WINDOWS\system32\drivers\rfcomm.sys
2007-07-22 16:15 57,856 ——— C:\WINDOWS\system32\drivers\atinbtxx.sys
2007-07-22 16:15 56,623 ——— C:\WINDOWS\system32\drivers\ati1btxx.sys
2007-07-22 16:15 526,848 ——— C:\WINDOWS\system32\p2psvc.dll
2007-07-22 16:15 52,224 ——— C:\WINDOWS\system32\drivers\atinraxx.sys
2007-07-22 16:15 516,768 ——— C:\WINDOWS\system32\ativvaxx.dll
2007-07-22 16:15 50,688 ——— C:\WINDOWS\system32\btpanui.dll
2007-07-22 16:15 50,176 ——— C:\WINDOWS\system32\xmlprovi.dll
2007-07-22 16:15 5,632 ——— C:\WINDOWS\system32\kbdmaori.dll
2007-07-22 16:15 49,152 ——— C:\WINDOWS\system32\powercfg.exe
2007-07-22 16:15 48,640 ——— C:\WINDOWS\system32\pnrpnsp.dll
2007-07-22 16:15 46,464 ——— C:\WINDOWS\system32\drivers\gagp30kx.sys
2007-07-22 16:15 452,736 ——— C:\WINDOWS\system32\drivers\mtxparhm.sys
2007-07-22 16:15 44,928 ——— C:\WINDOWS\system32\drivers\agpcpq.sys
2007-07-22 16:15 44,672 ——— C:\WINDOWS\system32\drivers\uagp35.sys
2007-07-22 16:15 44,032 ——— C:\WINDOWS\system32\twext.dll
2007-07-22 16:15 43,008 ——— C:\WINDOWS\system32\drivers\amdagp.sys
2007-07-22 16:15 42,752 ——— C:\WINDOWS\system32\drivers\alim1541.sys
2007-07-22 16:15 42,368 ——— C:\WINDOWS\system32\drivers\agp440.sys
2007-07-22 16:15 41,088 ——— C:\WINDOWS\system32\drivers\sisagp.sys
2007-07-22 16:15 404,990 ——— C:\WINDOWS\system32\drivers\slntamr.sys
2007-07-22 16:15 4,274,816 ——— C:\WINDOWS\system32\nv4_disp.dll
2007-07-22 16:15 4,255 ——— C:\WINDOWS\system32\drivers\adv01nt5.dll
2007-07-22 16:15 4,096 ——— C:\WINDOWS\system32\dsprpres.dll
2007-07-22 16:15 397,056 ——— C:\WINDOWS\system32\s3gnb.dll
2007-07-22 16:15 38,016 ——— C:\WINDOWS\system32\drivers\bthmodem.sys
2007-07-22 16:15 377,984 ——— C:\WINDOWS\system32\ati2dvaa.dll
2007-07-22 16:15 37,376 ——— C:\WINDOWS\system32\drivers\amdk7.sys
2007-07-22 16:15 36,463 ——— C:\WINDOWS\system32\drivers\ati1tuxx.sys
2007-07-22 16:15 36,096 ——— C:\WINDOWS\system32\drivers\intelppm.sys
2007-07-22 16:15 35,456 ——— C:\WINDOWS\system32\drivers\bthprint.sys
2007-07-22 16:15 34,735 ——— C:\WINDOWS\system32\drivers\ati1xsxx.sys
2007-07-22 16:15 327,040 ——— C:\WINDOWS\system32\drivers\ati2mtaa.sys
2007-07-22 16:15 32,866 ——— C:\WINDOWS\system32\slrundll.exe
2007-07-22 16:15 32,866 ——— C:\WINDOWS\slrundll.exe
2007-07-22 16:15 32,768 ——— C:\WINDOWS\system32\ativtmxx.dll
2007-07-22 16:15 32,285 ——— C:\WINDOWS\system32\hsfcisp2.dll
2007-07-22 16:15 312,320 ——— C:\WINDOWS\system32\p2pgraph.dll
2007-07-22 16:15 31,744 ——— C:\WINDOWS\system32\drivers\atinxbxx.sys
2007-07-22 16:15 30,671 ——— C:\WINDOWS\system32\drivers\ati1raxx.sys
2007-07-22 16:15 30,208 ——— C:\WINDOWS\system32\bthserv.dll
2007-07-22 16:15 30,080 ——— C:\WINDOWS\system32\drivers\rndismpx.sys
2007-07-22 16:15 3,967 ——— C:\WINDOWS\system32\drivers\adv02nt5.dll
2007-07-22 16:15 3,901 ——— C:\WINDOWS\system32\drivers\siint5.dll
2007-07-22 16:15 3,775 ——— C:\WINDOWS\system32\drivers\adv11nt5.dll
2007-07-22 16:15 3,711 ——— C:\WINDOWS\system32\drivers\adv09nt5.dll
2007-07-22 16:15 3,647 ——— C:\WINDOWS\system32\drivers\adv07nt5.dll
2007-07-22 16:15 3,615 ——— C:\WINDOWS\system32\drivers\adv05nt5.dll
2007-07-22 16:15 3,135 ——— C:\WINDOWS\system32\drivers\adv08nt5.dll
2007-07-22 16:15 29,455 ——— C:\WINDOWS\system32\drivers\ati1xbxx.sys
2007-07-22 16:15 29,184 ——— C:\WINDOWS\system32\sdhcinst.dll
2007-07-22 16:15 29,056 ——— C:\WINDOWS\system32\drivers\ip6fw.sys
2007-07-22 16:15 286,792 ——— C:\WINDOWS\system32\slextspk.dll
2007-07-22 16:15 28,672 ——— C:\WINDOWS\system32\drivers\atinsnxx.sys
2007-07-22 16:15 274,304 ——— C:\WINDOWS\system32\drivers\bthport.sys
2007-07-22 16:15 270,848 ——— C:\WINDOWS\system32\sbe.dll
2007-07-22 16:15 263,040 ——— C:\WINDOWS\system32\drivers\http.sys


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-07-22 21:07:55 ——– d—–w C:\Program Files\Movie Maker
2007-07-22 21:07:31 ——– d—–w C:\Program Files\Windows NT
2007-07-22 19:58:01 ——– d—–w C:\Program Files\Microsoft AntiSpyware
2007-07-22 05:14:57 ——– d—–w C:\Program Files\Online Services
2007-07-21 19:46:43 ——– d—–w C:\Program Files\Common Files\Wise Installation Wizard
2007-07-21 18:52:18 ——– d—–w C:\Program Files\Common Files\Symantec Shared
2007-07-21 04:49:35 29,696 –sha-w C:\WINDOWS\system32\drivers\Thumbs.db
2007-07-17 15:28:04 ——– d—–w C:\Program Files\Yahoo!
2007-07-17 01:45:28 ——– d—–w C:\Program Files\Hewlett-Packard
2007-07-16 14:49:00 246 —-a-w C:\Program Files\Common Files\zysig250
2007-07-16 04:11:48 ——– d—–w C:\Program Files\Common Files\RuleSpace
2007-07-16 03:41:35 ——– d—–w C:\Program Files\Common Files\Authentium Shared
2007-07-16 01:25:29 ——– d—–w C:\Program Files\MSN Gaming Zone
2007-07-16 01:24:28 164,787 —-a-w C:\WINDOWS\system32\drivers\core.cache(5).dsk
2007-07-16 01:24:28 164,787 —-a-w C:\WINDOWS\system32\drivers\core.cache(4).dsk
2007-07-16 01:24:28 164,787 —-a-w C:\WINDOWS\system32\drivers\core.cache(3).dsk
2007-07-16 01:24:28 164,787 —-a-w C:\WINDOWS\system32\drivers\core.cache(2).dsk
2007-07-13 07:26:28 ——– d—–w C:\Program Files\LimeWire
2007-06-16 04:18:43 ——– d—–w C:\Program Files\Google
2007-06-14 19:11:57 ——– d—–w C:\Program Files\Common Files\InstallShield
2007-06-13 20:08:59 ——– d-sh–w C:\Program Files\outlook
2007-06-12 21:55:47 376 —-a-w C:\WINDOWS\mozregistry.dat
2007-06-12 17:42:26 ——– d—–w C:\Program Files\Common Files\Command Software
2007-06-08 04:48:53 ——– d–h–w C:\Program Files\InstallShield Installation Information
2007-06-08 04:28:47 ——– d—–w C:\Program Files\Sony
2007-05-28 16:40:30 ——– d—–w C:\Program Files\iTunes
2007-05-28 16:40:07 ——– d—–w C:\Program Files\iPod
2007-05-28 16:38:49 ——– d—–w C:\Program Files\QuickTime
2007-05-28 16:36:52 ——– d—–w C:\Program Files\Apple Software Update
2007-05-27 19:12:06 ——– d–h–w C:\Program Files\WindowsUpdate
2007-05-27 19:11:00 ——– d—–w C:\Program Files\Common Files\PestPatrol
2007-05-26 03:50:45 ——– d—–w C:\Program Files\MSXML 4.0
2004-08-16 14:00:00 2,994,176 —-a-w C:\Program Files\Paint Shop Pro 9.exe
1998-12-09 02:53:54 99,840 -c–a-w C:\Program Files\Common Files\IRAABOUT.DLL
1998-12-09 02:53:54 70,144 -c–a-w C:\Program Files\Common Files\IRAMDMTR.DLL
1998-12-09 02:53:54 48,640 -c–a-w C:\Program Files\Common Files\IRALPTTR.DLL
1998-12-09 02:53:54 31,744 -c–a-w C:\Program Files\Common Files\IRAWEBTR.DLL
1998-12-09 02:53:54 186,368 -c–a-w C:\Program Files\Common Files\IRAREG.DLL
1998-12-09 02:53:54 17,920 -c–a-w C:\Program Files\Common Files\IRASRIAL.DLL


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]
2007-05-30 16:18 808472 –a—— C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
2006-10-22 23:08 62080 –a—— C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
2005-05-31 01:04 853672 –a—— C:\PROGRA~1\SPYBOT~1\SDHelper.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
2007-03-14 03:43 501400 –a—— C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
2007-06-15 23:18 2403392 -ra—— c:\program files\google\googletoolbar3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-03-14 22:10]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\aawservice]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
path=C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk
backup=C:\WINDOWS\pss\Adobe Reader Synchronizer.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Cleanup]
C:\Documents and Settings\Linda.DAVID-5DYLJRM82.000\Application Data\CCleanup\compind.bat

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\icq.com]
rundll32.exe "C:\WINDOWS\System32\gncuopap.dll",forkonce

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
"C:\Program Files\iTunes\iTunesHelper.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"C:\Program Files\Messenger\msmsgs.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\poolsv]
"C:\WINDOWS\poolsv.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Salestart]
"C:\Program Files\Common Files\WinAntiSpyware 2007\WAS7Mon.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
"C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\svhost]
"C:\WINDOWS\svhost.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Tbcw]
"C:\DOCUME~1\LINDAD~1.000\APPLIC~1\RACLE~1\mshta.exe" -vt yazb

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yqmkyhdq]
"C:\Documents and Settings\Linda.DAVID-5DYLJRM82.000\Application Data\??curity\dvdplay.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\YSearchProtection]
C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"Messenger"=2 (0x2)
"iPod Service"=3 (0x3)
"DomainService"=2 (0x2)
"comHost"=3 (0x3)

*Newly Created Service* - ALG
*Newly Created Service* - DCOMLAUNCH
*Newly Created Service* - FLTMGR
*Newly Created Service* - HTTP
*Newly Created Service* - IPNAT
*Newly Created Service* - SLWDMSUP
*Newly Created Service* - WSCSVC

Contents of the 'Scheduled Tasks' folder
2007-07-13 16:47:00 C:\WINDOWS\tasks\AppleSoftwareUpdate.job
2007-07-16 22:10:16 C:\WINDOWS\tasks\WebReg psc C3100 series.job

**************************************************************************

catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-22 17:20:06
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

**************************************************************************

Completion time: 2007-07-22 17:21:46
C:\ComboFix-quarantined-files.txt … 2007-07-22 17:21
C:\ComboFix2.txt … 2007-07-22 15:21

— E O F —

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:26:14 PM, on 7/22/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Trend Micro\spyware.exe\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {1B4F9DD7-2D7C-44B5-9126-73206DA0AE75} (CNavigationManager Object) - http://www3.authentium.com/cssrelease/bin/wizard.exe
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst20040510.cab
O16 - DPF: {4CCA4E80-9259-11D9-AC6E-444553544200} (FixController Control) - http://h30155.www3.hp.com/ediags/dd/instal…llMgr_v01_5.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1180293109453
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1180293096415
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secur…loadManager.ocx
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pub/shock…ash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{0EDA799A-B587-4556-A966-5624D458747F}: NameServer = 199.5.157.128,204.57.55.100
O17 - HKLM\System\CS2\Services\Tcpip\..\{0EDA799A-B587-4556-A966-5624D458747F}: NameServer = 199.5.157.128,204.57.55.100
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe

–
End of file - 4798 bytes



"Susan" - 2007-07-22 22:17:16 - ComboFix 07-07-14.6 - Service Pack 2 NTFS
Command switches used :: C:\Documents and Settings\Susan\Desktop\cfscript.txt


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\DOCUME~1\LINDAD~1.000\APPLIC~1\FunWebProducts
C:\DOCUME~1\LINDAD~1.000\APPLIC~1\FunWebProducts\Data\Linda\avatar.dat
C:\DOCUME~1\LINDAD~1.000\APPLIC~1\FunWebProducts\Data\Linda\register.dat
C:\Program Files\Common Files\zysig250
C:\Temp\brr
C:\Temp\brr\tmpZTF.log
C:\VundoFix Backups
C:\VundoFix Backups\addmorefiles.txt
C:\VundoFix Backups\edcfe.bak1.bad
C:\VundoFix Backups\edcfe.bak2.bad
C:\VundoFix Backups\edcfe.ini.bad
C:\VundoFix Backups\edcfe.ini2.bad
C:\VundoFix Backups\efcde.dll.bad
C:\VundoFix Backups\unyveylu.dll.bad
C:\WINDOWS\_MSRSTRT.EXE
C:\WINDOWS\govwef.exe
C:\WINDOWS\sysrlb32.exe
C:\WINDOWS\system32\b02FdUe
C:\WINDOWS\system32\b02FdUe\b02FdUe1065.exe
C:\WINDOWS\system32\b10FdUe
C:\WINDOWS\system32\b10FdUe\b10FdUe1099.exe
C:\WINDOWS\system32\drivers\core.cache(2).dsk
C:\WINDOWS\system32\drivers\core.cache(3).dsk
C:\WINDOWS\system32\drivers\core.cache(4).dsk
C:\WINDOWS\system32\drivers\core.cache(5).dsk
C:\WINDOWS\system32\opppo.bak1
C:\WINDOWS\system32\opppo.bak2
C:\WINDOWS\system32\zoox1.dll


((((((((((((((((((((((((( Files Created from 2007-06-23 to 2007-07-23 )))))))))))))))))))))))))))))))


2007-07-22 19:11 d——– C:\WINDOWS\system32\msmq
2007-07-22 19:11 d——– C:\WINDOWS\system32\Logfiles
2007-07-22 19:11 d——– C:\Inetpub
2007-07-22 18:27 d——– C:\Program Files\Lavasoft
2007-07-22 16:50 16,128 –a—— C:\WINDOWS\system32\drivers\MODEMCSA.sys
2007-07-22 16:50 d——– C:\WINDOWS\LastGood
2007-07-22 16:45 d——– C:\WINDOWS\Prefetch
2007-07-22 16:16 9,728 –a—— C:\WINDOWS\system32\rwnh.dll
2007-07-22 16:16 9,728 ——— C:\WINDOWS\system32\comsdupd.exe
2007-07-22 16:16 40,832 ——— C:\WINDOWS\system32\drivers\irbus.sys
2007-07-22 16:16 32,768 ——— C:\WINDOWS\system32\asr_pfu.exe
2007-07-22 16:16 12,800 ——— C:\WINDOWS\system32\spiisupd.exe
2007-07-22 16:16 10,752 –a—— C:\WINDOWS\system32\smtpapi.dll
2007-07-22 16:16 d——– C:\Program Files\messenger
2007-07-22 16:15 95,424 ——— C:\WINDOWS\system32\drivers\slnthal.sys
2007-07-22 16:15 937,984 ——— C:\WINDOWS\system32\winbrand.dll
2007-07-22 16:15 88,064 ——— C:\WINDOWS\system32\p2pnetsh.dll
2007-07-22 16:15 870,784 ——— C:\WINDOWS\system32\ati3d1ag.dll
2007-07-22 16:15 86,016 ——— C:\WINDOWS\system32\p2pgasvc.dll
2007-07-22 16:15 86,016 ——— C:\WINDOWS\system32\mdmxsdk.dll
2007-07-22 16:15 81,920 ——— C:\WINDOWS\system32\ieencode.dll
2007-07-22 16:15 81,408 ——— C:\WINDOWS\system32\wscsvc.dll
2007-07-22 16:15 8,192 ——— C:\WINDOWS\system32\smbinst.exe
2007-07-22 16:15 78,464 ——— C:\WINDOWS\system32\drivers\usbvideo.sys
2007-07-22 16:15 75,776 ——— C:\WINDOWS\system32\strmfilt.dll
2007-07-22 16:15 73,832 ——— C:\WINDOWS\system32\slcoinst.dll
2007-07-22 16:15 73,796 ——— C:\WINDOWS\system32\slserv.exe
2007-07-22 16:15 73,216 ——— C:\WINDOWS\system32\drivers\atintuxx.sys
2007-07-22 16:15 71,680 ——— C:\WINDOWS\system32\blastcln.exe
2007-07-22 16:15 701,440 ——— C:\WINDOWS\system32\drivers\ati2mtag.sys
2007-07-22 16:15 7,680 ——— C:\WINDOWS\system32\kbdsmsno.dll
2007-07-22 16:15 7,680 ——— C:\WINDOWS\system32\kbdsmsfi.dll
2007-07-22 16:15 7,168 ——— C:\WINDOWS\system32\kbdukx.dll
2007-07-22 16:15 7,168 ——— C:\WINDOWS\system32\kbdno1.dll
2007-07-22 16:15 7,168 ——— C:\WINDOWS\system32\kbdfi1.dll
2007-07-22 16:15 7,168 ——— C:\WINDOWS\system32\hccoin.dll
2007-07-22 16:15 685,056 ——— C:\WINDOWS\system32\drivers\hsfcxts2.sys
2007-07-22 16:15 67,584 ——— C:\WINDOWS\system32\drivers\sdbus.sys
2007-07-22 16:15 63,663 ——— C:\WINDOWS\system32\drivers\ati1rvxx.sys
2007-07-22 16:15 63,488 ——— C:\WINDOWS\system32\drivers\atinxsxx.sys
2007-07-22 16:15 60,416 ——— C:\WINDOWS\system32\fwcfg.dll
2007-07-22 16:15 6,656 ——— C:\WINDOWS\system32\kbdinmal.dll
2007-07-22 16:15 6,656 ——— C:\WINDOWS\system32\kbdinben.dll
2007-07-22 16:15 6,144 ——— C:\WINDOWS\system32\kbdmlt48.dll
2007-07-22 16:15 6,144 ——— C:\WINDOWS\system32\kbdmlt47.dll
2007-07-22 16:15 6,144 ——— C:\WINDOWS\system32\kbdinbe1.dll
2007-07-22 16:15 6,016 ——— C:\WINDOWS\system32\drivers\smbali.sys
2007-07-22 16:15 59,648 ——— C:\WINDOWS\system32\drivers\rfcomm.sys
2007-07-22 16:15 57,856 ——— C:\WINDOWS\system32\drivers\atinbtxx.sys
2007-07-22 16:15 56,623 ——— C:\WINDOWS\system32\drivers\ati1btxx.sys
2007-07-22 16:15 526,848 ——— C:\WINDOWS\system32\p2psvc.dll
2007-07-22 16:15 52,224 ——— C:\WINDOWS\system32\drivers\atinraxx.sys
2007-07-22 16:15 516,768 ——— C:\WINDOWS\system32\ativvaxx.dll
2007-07-22 16:15 50,688 ——— C:\WINDOWS\system32\btpanui.dll
2007-07-22 16:15 50,176 ——— C:\WINDOWS\system32\xmlprovi.dll
2007-07-22 16:15 5,632 ——— C:\WINDOWS\system32\kbdmaori.dll
2007-07-22 16:15 49,152 ——— C:\WINDOWS\system32\powercfg.exe
2007-07-22 16:15 48,640 ——— C:\WINDOWS\system32\pnrpnsp.dll
2007-07-22 16:15 46,464 ——— C:\WINDOWS\system32\drivers\gagp30kx.sys
2007-07-22 16:15 452,736 ——— C:\WINDOWS\system32\drivers\mtxparhm.sys
2007-07-22 16:15 44,928 ——— C:\WINDOWS\system32\drivers\agpcpq.sys
2007-07-22 16:15 44,672 ——— C:\WINDOWS\system32\drivers\uagp35.sys
2007-07-22 16:15 44,032 ——— C:\WINDOWS\system32\twext.dll
2007-07-22 16:15 43,008 ——— C:\WINDOWS\system32\drivers\amdagp.sys
2007-07-22 16:15 42,752 ——— C:\WINDOWS\system32\drivers\alim1541.sys
2007-07-22 16:15 42,368 ——— C:\WINDOWS\system32\drivers\agp440.sys
2007-07-22 16:15 41,088 ——— C:\WINDOWS\system32\drivers\sisagp.sys
2007-07-22 16:15 404,990 ——— C:\WINDOWS\system32\drivers\slntamr.sys
2007-07-22 16:15 4,274,816 ——— C:\WINDOWS\system32\nv4_disp.dll
2007-07-22 16:15 4,255 ——— C:\WINDOWS\system32\drivers\adv01nt5.dll
2007-07-22 16:15 4,096 ——— C:\WINDOWS\system32\dsprpres.dll
2007-07-22 16:15 397,056 ——— C:\WINDOWS\system32\s3gnb.dll
2007-07-22 16:15 38,016 ——— C:\WINDOWS\system32\drivers\bthmodem.sys
2007-07-22 16:15 377,984 ——— C:\WINDOWS\system32\ati2dvaa.dll
2007-07-22 16:15 37,376 ——— C:\WINDOWS\system32\drivers\amdk7.sys
2007-07-22 16:15 36,463 ——— C:\WINDOWS\system32\drivers\ati1tuxx.sys
2007-07-22 16:15 36,096 ——— C:\WINDOWS\system32\drivers\intelppm.sys
2007-07-22 16:15 35,456 ——— C:\WINDOWS\system32\drivers\bthprint.sys
2007-07-22 16:15 34,735 ——— C:\WINDOWS\system32\drivers\ati1xsxx.sys
2007-07-22 16:15 327,040 ——— C:\WINDOWS\system32\drivers\ati2mtaa.sys
2007-07-22 16:15 32,866 ——— C:\WINDOWS\system32\slrundll.exe
2007-07-22 16:15 32,866 ——— C:\WINDOWS\slrundll.exe
2007-07-22 16:15 32,768 ——— C:\WINDOWS\system32\ativtmxx.dll
2007-07-22 16:15 32,285 ——— C:\WINDOWS\system32\hsfcisp2.dll
2007-07-22 16:15 312,320 ——— C:\WINDOWS\system32\p2pgraph.dll
2007-07-22 16:15 31,744 ——— C:\WINDOWS\system32\drivers\atinxbxx.sys
2007-07-22 16:15 30,671 ——— C:\WINDOWS\system32\drivers\ati1raxx.sys
2007-07-22 16:15 30,208 ——— C:\WINDOWS\system32\bthserv.dll
2007-07-22 16:15 30,080 ——— C:\WINDOWS\system32\drivers\rndismpx.sys
2007-07-22 16:15 3,967 ——— C:\WINDOWS\system32\drivers\adv02nt5.dll
2007-07-22 16:15 3,901 ——— C:\WINDOWS\system32\drivers\siint5.dll
2007-07-22 16:15 3,775 ——— C:\WINDOWS\system32\drivers\adv11nt5.dll
2007-07-22 16:15 3,711 ——— C:\WINDOWS\system32\drivers\adv09nt5.dll
2007-07-22 16:15 3,647 ——— C:\WINDOWS\system32\drivers\adv07nt5.dll
2007-07-22 16:15 3,615 ——— C:\WINDOWS\system32\drivers\adv05nt5.dll
2007-07-22 16:15 3,135 ——— C:\WINDOWS\system32\drivers\adv08nt5.dll
2007-07-22 16:15 29,455 ——— C:\WINDOWS\system32\drivers\ati1xbxx.sys
2007-07-22 16:15 29,184 ——— C:\WINDOWS\system32\sdhcinst.dll
2007-07-22 16:15 29,056 ——— C:\WINDOWS\system32\drivers\ip6fw.sys
2007-07-22 16:15 286,792 ——— C:\WINDOWS\system32\slextspk.dll


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-07-22 23:25:02 ——– d—–w C:\Program Files\Common Files\Wise Installation Wizard
2007-07-22 21:07:55 ——– d—–w C:\Program Files\Movie Maker
2007-07-22 21:07:31 ——– d—–w C:\Program Files\Windows NT
2007-07-22 19:58:01 ——– d—–w C:\Program Files\Microsoft AntiSpyware
2007-07-22 05:14:57 ——– d—–w C:\Program Files\Online Services
2007-07-21 18:52:18 ——– d—–w C:\Program Files\Common Files\Symantec Shared
2007-07-21 04:49:35 29,696 –sha-w C:\WINDOWS\system32\drivers\Thumbs.db
2007-07-17 15:28:04 ——– d—–w C:\Program Files\Yahoo!
2007-07-17 01:45:28 ——– d—–w C:\Program Files\Hewlett-Packard
2007-07-16 04:11:48 ——– d—–w C:\Program Files\Common Files\RuleSpace
2007-07-16 03:41:35 ——– d—–w C:\Program Files\Common Files\Authentium Shared
2007-07-16 01:25:29 ——– d—–w C:\Program Files\MSN Gaming Zone
2007-07-13 07:26:28 ——– d—–w C:\Program Files\LimeWire
2007-06-16 04:18:43 ——– d—–w C:\Program Files\Google
2007-06-14 19:11:57 ——– d—–w C:\Program Files\Common Files\InstallShield
2007-06-13 20:08:59 ——– d-sh–w C:\Program Files\outlook
2007-06-12 21:55:47 376 —-a-w C:\WINDOWS\mozregistry.dat
2007-06-12 17:42:26 ——– d—–w C:\Program Files\Common Files\Command Software
2007-06-08 04:48:53 ——– d–h–w C:\Program Files\InstallShield Installation Information
2007-06-08 04:28:47 ——– d—–w C:\Program Files\Sony
2007-06-04 20:18:48 9,344 —-a-w C:\WINDOWS\system32\drivers\NSDriver.sys
2007-06-04 20:17:02 8,320 —-a-w C:\WINDOWS\system32\drivers\AWRTRD.sys
2007-06-04 20:14:56 6,272 —-a-w C:\WINDOWS\system32\drivers\AWRTPD.sys
2007-05-28 16:40:30 ——– d—–w C:\Program Files\iTunes
2007-05-28 16:40:07 ——– d—–w C:\Program Files\iPod
2007-05-28 16:38:49 ——– d—–w C:\Program Files\QuickTime
2007-05-28 16:36:52 ——– d—–w C:\Program Files\Apple Software Update
2007-05-27 19:12:06 ——– d–h–w C:\Program Files\WindowsUpdate
2007-05-27 19:11:00 ——– d—–w C:\Program Files\Common Files\PestPatrol
2007-05-26 03:50:45 ——– d—–w C:\Program Files\MSXML 4.0
2004-08-16 14:00:00 2,994,176 —-a-w C:\Program Files\Paint Shop Pro 9.exe
1998-12-09 02:53:54 99,840 -c–a-w C:\Program Files\Common Files\IRAABOUT.DLL
1998-12-09 02:53:54 70,144 -c–a-w C:\Program Files\Common Files\IRAMDMTR.DLL
1998-12-09 02:53:54 48,640 -c–a-w C:\Program Files\Common Files\IRALPTTR.DLL
1998-12-09 02:53:54 31,744 -c–a-w C:\Program Files\Common Files\IRAWEBTR.DLL
1998-12-09 02:53:54 186,368 -c–a-w C:\Program Files\Common Files\IRAREG.DLL
1998-12-09 02:53:54 17,920 -c–a-w C:\Program Files\Common Files\IRASRIAL.DLL


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]
2007-05-30 16:18 808472 –a—— C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
2006-10-22 23:08 62080 –a—— C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
2005-05-31 01:04 853672 –a—— C:\PROGRA~1\SPYBOT~1\SDHelper.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
2007-03-14 03:43 501400 –a—— C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
2007-06-15 23:18 2403392 -ra—— c:\program files\google\googletoolbar3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-03-14 22:10]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\aawservice]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
path=C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk
backup=C:\WINDOWS\pss\Adobe Reader Synchronizer.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Cleanup]
C:\Documents and Settings\Linda.DAVID-5DYLJRM82.000\Application Data\CCleanup\compind.bat

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\icq.com]
rundll32.exe "C:\WINDOWS\System32\gncuopap.dll",forkonce

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
"C:\Program Files\iTunes\iTunesHelper.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"C:\Program Files\Messenger\msmsgs.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\poolsv]
"C:\WINDOWS\poolsv.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Salestart]
"C:\Program Files\Common Files\WinAntiSpyware 2007\WAS7Mon.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
"C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\svhost]
"C:\WINDOWS\svhost.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Tbcw]
"C:\DOCUME~1\LINDAD~1.000\APPLIC~1\RACLE~1\mshta.exe" -vt yazb

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yqmkyhdq]
"C:\Documents and Settings\Linda.DAVID-5DYLJRM82.000\Application Data\??curity\dvdplay.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\YSearchProtection]
C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"Messenger"=2 (0x2)
"iPod Service"=3 (0x3)
"DomainService"=2 (0x2)
"comHost"=3 (0x3)

*Newly Created Service* - AD-WATCH_CONNECT_FILTER
*Newly Created Service* - AD-WATCH_REGISTRY_FILTER
*Newly Created Service* - ALG
*Newly Created Service* - DCOMLAUNCH
*Newly Created Service* - FLTMGR
*Newly Created Service* - HTTP
*Newly Created Service* - IPNAT
*Newly Created Service* - SLWDMSUP
*Newly Created Service* - WSCSVC

Contents of the 'Scheduled Tasks' folder
2007-07-13 16:47:00 C:\WINDOWS\tasks\AppleSoftwareUpdate.job
2007-07-16 22:10:16 C:\WINDOWS\tasks\WebReg psc C3100 series.job

**************************************************************************

catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-22 22:21:01
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

**************************************************************************

Completion time: 2007-07-22 22:22:41
C:\ComboFix-quarantined-files.txt … 2007-07-22 22:22
C:\ComboFix2.txt … 2007-07-22 17:21
C:\ComboFix3.txt … 2007-07-22 15:21

— E O F —