Spyware / Malware / Virus Removal

[Resolved]Winantivirus.com Pop-up/ Lock-ups

14 min read

Looking for the outcome? Ask AI

ameritrash73 Topic Starter

Post #1July 25, 2007, 9:02 PM UTC last edited July 25, 2007, 11:05 PM UTC

I've gone thru all the steps on the malware self help post. I've also tried VundoFix among others. No matter what I use to remove the problems, they quickly come back. Here's my HijackThis log file:

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 3:59:01 PM, on 7/25/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
D:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
i:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\rundll32.exe
D:\Program Files\Adobe\Photoshop Elements 5.0\apdproxy.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
F:\Program Files\Ideazon\ZEngine\Zboard.exe
C:\WINDOWS\System32\svchost.exe
D:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe
C:\Program Files\palmOne\Hotsync.exe
C:\Program Files\NYKO\Gamepad Mapping Tools\ngpmap.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Danny\Desktop\HiJackThis_v2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: MSEvents Object - {2FE91693-52D9-4199-8BEE-627EB0A3D3A3} - C:\WINDOWS\system32\mllml.dll (file missing)
O2 - BHO: MorpheusToolbar BHO - {3F3714A1-89A4-46be-8AF3-D0C9D1FB03F9} - C:\Program Files\MorpheusBar\bar\1.bin\MORPHBAR.DLL
O2 - BHO: MSEvents Object - {44CA2BC3-2204-411D-955E-F9C9483D32F8} - C:\WINDOWS\system32\mljji.dll (file missing)
O2 - BHO: (no name) - {48E5DF1C-66A4-400A-B5F1-464E681319D9} - C:\WINDOWS\system32\pmkhh.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: MSEvents Object - {8274955B-A1F3-4C99-819D-FDA49997ECDA} - C:\WINDOWS\system32\mljji.dll (file missing)
O2 - BHO: (no name) - {938A8A03-A938-4019-B764-03FF8D167D79} - C:\WINDOWS\system32\yliasduc.dll
O2 - BHO: BndDrive BHO Class - {9815DA81-2E0C-478c-90E4-06E474E704D0} - C:\Program Files\ISM\BndDrive.dll
O2 - BHO: MSEvents Object - {DCD53738-C4F9-414A-A03C-C7405A4AC844} - C:\WINDOWS\system32\ddcdcab.dll (file missing)
O3 - Toolbar: Morpheus Toolbar - {3F3714A9-89A4-46be-8AF3-D0C9D1FB03F9} - C:\Program Files\MorpheusBar\bar\1.bin\MORPHBAR.DLL
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [Adobe Photo Downloader] "D:\Program Files\Adobe\Photoshop Elements 5.0\apdproxy.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Zboard] F:\Program Files\Ideazon\ZEngine\Zboard.exe
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [MemoryManager] rundll32.exe "C:\WINDOWS\system32\cdegdgxb.dll",forkonce
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe"
O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe /S
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit (User 'Default user')
O4 - Startup: NYKO Gamepad Mapping Tools.lnk = C:\Program Files\NYKO\Gamepad Mapping Tools\ngpmap.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HotSync Manager.lnk = C:\Program Files\palmOne\Hotsync.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Absolute Poker Basic - {5E72AD5A-20DF-4ca4-9B7B-D9717FFDE0C5} - C:\Documents and Settings\Danny\Start Menu\Programs\Absolute Poker Basic\Absolute Poker Basic.lnk
O9 - Extra 'Tools' menuitem: Absolute Poker Basic - {5E72AD5A-20DF-4ca4-9B7B-D9717FFDE0C5} - C:\Documents and Settings\Danny\Start Menu\Programs\Absolute Poker Basic\Absolute Poker Basic.lnk
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: UltimateBet - {94148DB5-B42D-4915-95DA-2CBB4F7095BF} - E:\Program Files\UltimateBet\UltimateBet.exe
O9 - Extra 'Tools' menuitem: UltimateBet - {94148DB5-B42D-4915-95DA-2CBB4F7095BF} - E:\Program Files\UltimateBet\UltimateBet.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15030/CTSUEng.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www.ca.com/us/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {B030900C-746A-47BF-8B1D-EA3FB3395563} (CoxFastConnect20 Control) - https://fastconnect.cox.net/cd20/CoxFastConnect20.ocx
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/5m/vir…l/installer.exe
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15030/CTPID.cab
O20 - Winlogon Notify: ddcdcab - ddcdcab.dll (file missing)
O20 - Winlogon Notify: mljji - C:\WINDOWS\system32\mljji.dll (file missing)
O20 - Winlogon Notify: mllml - C:\WINDOWS\system32\mllml.dll (file missing)
O20 - Winlogon Notify: pmkhh - C:\WINDOWS\system32\pmkhh.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Adobe Active File Monitor V5 (AdobeActiveFileMonitor5.0) - Unknown owner - D:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - i:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: .NET Runtime Optimization Service v2.0.50727_X86 (clr_optimization_v2.0.50727_32) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

–
End of file - 9730 bytes

Moved you over to the Malware Removal Forum.
See ya back here in OCP, if you have additional concerns after getting clean from any Malware.
Best Regards,
Doug

Trevuren

Post #2July 25, 2007, 11:47 PM UTC

Hello ameritrash73 and welcome to the TomCoyote Forums

My name is Trevuren and I will be helping you with your problem.

You have a new infection on your machine. An analyst by the name of Tony Klein will drop by and provide you with specific instructions regarding submitting some files for analysis. Once he has the files, I will help you clean up your machine.

Regards,

Trevuren

Trevuren

Post #3July 29, 2007, 8:29 PM UTC

I am extremely sorry that this has taken so long. The expert that I was referring to was away and did not receive my message until about 15 minutes ago. I would not have waited this long to help you but this information is o important.

* First, I need you to check the following folder and to tell me how many files it contains: C:\Program Files\ISM

* Second, if there are more than 10 files, I need you to tell me if you have a program that can Zip files and if you know how to use it.

Thanks for your cooperation, it is much appreciated

Trevuren

ameritrash73

Post #4July 30, 2007, 10:26 PM UTC

There are seven files.

Trevuren

Post #5July 30, 2007, 11:32 PM UTC last edited July 30, 2007, 11:36 PM UTC

Good!!

1. Please zip up all the files that are in that folder and call the zipped file. ISM.zip

2. Now please go to this forum

3. There's no need to register. Just start a new topic, titled "File for TonyKlein".

4. In the topic, simply refer to this TC forum thread (http://forums.tomcoyote.org/Winantivirus_com_Pop_up_Lock_ups_t81643.html&gopid=390817#entry390817) and use the Attachment box to upload the zipped file.

5. When you have finished posting, please copy the url (link) to the topic that you just opened on that forum and return to your topic here and paste the link in your reply.

6. You will be notified when they have received the files.

Regards and thank you for helping us help you,

Trevuren

ameritrash73

Post #6July 31, 2007, 8:29 PM UTC

Got it. Here's the link: http://www.thespykiller.co.uk/index.php?topic=4653.0

Trevuren

Post #7July 31, 2007, 10:42 PM UTC

First of all I would like to thank for having been so patient. Thanks to your patience, this infection is now in our databases and the Antivirus companies are starting to pick it up. Thanks again.

A. Please download VundoFix.exe to your desktop.

Double-click VundoFix.exe to run it.
Click the Scan for Vundo button.
Once it's done scanning, click the Remove Vundo button.
You will receive a prompt asking if you want to remove the files, click YES
Once you click yes, your desktop will go blank as it starts removing Vundo.
When completed, it will prompt that it will reboot your computer, click OK.
Please post the contents of C:\vundofix.txt.

Note: It is possible that VundoFix encountered a file it could not remove.
In this case, VundoFix will run on reboot, simply follow the above instructions starting from "Click the Scan for Vundo button." when VundoFix appears at reboot.

B. Download ComboFix from Here to your Desktop.

Double click combofix.exe and follow the prompts.
When finished, it shall produce a log for you. Post that log and a HiJackthis log in your next reply

Note: Do not mouseclick combofix's window while its running. That may cause it to stall

C. Reports/Logs to post:

VundoFix.txt
ComboFix.txt
HijackThis log

ameritrash73

Post #8August 1, 2007, 12:30 AM UTC

VundoFix V6.5.6

Checking Java version…

Java version is 1.5.0.10

Java version is 1.5.0.11

Scan started at 10:50:15 AM 7/24/2007

Listing files found while scanning….

C:\windows\system32\evraniro.dll
C:\WINDOWS\system32\ijjlm.bak1
C:\WINDOWS\system32\ijjlm.bak2
C:\WINDOWS\system32\ijjlm.ini
C:\WINDOWS\system32\mljji.dll
C:\WINDOWS\system32\pmkhh.dll

Beginning removal…

Attempting to delete C:\windows\system32\evraniro.dll
C:\windows\system32\evraniro.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\ijjlm.bak1
C:\WINDOWS\system32\ijjlm.bak1 Has been deleted!

Attempting to delete C:\WINDOWS\system32\ijjlm.bak2
C:\WINDOWS\system32\ijjlm.bak2 Has been deleted!

Attempting to delete C:\WINDOWS\system32\ijjlm.ini
C:\WINDOWS\system32\ijjlm.ini Has been deleted!

Attempting to delete C:\WINDOWS\system32\pmkhh.dll
C:\WINDOWS\system32\pmkhh.dll Could not be deleted.

Performing Repairs to the registry.
Done!

VundoFix V6.5.6

Checking Java version…

Java version is 1.5.0.10

Java version is 1.5.0.11

Scan started at 11:04:39 AM 7/24/2007

Listing files found while scanning….

C:\WINDOWS\system32\mljji.dll

Beginning removal…

Performing Repairs to the registry.
Done!

VundoFix V6.5.6

Checking Java version…

Java version is 1.5.0.10

Java version is 1.5.0.11

Scan started at 11:33:53 AM 7/24/2007

Listing files found while scanning….

C:\WINDOWS\system32\lmllm.bak1
C:\WINDOWS\system32\lmllm.ini
C:\WINDOWS\system32\mljji.dll
C:\WINDOWS\system32\mllml.dll

Beginning removal…

Attempting to delete C:\WINDOWS\system32\lmllm.bak1
C:\WINDOWS\system32\lmllm.bak1 Has been deleted!

Attempting to delete C:\WINDOWS\system32\lmllm.ini
C:\WINDOWS\system32\lmllm.ini Has been deleted!

Performing Repairs to the registry.
Done!

VundoFix V6.5.6

Checking Java version…

Java version is 1.5.0.10

Java version is 1.5.0.11

Scan started at 4:50:03 AM 7/27/2007

Listing files found while scanning….

C:\WINDOWS\system32\mljji.dll
C:\WINDOWS\system32\mllml.dll
C:\WINDOWS\system32\pmkhh.dll

Beginning removal…

Performing Repairs to the registry.
Done!

VundoFix V6.5.6

Checking Java version…

Java version is 1.5.0.10

Java version is 1.5.0.11

Scan started at 5:14:59 AM 7/28/2007

Listing files found while scanning….

C:\WINDOWS\system32\mljji.dll
C:\WINDOWS\system32\mllml.dll
C:\WINDOWS\system32\pmkhh.dll

Beginning removal…

Performing Repairs to the registry.
Done!

VundoFix V6.5.6

Checking Java version…

Java version is 1.5.0.10

Java version is 1.5.0.11

Scan started at 6:09:22 PM 7/31/2007

Listing files found while scanning….

C:\WINDOWS\system32\mljji.dll
C:\WINDOWS\system32\mllml.dll
C:\WINDOWS\system32\pmkhh.dll

Beginning removal…

Performing Repairs to the registry.
Done!

VundoFix V6.5.6

Checking Java version…

Java version is 1.5.0.10

Java version is 1.5.0.11

Scan started at 6:39:37 PM 7/31/2007

Listing files found while scanning….

C:\WINDOWS\system32\mljji.dll
C:\WINDOWS\system32\mllml.dll
C:\WINDOWS\system32\pmkhh.dll

Beginning removal…

Performing Repairs to the registry.
Done!

#####################################################

ComboFix 07-07-27.6 - "Danny" 2007-07-31 18:24:45.2 [GMT -5:00] - NTFS
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.True

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

C:\Program Files\Common Files\Yazzle1281OinUninstaller.exe
C:\WINDOWS\system32\b02FdUe

((((((((((((((((((((((((( Files Created from 2007-06-28 to 2007-07-31 )))))))))))))))))))))))))))))))

2007-07-30 19:44 d——– C:\DOCUME~1\Aerin\APPLIC~1\Media Player Classic
2007-07-29 15:40 d——– C:\Program Files\Realtek AC97
2007-07-29 15:39 d——– C:\Program Files\Common Files\ArcSoft
2007-07-29 06:11 d——– C:\Program Files\Realtek AC97(2)
2007-07-28 04:26 15,900,672 –a—— C:\DOCUME~1\Danny\ntuser.dat
2007-07-28 04:24 245,408 –a—— C:\WINDOWS\system32\unicows.dll
2007-07-28 04:24 1,645,320 –a—— C:\WINDOWS\system32\gdiplus.dll
2007-07-28 04:24 d——– C:\Program Files\SanDisk
2007-07-25 10:00 126,016 –a—— C:\WINDOWS\system32\cdegdgxb.dll
2007-07-24 23:19 d——– C:\Program Files\Windows Media Connect 2
2007-07-24 23:16 d——– C:\WINDOWS\system32\drivers\UMDF
2007-07-24 11:17 228,960 –a—— C:\WINDOWS\system32\mllml.dll.vir
2007-07-24 10:50 d——– C:\VundoFix Backups
2007-07-24 09:54 126,016 –a—— C:\WINDOWS\system32\ulqecqsj.dll
2007-07-23 15:33 d——– C:\Program Files\Enigma Software Group
2007-07-22 17:54 d——– C:\Program Files\SpywareBlaster
2007-07-22 04:01 d——– C:\Program Files\Common Files\Download Manager
2007-07-21 17:02 d——– C:\Downloads
2007-07-21 17:02 d——– C:\DOCUME~1\Danny\APPLIC~1\GetRightToGo
2007-07-21 16:19 d——– C:\!KillBox
2007-07-20 04:29 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-07-20 03:27 d——– C:\DOCUME~1\Danny\APPLIC~1\Uniblue
2007-07-18 20:59 d——– C:\Temp\brr
2007-07-18 20:59 d——– C:\Temp
2007-07-18 16:15 d——– C:\Program Files\iTunes
2007-07-18 16:15 d——– C:\Program Files\iPod
2007-07-18 15:59 d—-c— C:\WINDOWS\system32\DRVSTORE
2007-07-18 15:59 d——– C:\Program Files\Common Files\Apple
2007-07-17 22:28 d——– C:\Program Files\Virtools
2007-07-15 21:17 369 –a—— C:\WINDOWS\ereg077.dat
2007-07-15 21:17 d——– C:\WINDOWS\BBSTORE
2007-07-15 15:33 d——– C:\Program Files\ISM
2007-07-14 23:51 d——– C:\DOCUME~1\Shyla\WINDOWS
2007-07-14 14:25 d——– C:\Program Files\Atari
2007-07-13 21:35 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\QuickTime
2007-07-13 21:33 d——– C:\DOCUME~1\Shyla\APPLIC~1\InstallShield
2007-07-12 22:26 d——– C:\Program Files\Apple Software Update
2007-07-12 22:26 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple
2007-07-11 03:11 d——– C:\DOCUME~1\Aerin\APPLIC~1\dvdcss
2007-07-10 05:08 d——– C:\DOCUME~1\Danny\APPLIC~1\Creative
2007-07-09 18:33 41,984 ——— C:\WINDOWS\Ctregrun.exe
2007-07-09 18:32 d——– C:\Program Files\Audible
2007-07-09 18:30 221,184 –a—— C:\WINDOWS\system32\wmpns.dll
2007-07-09 18:27 d——– C:\Program Files\Creative
2007-07-07 04:12 d——– C:\DOCUME~1\Danny\APPLIC~1\GameHouse
2007-06-29 00:43 37,376 –a—— C:\WINDOWS\system32\nvcod(2).dll
2007-06-29 00:43 1,018,772 –a—— C:\WINDOWS\system32\nvucode.bin
2007-06-23 22:33 d——– C:\DOCUME~1\Aerin\APPLIC~1\Chicken Chase
2007-06-23 16:17 d——– C:\DOCUME~1\Aerin\APPLIC~1\Leadertech
2007-06-22 15:30 d——– C:\DOCUME~1\Shyla\APPLIC~1\Scholastic
2007-06-22 03:43 d——– C:\DOCUME~1\Aerin\APPLIC~1\Sandlot Games
2007-06-13 15:28 d——– C:\Program Files\support.com
2007-06-13 15:28 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Support.com
2007-06-12 04:12 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\NVIDIA
2007-06-09 18:53 d——– C:\hegames
2007-06-06 00:52 d——– C:\DOCUME~1\Danny\APPLIC~1\Oxin's Style!
2007-06-06 00:51 d——– C:\Program Files\thriXXX
2007-06-04 19:32 d——– C:\DOCUME~1\Shyla\APPLIC~1\vlc
2007-06-04 19:32 d——– C:\DOCUME~1\Shyla\APPLIC~1\dvdcss
2007-06-04 19:30 d——– C:\DOCUME~1\Shyla\APPLIC~1\Media Player Classic
2007-06-04 19:30 d——– C:\DOCUME~1\Shyla\APPLIC~1\Ideazon

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-07-31 18:08 ——— d——– C:\Program Files\Morpheus
2007-07-29 15:40 ——— d——– C:\DOCUME~1\Danny\APPLIC~1\Arcsoft
2007-07-29 15:39 ——— d——– C:\DOCUME~1\Danny\APPLIC~1\dvdcss
2007-07-28 04:24 ——— d–h—– C:\Program Files\InstallShield Installation Information
2007-07-22 15:29 ——— d——– C:\DOCUME~1\Danny\APPLIC~1\Symantec
2007-07-19 05:23 ——— d——– C:\Program Files\nbpro
2007-07-15 10:51 ——— d——– C:\Program Files\Big Kahuna Reef 2
2007-07-14 15:25 ——— d——– C:\Program Files\Fish Tycoon
2007-07-13 21:34 ——— d——– C:\Program Files\Disney Interactive
2007-06-30 01:46 ——— d——– C:\Program Files\Yahoo! Games
2007-06-28 04:28 30 –a—— C:\WINDOWS\popcinfo.dat
2007-06-23 16:16 ——— d——– C:\Program Files\InSpheration
2007-06-23 16:13 ——— d——– C:\Program Files\Feeding Frenzy 2
2007-06-23 16:13 ——— d——– C:\Program Files\Fatman Adventures
2007-06-23 16:13 ——— d——– C:\Program Files\Electra
2007-06-23 16:11 ——— d——– C:\Program Files\Chainz 2
2007-06-23 16:10 ——— d——– C:\Program Files\Elythril The Elf Treasure
2007-06-23 16:10 ——— d——– C:\Program Files\Charm Tale
2007-06-23 16:09 ——— d——– C:\Program Files\Aqua Pearls
2007-06-23 16:08 ——— d——– C:\Program Files\Gold Sprinter
2007-06-23 16:07 ——— d——– C:\Program Files\Charm Solitaire
2007-06-23 16:06 ——— d——– C:\Program Files\Deep Sea Adventures
2007-06-19 15:14 ——— d——– C:\Program Files\Symantec
2007-06-19 15:14 ——— d——– C:\Program Files\Common Files\Symantec Shared
2007-06-19 15:09 ——— d——– C:\Program Files\Norton AntiVirus
2007-06-07 18:13 ——— d——– C:\DOCUME~1\Danny\APPLIC~1\Zylom
2007-06-07 18:03 ——— d——– C:\Program Files\Zylom Games
2007-06-02 19:32 ——— d——– C:\Program Files\palmOne
2007-05-15 06:51 43520 –a—— C:\WINDOWS\system32\CmdLineExt03.dll
2006-12-14 05:57 836783 –a—— C:\Program Files\7z442.exe

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{015A267B-1A84-4339-8190-A93880373586}]
C:\WINDOWS\system32\pmkhh.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2FE91693-52D9-4199-8BEE-627EB0A3D3A3}]
C:\WINDOWS\system32\mllml.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{44CA2BC3-2204-411D-955E-F9C9483D32F8}]
C:\WINDOWS\system32\mljji.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{48E5DF1C-66A4-400A-B5F1-464E681319D9}]
C:\WINDOWS\system32\pmkhh.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8274955B-A1F3-4C99-819D-FDA49997ECDA}]
C:\WINDOWS\system32\mljji.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9815DA81-2E0C-478c-90E4-06E474E704D0}]
2007-07-11 15:02 192512 –a—— C:\Program Files\ISM\BndDrive.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2006-03-01 16:22 C:\WINDOWS\soundman.exe]
"nwiz"="nwiz.exe" [2006-10-22 12:22 C:\WINDOWS\system32\nwiz.exe]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-04 02:56 C:\WINDOWS\system32\bthprops.cpl]
"Adobe Photo Downloader"="D:\Program Files\Adobe\Photoshop Elements 5.0\apdproxy.exe" [2006-09-14 08:55]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" [2007-04-22 10:22]
"Zboard"="F:\Program Files\Ideazon\ZEngine\Zboard.exe" [2007-04-03 19:46]
"QuickTime Task"="D:\Program Files\QuickTime\QTTask.exe" [2007-06-29 06:24]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-07-10 09:18]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PopUpStopperFreeEdition"="C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe" [2005-03-17 11:10]
"Uniblue RegistryBooster 2"="C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe" []
"ISMModule"="C:\Program Files\ISM\ISMModule.exe" [2007-08-27 16:09]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"NvMediaCenter"=RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
"ALUAlert"=C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe

C:\Documents and Settings\Danny\Start Menu\Programs\Startup\
NYKO Gamepad Mapping Tools.lnk - C:\Program Files\NYKO\Gamepad Mapping Tools\ngpmap.exe [2006-10-14 03:53:26]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26]
HotSync Manager.lnk - C:\Program Files\palmOne\Hotsync.exe [2004-06-09 14:16:08]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{93994DE8-8239-4655-B1D1-5F4E91300429}"= d:\PROGRA~1\DVDREG~1\DVDShell.dll [2004-10-09 16:18 49152]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ddcdcab]
ddcdcab.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\mljji]
C:\WINDOWS\system32\mljji.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\mllml]
C:\WINDOWS\system32\mllml.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\pmkhh]
C:\WINDOWS\system32\pmkhh.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AVG Anti-Spyware Driver]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AVG Anti-Spyware Guard]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]

R0 imagedrv;imagedrv;C:\WINDOWS\system32\Drivers\imagedrv.sys
R0 imagesrv;imagesrv;C:\WINDOWS\system32\DRIVERS\imagesrv.sys
R0 SI3112r;Silicon Image SiI 3112 SATARaid Controller;C:\WINDOWS\system32\DRIVERS\SI3112r.sys
R0 SiFilter;SATALink driver accelerator;C:\WINDOWS\system32\DRIVERS\SiWinAcc.sys
R2 BthServ;Bluetooth Support Service;C:\WINDOWS\system32\svchost.exe -k bthsvcs
R2 hardlock;hardlock;\??\C:\WINDOWS\system32\drivers\hardlock.sys
R2 Haspnt;Haspnt;\??\C:\WINDOWS\system32\drivers\Haspnt.sys
R2 MaVctrl;MaVctrl;C:\WINDOWS\system32\DRIVERS\MaVc2K.sys
R2 SVKP;SVKP;\??\C:\WINDOWS\system32\SVKP.sys
R3 Afc;PPdus ASPI Shell;C:\WINDOWS\system32\drivers\Afc.sys
R3 Alpham1;Ideazon ZBoard USB Human Interface Device;C:\WINDOWS\system32\DRIVERS\Alpham1.sys
R3 Alpham2;Ideazon ZBoard MM USB Human Interface Device;C:\WINDOWS\system32\DRIVERS\Alpham2.sys
R3 ASAPIW2k;ASAPIW2K;C:\WINDOWS\system32\drivers\ASAPIW2k.sys
R3 Ma730Pt;MA730 Bluetooth VCOM Driver;C:\WINDOWS\system32\DRIVERS\Ma730Pt.sys
R3 Ma730Vad;MA730 Bluetooth Audio;C:\WINDOWS\system32\DRIVERS\Ma730Vad.sys
R3 Pcouffin;Low level access layer for CD devices;C:\WINDOWS\system32\Drivers\Pcouffin.sys
R3 ROOTMODEM;Microsoft Legacy Modem Driver;C:\WINDOWS\system32\Drivers\RootMdm.sys
R3 usbbus;LGE CDMA Composite USB Device;C:\WINDOWS\system32\DRIVERS\lgusbbus.sys
R3 UsbDiag;LGE CDMA USB Serial Port;C:\WINDOWS\system32\DRIVERS\lgusbdiag.sys
R3 USBModem;LGE CDMA USB Modem;C:\WINDOWS\system32\DRIVERS\lgusbmodem.sys
R3 vaxscsi;vaxscsi;C:\WINDOWS\system32\Drivers\vaxscsi.sys
S2 windev-ad3-30cc;windev-ad3-30cc;\??\C:\WINDOWS\system32\windev-ad3-30cc.sys
S3 61883;61883 Unit Device;C:\WINDOWS\system32\DRIVERS\61883.sys
S3 Alpham;Ideazon ZBoard Composite Keyboard Driver;C:\WINDOWS\system32\DRIVERS\Alpham.sys
S3 Amsmpu4p;Amsmpu4p;\??\C:\DOCUME~1\Danny\LOCALS~1\Temp\Amsmpu4p.sys
S3 Avc;AVC Device;C:\WINDOWS\system32\DRIVERS\avc.sys
S3 BthEnum;Bluetooth Request Block Driver;C:\WINDOWS\system32\DRIVERS\BthEnum.sys
S3 BTHMODEM;Bluetooth Serial Communications Driver;C:\WINDOWS\system32\DRIVERS\bthmodem.sys
S3 BthPan;Bluetooth Device (Personal Area Network);C:\WINDOWS\system32\DRIVERS\bthpan.sys
S3 BTHPORT;Bluetooth Port Driver;C:\WINDOWS\system32\Drivers\BTHport.sys
S3 BTHUSB;Bluetooth Radio USB Driver;C:\WINDOWS\system32\Drivers\BTHUSB.sys
S3 mam4410c;mam4410c;C:\WINDOWS\system32\Drivers\mam4410c.sys
S3 mam4410m;mam4410m;C:\WINDOWS\system32\Drivers\mam4410m.sys
S3 mam4410u;mam4410u;C:\WINDOWS\system32\Drivers\mam4410u.sys
S3 MarvinBus;Pinnacle Marvin Bus;C:\WINDOWS\system32\DRIVERS\MarvinBus.sys
S3 MSDV;Microsoft DV Camera and VCR;C:\WINDOWS\system32\DRIVERS\msdv.sys
S3 PalmUSBD;PalmUSBD;C:\WINDOWS\system32\drivers\PalmUSBD.sys
S3 RFCOMM;Bluetooth Device (RFCOMM Protocol TDI);C:\WINDOWS\system32\DRIVERS\rfcomm.sys

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs BthServ

Contents of the 'Scheduled Tasks' folder
2007-07-26 14:21:09 C:\WINDOWS\tasks\AppleSoftwareUpdate.job
2007-07-31 23:23:22 C:\WINDOWS\tasks\Symantec NetDetect.job

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-31 18:28:42
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden registry entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-07-31 18:29:39
C:\ComboFix-quarantined-files.txt … 2007-07-31 18:29
C:\ComboFix2.txt … 2007-07-27 04:41
C:\ComboFix3.txt … 2007-07-20 04:52

— E O F —

#######################################

Logfile of HijackThis v1.99.1
Scan saved at 7:22:43 PM, on 7/31/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
D:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
i:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\rundll32.exe
D:\Program Files\Adobe\Photoshop Elements 5.0\apdproxy.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
F:\Program Files\Ideazon\ZEngine\Zboard.exe
D:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe
C:\Program Files\ISM\ISMModule.exe
C:\Program Files\palmOne\Hotsync.exe
C:\Program Files\NYKO\Gamepad Mapping Tools\ngpmap.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Danny\Local Settings\Temporary Internet Files\Content.IE5\PBYAMRQ1\HijackThis[1].exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
O2 - BHO: (no name) - {015A267B-1A84-4339-8190-A93880373586} - C:\WINDOWS\system32\pmkhh.dll (file missing)
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: MSEvents Object - {2FE91693-52D9-4199-8BEE-627EB0A3D3A3} - C:\WINDOWS\system32\mllml.dll (file missing)
O2 - BHO: MorpheusToolbar BHO - {3F3714A1-89A4-46be-8AF3-D0C9D1FB03F9} - C:\Program Files\MorpheusBar\bar\1.bin\MORPHBAR.DLL
O2 - BHO: MSEvents Object - {44CA2BC3-2204-411D-955E-F9C9483D32F8} - C:\WINDOWS\system32\mljji.dll (file missing)
O2 - BHO: (no name) - {48E5DF1C-66A4-400A-B5F1-464E681319D9} - C:\WINDOWS\system32\pmkhh.dll (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: MSEvents Object - {8274955B-A1F3-4C99-819D-FDA49997ECDA} - C:\WINDOWS\system32\mljji.dll (file missing)
O2 - BHO: BndDrive BHO Class - {9815DA81-2E0C-478c-90E4-06E474E704D0} - C:\Program Files\ISM\BndDrive.dll
O3 - Toolbar: Morpheus Toolbar - {3F3714A9-89A4-46be-8AF3-D0C9D1FB03F9} - C:\Program Files\MorpheusBar\bar\1.bin\MORPHBAR.DLL
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [Adobe Photo Downloader] "D:\Program Files\Adobe\Photoshop Elements 5.0\apdproxy.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Zboard] F:\Program Files\Ideazon\ZEngine\Zboard.exe
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe"
O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe /S
O4 - HKCU\..\Run: [ISMModule] "C:\Program Files\ISM\ISMModule.exe"
O4 - Startup: NYKO Gamepad Mapping Tools.lnk = C:\Program Files\NYKO\Gamepad Mapping Tools\ngpmap.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HotSync Manager.lnk = C:\Program Files\palmOne\Hotsync.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Absolute Poker Basic - {5E72AD5A-20DF-4ca4-9B7B-D9717FFDE0C5} - C:\Documents and Settings\Danny\Start Menu\Programs\Absolute Poker Basic\Absolute Poker Basic.lnk
O9 - Extra 'Tools' menuitem: Absolute Poker Basic - {5E72AD5A-20DF-4ca4-9B7B-D9717FFDE0C5} - C:\Documents and Settings\Danny\Start Menu\Programs\Absolute Poker Basic\Absolute Poker Basic.lnk
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: UltimateBet - {94148DB5-B42D-4915-95DA-2CBB4F7095BF} - E:\Program Files\UltimateBet\UltimateBet.exe
O9 - Extra 'Tools' menuitem: UltimateBet - {94148DB5-B42D-4915-95DA-2CBB4F7095BF} - E:\Program Files\UltimateBet\UltimateBet.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15030/CTSUEng.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www.ca.com/us/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {B030900C-746A-47BF-8B1D-EA3FB3395563} (CoxFastConnect20 Control) - https://fastconnect.cox.net/cd20/CoxFastConnect20.ocx
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/5m/vir…l/installer.exe
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15030/CTPID.cab
O20 - Winlogon Notify: ddcdcab - ddcdcab.dll (file missing)
O20 - Winlogon Notify: mljji - C:\WINDOWS\system32\mljji.dll (file missing)
O20 - Winlogon Notify: mllml - C:\WINDOWS\system32\mllml.dll (file missing)
O20 - Winlogon Notify: pmkhh - C:\WINDOWS\system32\pmkhh.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe Active File Monitor V5 (AdobeActiveFileMonitor5.0) - Unknown owner - D:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - i:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: .NET Runtime Optimization Service v2.0.50727_X86 (clr_optimization_v2.0.50727_32) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

##################################################

Voila…

Trevuren

Post #9August 1, 2007, 12:54 AM UTC

I need you to do a few things before we can continue with the cleanup. You moved HijackThis since the first post. It is now located in a location where the backups that it creates will probably be deleted by our tools thus removing any chance of recovery in case of error.

A. 1. Right click in an empty space on your desktop.

2. From the Menu, click New, then Folder and a folder will appear on your desktop.

3. Name the folder HJT

4. Move HijackThis .exe from its current location here: C:\Documents and Settings\Danny\Local Settings\Temporary Internet Files\Content.IE5\PBYAMRQ1\HijackThis[1].exe into the new Folder that was just created on your desktop.

B. Please provide a list of uninstallable programs.

To Provide a List of Installed Programs

Run HijackThis.
Click Config>>Miscellaneous Tools>>Open Uninstall Manager>>Save List
Save list to Desktop
Copy the Notepad list and Paste it into this thread.

C. Please download ATF Cleaner by Atribune.
This program is for XP and Windows 2000 onlyDouble-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.
If you use Firefox browserClick Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browserClick Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.
For Technical Support, double-click the e-mail address located at the bottom of each menu.

D. Now, please do the following in the order indicated:

Run ComboFix again and make sure that you can find the log because I need you to post the new log.
Run HijackThis, Scan, produce a log

E. The logs/reports to produce:

ComboFix.txt
List of Uninstallable Programs
HijackThis log

ameritrash73

Post #10August 1, 2007, 1:53 AM UTC

ATF is locking up on me. Any suggestions?

ameritrash73

Post #11August 1, 2007, 1:54 AM UTC

Never mind. Got it.

ameritrash73

Post #12August 1, 2007, 8:57 AM UTC

ComboFix 07-07-27.6 - "Danny" 2007-07-31 20:52:23.3 [GMT -5:00] - NTFS
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.True

((((((((((((((((((((((((( Files Created from 2007-07-01 to 2007-08-01 )))))))))))))))))))))))))))))))

2007-07-30 19:44 d——– C:\DOCUME~1\Aerin\APPLIC~1\Media Player Classic
2007-07-29 15:40 d——– C:\Program Files\Realtek AC97
2007-07-29 15:39 d——– C:\Program Files\Common Files\ArcSoft
2007-07-29 06:11 d——– C:\Program Files\Realtek AC97(2)
2007-07-28 04:26 15,900,672 –a—— C:\DOCUME~1\Danny\ntuser.dat
2007-07-28 04:24 245,408 –a—— C:\WINDOWS\system32\unicows.dll
2007-07-28 04:24 1,645,320 –a—— C:\WINDOWS\system32\gdiplus.dll
2007-07-28 04:24 d——– C:\Program Files\SanDisk
2007-07-25 10:00 126,016 –a—— C:\WINDOWS\system32\cdegdgxb.dll
2007-07-24 23:19 d——– C:\Program Files\Windows Media Connect 2
2007-07-24 23:16 d——– C:\WINDOWS\system32\drivers\UMDF
2007-07-24 11:17 228,960 –a—— C:\WINDOWS\system32\mllml.dll.vir
2007-07-24 10:50 d——– C:\VundoFix Backups
2007-07-24 09:54 126,016 –a—— C:\WINDOWS\system32\ulqecqsj.dll
2007-07-23 15:33 d——– C:\Program Files\Enigma Software Group
2007-07-22 17:54 d——– C:\Program Files\SpywareBlaster
2007-07-22 04:01 d——– C:\Program Files\Common Files\Download Manager
2007-07-21 17:02 d——– C:\Downloads
2007-07-21 17:02 d——– C:\DOCUME~1\Danny\APPLIC~1\GetRightToGo
2007-07-21 16:19 d——– C:\!KillBox
2007-07-20 04:29 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-07-20 03:27 d——– C:\DOCUME~1\Danny\APPLIC~1\Uniblue
2007-07-18 20:59 d——– C:\Temp\brr
2007-07-18 20:59 d——– C:\Temp
2007-07-18 16:15 d——– C:\Program Files\iTunes
2007-07-18 16:15 d——– C:\Program Files\iPod
2007-07-18 15:59 d—-c— C:\WINDOWS\system32\DRVSTORE
2007-07-18 15:59 d——– C:\Program Files\Common Files\Apple
2007-07-17 22:28 d——– C:\Program Files\Virtools
2007-07-15 21:17 369 –a—— C:\WINDOWS\ereg077.dat
2007-07-15 21:17 d——– C:\WINDOWS\BBSTORE
2007-07-15 15:33 d——– C:\Program Files\ISM
2007-07-14 23:51 d——– C:\DOCUME~1\Shyla\WINDOWS
2007-07-14 14:25 d——– C:\Program Files\Atari
2007-07-13 21:35 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\QuickTime
2007-07-13 21:33 d——– C:\DOCUME~1\Shyla\APPLIC~1\InstallShield
2007-07-12 22:26 d——– C:\Program Files\Apple Software Update
2007-07-12 22:26 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple
2007-07-11 03:11 d——– C:\DOCUME~1\Aerin\APPLIC~1\dvdcss
2007-07-10 05:08 d——– C:\DOCUME~1\Danny\APPLIC~1\Creative
2007-07-09 18:33 41,984 ——— C:\WINDOWS\Ctregrun.exe
2007-07-09 18:32 d——– C:\Program Files\Audible
2007-07-09 18:30 221,184 –a—— C:\WINDOWS\system32\wmpns.dll
2007-07-09 18:27 d——– C:\Program Files\Creative
2007-07-07 04:12 d——– C:\DOCUME~1\Danny\APPLIC~1\GameHouse

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-07-31 18:08 ——— d——– C:\Program Files\Morpheus
2007-07-29 15:40 ——— d——– C:\DOCUME~1\Danny\APPLIC~1\Arcsoft
2007-07-29 15:39 ——— d——– C:\DOCUME~1\Danny\APPLIC~1\dvdcss
2007-07-28 04:24 ——— d–h—– C:\Program Files\InstallShield Installation Information
2007-07-23 09:27 ——— d——– C:\Program Files\thriXXX
2007-07-22 15:29 ——— d——– C:\DOCUME~1\Danny\APPLIC~1\Symantec
2007-07-19 05:23 ——— d——– C:\Program Files\nbpro
2007-07-15 10:51 ——— d——– C:\Program Files\Big Kahuna Reef 2
2007-07-14 15:25 ——— d——– C:\Program Files\Fish Tycoon
2007-07-13 21:34 ——— d——– C:\Program Files\Disney Interactive
2007-06-30 01:46 ——— d——– C:\Program Files\Yahoo! Games
2007-06-29 00:43 37376 –a—— C:\WINDOWS\system32\nvcod(2).dll
2007-06-29 00:43 1018772 –a—— C:\WINDOWS\system32\nvucode.bin
2007-06-28 04:28 30 –a—— C:\WINDOWS\popcinfo.dat
2007-06-23 16:16 ——— d——– C:\Program Files\InSpheration
2007-06-23 16:13 ——— d——– C:\Program Files\Feeding Frenzy 2
2007-06-23 16:13 ——— d——– C:\Program Files\Fatman Adventures
2007-06-23 16:13 ——— d——– C:\Program Files\Electra
2007-06-23 16:11 ——— d——– C:\Program Files\Chainz 2
2007-06-23 16:10 ——— d——– C:\Program Files\Elythril The Elf Treasure
2007-06-23 16:10 ——— d——– C:\Program Files\Charm Tale
2007-06-23 16:09 ——— d——– C:\Program Files\Aqua Pearls
2007-06-23 16:08 ——— d——– C:\Program Files\Gold Sprinter
2007-06-23 16:07 ——— d——– C:\Program Files\Charm Solitaire
2007-06-23 16:06 ——— d——– C:\Program Files\Deep Sea Adventures
2007-06-21 19:25 ——— d——– C:\Program Files\support.com
2007-06-19 15:14 ——— d——– C:\Program Files\Symantec
2007-06-19 15:14 ——— d——– C:\Program Files\Common Files\Symantec Shared
2007-06-19 15:09 ——— d——– C:\Program Files\Norton AntiVirus
2007-06-07 18:13 ——— d——– C:\DOCUME~1\Danny\APPLIC~1\Zylom
2007-06-07 18:03 ——— d——– C:\Program Files\Zylom Games
2007-06-06 00:52 ——— d——– C:\DOCUME~1\Danny\APPLIC~1\Oxin's Style!
2007-06-02 19:32 ——— d——– C:\Program Files\palmOne
2007-05-15 06:51 43520 –a—— C:\WINDOWS\system32\CmdLineExt03.dll
2006-12-14 05:57 836783 –a—— C:\Program Files\7z442.exe

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{015A267B-1A84-4339-8190-A93880373586}]
C:\WINDOWS\system32\pmkhh.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2FE91693-52D9-4199-8BEE-627EB0A3D3A3}]
C:\WINDOWS\system32\mllml.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{44CA2BC3-2204-411D-955E-F9C9483D32F8}]
C:\WINDOWS\system32\mljji.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{48E5DF1C-66A4-400A-B5F1-464E681319D9}]
C:\WINDOWS\system32\pmkhh.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8274955B-A1F3-4C99-819D-FDA49997ECDA}]
C:\WINDOWS\system32\mljji.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9815DA81-2E0C-478c-90E4-06E474E704D0}]
2007-07-11 15:02 192512 –a—— C:\Program Files\ISM\BndDrive.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2006-03-01 16:22 C:\WINDOWS\soundman.exe]
"nwiz"="nwiz.exe" [2006-10-22 12:22 C:\WINDOWS\system32\nwiz.exe]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-04 02:56 C:\WINDOWS\system32\bthprops.cpl]
"Adobe Photo Downloader"="D:\Program Files\Adobe\Photoshop Elements 5.0\apdproxy.exe" [2006-09-14 08:55]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" [2007-04-22 10:22]
"Zboard"="F:\Program Files\Ideazon\ZEngine\Zboard.exe" [2007-04-03 19:46]
"QuickTime Task"="D:\Program Files\QuickTime\QTTask.exe" [2007-06-29 06:24]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-07-10 09:18]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PopUpStopperFreeEdition"="C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe" [2005-03-17 11:10]
"Uniblue RegistryBooster 2"="C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe" []
"ISMModule"="C:\Program Files\ISM\ISMModule.exe" [2007-08-27 16:09]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"NvMediaCenter"=RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
"ALUAlert"=C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe

C:\Documents and Settings\Danny\Start Menu\Programs\Startup\
NYKO Gamepad Mapping Tools.lnk - C:\Program Files\NYKO\Gamepad Mapping Tools\ngpmap.exe [2006-10-14 03:53:26]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26]
HotSync Manager.lnk - C:\Program Files\palmOne\Hotsync.exe [2004-06-09 14:16:08]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{93994DE8-8239-4655-B1D1-5F4E91300429}"= d:\PROGRA~1\DVDREG~1\DVDShell.dll [2004-10-09 16:18 49152]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ddcdcab]
ddcdcab.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\mljji]
C:\WINDOWS\system32\mljji.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\mllml]
C:\WINDOWS\system32\mllml.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\pmkhh]
C:\WINDOWS\system32\pmkhh.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AVG Anti-Spyware Driver]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AVG Anti-Spyware Guard]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]

R0 imagedrv;imagedrv;C:\WINDOWS\system32\Drivers\imagedrv.sys
R0 imagesrv;imagesrv;C:\WINDOWS\system32\DRIVERS\imagesrv.sys
R0 SI3112r;Silicon Image SiI 3112 SATARaid Controller;C:\WINDOWS\system32\DRIVERS\SI3112r.sys
R0 SiFilter;SATALink driver accelerator;C:\WINDOWS\system32\DRIVERS\SiWinAcc.sys
R2 BthServ;Bluetooth Support Service;C:\WINDOWS\system32\svchost.exe -k bthsvcs
R2 hardlock;hardlock;\??\C:\WINDOWS\system32\drivers\hardlock.sys
R2 Haspnt;Haspnt;\??\C:\WINDOWS\system32\drivers\Haspnt.sys
R2 MaVctrl;MaVctrl;C:\WINDOWS\system32\DRIVERS\MaVc2K.sys
R2 SVKP;SVKP;\??\C:\WINDOWS\system32\SVKP.sys
R3 Afc;PPdus ASPI Shell;C:\WINDOWS\system32\drivers\Afc.sys
R3 Alpham1;Ideazon ZBoard USB Human Interface Device;C:\WINDOWS\system32\DRIVERS\Alpham1.sys
R3 Alpham2;Ideazon ZBoard MM USB Human Interface Device;C:\WINDOWS\system32\DRIVERS\Alpham2.sys
R3 ASAPIW2k;ASAPIW2K;C:\WINDOWS\system32\drivers\ASAPIW2k.sys
R3 Ma730Pt;MA730 Bluetooth VCOM Driver;C:\WINDOWS\system32\DRIVERS\Ma730Pt.sys
R3 Ma730Vad;MA730 Bluetooth Audio;C:\WINDOWS\system32\DRIVERS\Ma730Vad.sys
R3 Pcouffin;Low level access layer for CD devices;C:\WINDOWS\system32\Drivers\Pcouffin.sys
R3 ROOTMODEM;Microsoft Legacy Modem Driver;C:\WINDOWS\system32\Drivers\RootMdm.sys
R3 usbbus;LGE CDMA Composite USB Device;C:\WINDOWS\system32\DRIVERS\lgusbbus.sys
R3 vaxscsi;vaxscsi;C:\WINDOWS\system32\Drivers\vaxscsi.sys
S2 windev-ad3-30cc;windev-ad3-30cc;\??\C:\WINDOWS\system32\windev-ad3-30cc.sys
S3 61883;61883 Unit Device;C:\WINDOWS\system32\DRIVERS\61883.sys
S3 Alpham;Ideazon ZBoard Composite Keyboard Driver;C:\WINDOWS\system32\DRIVERS\Alpham.sys
S3 Amsmpu4p;Amsmpu4p;\??\C:\DOCUME~1\Danny\LOCALS~1\Temp\Amsmpu4p.sys
S3 Avc;AVC Device;C:\WINDOWS\system32\DRIVERS\avc.sys
S3 BthEnum;Bluetooth Request Block Driver;C:\WINDOWS\system32\DRIVERS\BthEnum.sys
S3 BTHMODEM;Bluetooth Serial Communications Driver;C:\WINDOWS\system32\DRIVERS\bthmodem.sys
S3 BthPan;Bluetooth Device (Personal Area Network);C:\WINDOWS\system32\DRIVERS\bthpan.sys
S3 BTHPORT;Bluetooth Port Driver;C:\WINDOWS\system32\Drivers\BTHport.sys
S3 BTHUSB;Bluetooth Radio USB Driver;C:\WINDOWS\system32\Drivers\BTHUSB.sys
S3 mam4410c;mam4410c;C:\WINDOWS\system32\Drivers\mam4410c.sys
S3 mam4410m;mam4410m;C:\WINDOWS\system32\Drivers\mam4410m.sys
S3 mam4410u;mam4410u;C:\WINDOWS\system32\Drivers\mam4410u.sys
S3 MarvinBus;Pinnacle Marvin Bus;C:\WINDOWS\system32\DRIVERS\MarvinBus.sys
S3 MSDV;Microsoft DV Camera and VCR;C:\WINDOWS\system32\DRIVERS\msdv.sys
S3 PalmUSBD;PalmUSBD;C:\WINDOWS\system32\drivers\PalmUSBD.sys
S3 RFCOMM;Bluetooth Device (RFCOMM Protocol TDI);C:\WINDOWS\system32\DRIVERS\rfcomm.sys
S3 UsbDiag;LGE CDMA USB Serial Port;C:\WINDOWS\system32\DRIVERS\lgusbdiag.sys
S3 USBModem;LGE CDMA USB Modem;C:\WINDOWS\system32\DRIVERS\lgusbmodem.sys

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs BthServ

Contents of the 'Scheduled Tasks' folder
2007-07-26 14:21:09 C:\WINDOWS\tasks\AppleSoftwareUpdate.job
2007-07-31 23:49:35 C:\WINDOWS\tasks\Symantec NetDetect.job

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-31 20:55:27
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden registry entries …

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher]
"TracesProcessed"=dword:0000027c

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-07-31 20:56:35
C:\ComboFix-quarantined-files.txt … 2007-07-31 20:55
C:\ComboFix2.txt … 2007-07-31 18:29
C:\ComboFix3.txt … 2007-07-27 04:41

— E O F —

##########################################

4DOS 7.50
5 Spots
5 Spots II
7-Zip 4.42
Absolute Poker Basic
Action Ball Deluxe
Ad-Aware SE Personal
Adobe Download Manager 2.0 (Remove Only)
Adobe Flash Player 9 ActiveX
Adobe Help Center 2.1
Adobe Photoshop Elements 5.0
Adobe Reader 7.0.8
Adobe Shockwave Player
Adventure Ball
Adventure Inlay Safari Edition
Alpha Ball
Ancient Sudoku
Apollo DivX to DVD Creator 3.5.0
Apple Mobile Device Support
Apple Software Update
Aquabble Avalanche
Aquabble Quest
ArcSoft PhotoImpression 5
Atlantis Adventure
Atlantis Quest
Avery Wizard 3.0
AVG Anti-Spyware 7.5
AVG Free Edition
Babel Deluxe
Ballistik
Balloon Blast
Battleship Chess
Bejeweled 2 Deluxe
Big Kahuna Reef 2 - Chain Reaction
BitPim 0.9.08
Boilosft AVI to VCD SVCD DVD Converter 1.49
Bookworm Deluxe
BookWorm Deluxe 1.01
BookWorm Deluxe 1.02
BookWorm Deluxe 1.03
Break Ball 2 Gold
Break Quest
Bricks of Atlantis
Bricks of Camelot
Bricks of Egypt
Brickshooter Egypt
Business Card Designer Plus 7.3.0.0
Cake Mania
Canopus ProCoder 2
Carl's Classics
Chessmaster Challenge
Chocolatier (remove only)
Coffee Tycoon
Combined Community Codec Pack 2006-07-28 (Remove Only)
Comcast High-Speed Internet Install Wizard
Creative Removable Disk Manager
Creative System Information
DDD Pool
Diner Dash - Flo On The Go
Diner Dash 2
DiscAPI
Disney's Simba's Pride GameBreak
DivX Content Uploader
DivX Converter
DivX Player
DivX Web Player
Documents To Go
DVD Region+CSS Free [removed]
DVD X Copy Platinum 5.0.0
DVD-CLONER V3.00 Build 880
EA Link
Elite Mahjong
EPSON CX6000 Series User's Guide
EPSON Printer Software
EPSON Scan
EPSON Stylus CX6000 Scanner Driver Update
Fairies
Fairy Godmother Tycoon (remove only)
Fiber Twig
Fiber Twig 2
Filler
Fireworks Extravaganza
Fresco Wizard
Fruit Lockers
Funkiball Adventure
Go Diego Go! Wolf Pup Rescue
Golden Dozen Solitaire
Google Toolbar for Firefox
GTA San Andreas
Gutterball 2
Haali Media Splitter
Half-Life® 2
Half-Life: Blue Shift
Half-Life: Opposing Force
Harry Potter and the Order of the Phoenix™
HDLD GUI 2.0
Hexalot
HijackThis 1.99.1
Hitman - Codename 47 © EIDOS
Hotfix for Windows XP (KB926239)
HP Memories Disc
Hyperballoid Around The World
'I Luv' House Pets
Ice Cream Tycoon
ImgBurn (Remove Only)
Incrediball - The Seven Sapphires
Internet Speed Monitor
iTunes
J2SE Runtime Environment 5.0 Update 10
J2SE Runtime Environment 5.0 Update 11
Java™ 6 Update 2
Java™ SE Runtime Environment 6 Update 1
Jewel Of Atlantis
Jewel Quest
Karu
K-Lite Codec Pack 2.70 Full
Legend of Aladdin
Leisure Suit Larry - Magna Cum Laude
Leisure Suit Larry Collection™
LG GSM PC Components
LG USB Modem driver
LG VX8100 MA730 - Handset Manager V9.2
LG VX8100 USB - Handset Manager V9.2
LGUsbDriver
Little Bear Rainy Day Activities
LiveUpdate 1.90 (Symantec Corporation)
Macromedia Extension Manager
Macromedia Flash 8
Macromedia Flash 8 Video Encoder
Magic Ball 2
Magic Ball 2 New Worlds
Memory Loops
Microsoft .NET Framework 2.0
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Office Professional Edition 2003
Microsoft Plus! Dancer LE
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
Mind Machine
Mind Your Marbles
Mini Golf Pro
Mirror Magic
Morpheus 5.2 (remove only)
Morpheus Toolbar
Move Networks Player for Internet Explorer
Mozilla Firefox (1.5)
Mystery Case Files - Prime Suspects (remove only)
Mystery Case Files Ravenhearst
Neighbours From Hell 2
Nero 7 Demo
NewsBin Pro 4.3
NewsBin Pro V5
NVIDIA Drivers
NYKO Gamepad Mapping Tools 2.0.0
palmOne
Petz Vet
Pop-Up Stopper Free Edition
Princess Magical Dress-Up
Project64 1.6
PS2 HD Handiness 0.75
PureVoice
Putt-Putt: Pep's Birthday Surprise
QCP Converter
QuickPar 0.9
QuickTime
RAPID
Realtek AC'97 Audio
Return to Castle Wolfenstein
Sandlot Games Client Services
Sansa Media Converter
Scholastic's I SPY Mystery
Scrabble® 2003 Edition
ScummVM 0.9.1
Sid Meier's Pirates!
Sony Vegas 5.0a
Spider-Man 2
Spider-Man 3 ™
SpongeBob's Obstacle Odyssey
Sproink (remove only)
Spybot - Search & Destroy 1.4
SpywareBlaster v3.5.1
Super Collapse
The Emporer's Mahjong
The Settlers II - 10th Anniversary
The Settlers III Gold Edition
The Simpsons Hit & Run™
The Sims 2
The Sims 2 Family Fun Stuff
The Sims 2 Glamour Life Stuff
The Sims 2 Nightlife
The Sims 2 Open For Business
The Sims 2 Pets
The Sims 2 University
The Sims™ 2 Seasons
Tiger Woods PGA TOUR 07
TradeWinds 2 (remove only)
Tradewinds Legends
Transformers™ - The Game
UltimateBet
UltimateBuddy
Ultra Video Converter 2.0.6
VideoLAN VLC media player 0.8.6a
Virtual Villagers (remove only)
Virtual Villagers 2
Visual Business Cards 4
Windows Installer 3.1 (KB893803)
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Player 10 Hotfix - KB895316
Windows Media Player 11
Windows Media Player 11
Windows XP Service Pack 2
XP Repair Pro 2.4.1
Yahoo! Mail Quick Select Tool (PhotoMail)
Yahoo! Toolbar
Yahtzee Deluxe
Z Engine
Zoom Player (remove only)

#######################################

Logfile of HijackThis v1.99.1
Scan saved at 8:47:14 PM, on 7/31/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
D:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
i:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\rundll32.exe
D:\Program Files\Adobe\Photoshop Elements 5.0\apdproxy.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
F:\Program Files\Ideazon\ZEngine\Zboard.exe
D:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe
C:\Program Files\ISM\ISMModule.exe
C:\Program Files\palmOne\Hotsync.exe
C:\Program Files\NYKO\Gamepad Mapping Tools\ngpmap.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Documents and Settings\Danny\Desktop\HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
O2 - BHO: (no name) - {015A267B-1A84-4339-8190-A93880373586} - C:\WINDOWS\system32\pmkhh.dll (file missing)
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: MSEvents Object - {2FE91693-52D9-4199-8BEE-627EB0A3D3A3} - C:\WINDOWS\system32\mllml.dll (file missing)
O2 - BHO: MorpheusToolbar BHO - {3F3714A1-89A4-46be-8AF3-D0C9D1FB03F9} - C:\Program Files\MorpheusBar\bar\1.bin\MORPHBAR.DLL
O2 - BHO: MSEvents Object - {44CA2BC3-2204-411D-955E-F9C9483D32F8} - C:\WINDOWS\system32\mljji.dll (file missing)
O2 - BHO: (no name) - {48E5DF1C-66A4-400A-B5F1-464E681319D9} - C:\WINDOWS\system32\pmkhh.dll (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: MSEvents Object - {8274955B-A1F3-4C99-819D-FDA49997ECDA} - C:\WINDOWS\system32\mljji.dll (file missing)
O2 - BHO: BndDrive BHO Class - {9815DA81-2E0C-478c-90E4-06E474E704D0} - C:\Program Files\ISM\BndDrive.dll
O3 - Toolbar: Morpheus Toolbar - {3F3714A9-89A4-46be-8AF3-D0C9D1FB03F9} - C:\Program Files\MorpheusBar\bar\1.bin\MORPHBAR.DLL
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [Adobe Photo Downloader] "D:\Program Files\Adobe\Photoshop Elements 5.0\apdproxy.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Zboard] F:\Program Files\Ideazon\ZEngine\Zboard.exe
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe"
O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe /S
O4 - HKCU\..\Run: [ISMModule] "C:\Program Files\ISM\ISMModule.exe"
O4 - Startup: NYKO Gamepad Mapping Tools.lnk = C:\Program Files\NYKO\Gamepad Mapping Tools\ngpmap.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HotSync Manager.lnk = C:\Program Files\palmOne\Hotsync.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Absolute Poker Basic - {5E72AD5A-20DF-4ca4-9B7B-D9717FFDE0C5} - C:\Documents and Settings\Danny\Start Menu\Programs\Absolute Poker Basic\Absolute Poker Basic.lnk
O9 - Extra 'Tools' menuitem: Absolute Poker Basic - {5E72AD5A-20DF-4ca4-9B7B-D9717FFDE0C5} - C:\Documents and Settings\Danny\Start Menu\Programs\Absolute Poker Basic\Absolute Poker Basic.lnk
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: UltimateBet - {94148DB5-B42D-4915-95DA-2CBB4F7095BF} - E:\Program Files\UltimateBet\UltimateBet.exe
O9 - Extra 'Tools' menuitem: UltimateBet - {94148DB5-B42D-4915-95DA-2CBB4F7095BF} - E:\Program Files\UltimateBet\UltimateBet.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15030/CTSUEng.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www.ca.com/us/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {B030900C-746A-47BF-8B1D-EA3FB3395563} (CoxFastConnect20 Control) - https://fastconnect.cox.net/cd20/CoxFastConnect20.ocx
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/5m/vir…l/installer.exe
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15030/CTPID.cab
O20 - Winlogon Notify: ddcdcab - ddcdcab.dll (file missing)
O20 - Winlogon Notify: mljji - C:\WINDOWS\system32\mljji.dll (file missing)
O20 - Winlogon Notify: mllml - C:\WINDOWS\system32\mllml.dll (file missing)
O20 - Winlogon Notify: pmkhh - C:\WINDOWS\system32\pmkhh.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe Active File Monitor V5 (AdobeActiveFileMonitor5.0) - Unknown owner - D:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - i:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: .NET Runtime Optimization Service v2.0.50727_X86 (clr_optimization_v2.0.50727_32) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

Trevuren

Post #13August 1, 2007, 4:59 PM UTC

A. First, there are a few programs that you need to uninstall. To do so, use the Add/Remove Program module in your Control Panel:

These two because you are already running a more current version:

J2SE Runtime Environment 5.0 Update 10
J2SE Runtime Environment 5.0 Update 11

These two, the explanation for which can be found here: http://www.bleepingcomputer.com/uninstall/all.html

UltimateBet
UltimateBuddy

B. Please disable AVG AntiSpyware by opening the program and on the Status page - beside "Resident Shield" click on "change status" so that it says "inactive" for it may interfere with our HJT fix.

Remember to reactivate this feature when all our work is finished.

C. 1. Please open Notepad

Click Start , then Run
Type notepad .exe in the Run Box.

2. Now copy/paste the entire content of the codebox below into the Notepad window:

File::
C:\WINDOWS\system32\cdegdgxb.dll
C:\WINDOWS\system32\mllml.dll.vir
C:\WINDOWS\system32\ulqecqsj.dll
C:\WINDOWS\popcinfo.dat
C:\DOCUME~1\Danny\LOCALS~1\Temp\Amsmpu4p.sys

Folder::
C:\Program Files\ISM
E:\Program Files\UltimateBet
E:\Program Files\UltimaBuddy
C:\VundoFix Backups
C:\Program Files\thriXXX

Registry::
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Local Page"="about:blank" 
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{015A267B-1A84-4339-8190-A93880373586}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2FE91693-52D9-4199-8BEE-627EB0A3D3A3}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{44CA2BC3-2204-411D-955E-F9C9483D32F8}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{48E5DF1C-66A4-400A-B5F1-464E681319D9}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8274955B-A1F3-4C99-819D-FDA49997ECDA}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9815DA81-2E0C-478c-90E4-06E474E704D0}]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ddcdcab]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\mljji]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\mllml]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\pmkhh]

3. Save the above as CFScript.txt

4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

[external image: Posted Image]

5. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:

Combofix.txt
A new HijackThis log.

ameritrash73

Post #14August 1, 2007, 8:29 PM UTC

I read about Ultimate Bet and Ultimate Buddy. It said they were fine as long as I rejected all extra carp** when I installed them which I did so I'm not gonna worry about those unless you really think it's neccessary. Here are the logs. Thank you for all your help so far…

ComboFix 07-07-27.6 - "Danny" 2007-08-01 15:13:43.4 [GMT -5:00] - NTFS
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.True
Command switches used :: C:\Documents and Settings\Danny\My Documents\CFScript.txt
* Created a new restore point

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

C:\Program Files\ISM
C:\Program Files\ISM\BndDrive.dll
C:\Program Files\ISM\bndloader.exe
C:\Program Files\ISM\dictionary.gz
C:\Program Files\ISM\ism.exe
C:\Program Files\ISM\ISM.zip
C:\Program Files\ISM\ISMModule.exe
C:\Program Files\ISM\targets.gz
C:\Program Files\ISM\Uninstall.exe
C:\Program Files\thriXXX
C:\VundoFix Backups
C:\VundoFix Backups\addmorefiles.txt
C:\VundoFix Backups\ijjlm.bak1.bad
C:\VundoFix Backups\ijjlm.bak2.bad
C:\VundoFix Backups\ijjlm.ini.bad
C:\VundoFix Backups\lmllm.bak1.bad
C:\VundoFix Backups\lmllm.ini.bad
C:\WINDOWS\popcinfo.dat
C:\WINDOWS\system32\cdegdgxb.dll
C:\WINDOWS\system32\mllml.dll.vir
C:\WINDOWS\system32\ulqecqsj.dll
E:\Program Files\UltimateBet
E:\Program Files\UltimateBet\eula.txt
E:\Program Files\UltimateBet\INSTALL.LOG
E:\Program Files\UltimateBet\libeay32.dll
E:\Program Files\UltimateBet\LocalWeb\clientLowerLeftPaneContent.html
E:\Program Files\UltimateBet\LocalWeb\clientLowerLeftPaneFrame.html
E:\Program Files\UltimateBet\LocalWeb\clientLowerRightPaneContent.html
E:\Program Files\UltimateBet\LocalWeb\clientLowerRightPaneFrame.html
E:\Program Files\UltimateBet\LocalWeb\clientUpperLeftPaneContent.html
E:\Program Files\UltimateBet\LocalWeb\clientUpperLeftPaneFrame.html
E:\Program Files\UltimateBet\LocalWeb\clientUpperRightPaneContent.html
E:\Program Files\UltimateBet\LocalWeb\clientUpperRightPaneFrame.html
E:\Program Files\UltimateBet\LocalWeb\clientUpperRightWarningNoWeb.html
E:\Program Files\UltimateBet\LocalWeb\content_offline.jpg
E:\Program Files\UltimateBet\LocalWeb\content_offline_cardroom_avail.jpg
E:\Program Files\UltimateBet\LocalWeb\flashmenugame.swf
E:\Program Files\UltimateBet\LocalWeb\flashnav.js
E:\Program Files\UltimateBet\LocalWeb\left_logo.jpg
E:\Program Files\UltimateBet\LocalWeb\leftnav-noflash.jpg
E:\Program Files\UltimateBet\LocalWeb\leftnav-oldflash.jpg
E:\Program Files\UltimateBet\LocalWeb\leftnav_bg.jpg
E:\Program Files\UltimateBet\LocalWeb\leftnav_btn_cashier_down.gif
E:\Program Files\UltimateBet\LocalWeb\leftnav_btn_cashier_off.gif
E:\Program Files\UltimateBet\LocalWeb\leftnav_btn_cashier_over.gif
E:\Program Files\UltimateBet\LocalWeb\leftnav_btn_customersupport_down.gif
E:\Program Files\UltimateBet\LocalWeb\leftnav_btn_customersupport_off.gif
E:\Program Files\UltimateBet\LocalWeb\leftnav_btn_customersupport_over.gif
E:\Program Files\UltimateBet\LocalWeb\leftnav_btn_leaderboards_down.jpg
E:\Program Files\UltimateBet\LocalWeb\leftnav_btn_leaderboards_off.jpg
E:\Program Files\UltimateBet\LocalWeb\leftnav_btn_leaderboards_over.jpg
E:\Program Files\UltimateBet\LocalWeb\leftnav_btn_mpblackjack_down.gif
E:\Program Files\UltimateBet\LocalWeb\leftnav_btn_mpblackjack_off.gif
E:\Program Files\UltimateBet\LocalWeb\leftnav_btn_mpblackjack_over.gif
E:\Program Files\UltimateBet\LocalWeb\leftnav_btn_newaccount_down.gif
E:\Program Files\UltimateBet\LocalWeb\leftnav_btn_newaccount_off.gif
E:\Program Files\UltimateBet\LocalWeb\leftnav_btn_newaccount_over.gif
E:\Program Files\UltimateBet\LocalWeb\leftnav_btn_playpoker_down.gif
E:\Program Files\UltimateBet\LocalWeb\leftnav_btn_playpoker_off.gif
E:\Program Files\UltimateBet\LocalWeb\leftnav_btn_playpoker_over.gif
E:\Program Files\UltimateBet\LocalWeb\leftnav_btn_promotions_down.gif
E:\Program Files\UltimateBet\LocalWeb\leftnav_btn_promotions_off.gif
E:\Program Files\UltimateBet\LocalWeb\leftnav_btn_promotions_over.gif
E:\Program Files\UltimateBet\LocalWeb\leftnav_btn_spblackjack_down.gif
E:\Program Files\UltimateBet\LocalWeb\leftnav_btn_spblackjack_off.gif
E:\Program Files\UltimateBet\LocalWeb\leftnav_btn_spblackjack_over.gif
E:\Program Files\UltimateBet\LocalWeb\lowerleft-logo-top.jpg
E:\Program Files\UltimateBet\LocalWeb\lowerleft-logo.jpg
E:\Program Files\UltimateBet\LocalWeb\NewUser.html
E:\Program Files\UltimateBet\LocalWeb\pixel_black.gif
E:\Program Files\UltimateBet\LocalWeb\progress.gif
E:\Program Files\UltimateBet\LocalWeb\progress.html
E:\Program Files\UltimateBet\LocalWeb\ServerDown.html
E:\Program Files\UltimateBet\LocalWeb\utils.js
E:\Program Files\UltimateBet\Product.ini
E:\Program Files\UltimateBet\res2D.dll
E:\Program Files\UltimateBet\resBJ.dll
E:\Program Files\UltimateBet\resGames.dll
E:\Program Files\UltimateBet\resLobby.dll
E:\Program Files\UltimateBet\resMiniBar.dll
E:\Program Files\UltimateBet\resSplash.dll
E:\Program Files\UltimateBet\resTable.dll
E:\Program Files\UltimateBet\ssleay32.dll
E:\Program Files\UltimateBet\StmOCX.dll
E:\Program Files\UltimateBet\ubcustom.ico
E:\Program Files\UltimateBet\UBSoftUpdate.exe
E:\Program Files\UltimateBet\UltimateBet.dat
E:\Program Files\UltimateBet\UltimateBet.exe
E:\Program Files\UltimateBet\UNWISE.EXE
E:\Program Files\UltimateBet\Update\UBSoftUpdate.log
E:\Program Files\UltimateBet\zlib.dll

((((((((((((((((((((((((( Files Created from 2007-07-01 to 2007-08-01 )))))))))))))))))))))))))))))))

2007-07-30 19:44 d——– C:\DOCUME~1\Aerin\APPLIC~1\Media Player Classic
2007-07-29 15:40 d——– C:\Program Files\Realtek AC97
2007-07-29 15:39 d——– C:\Program Files\Common Files\ArcSoft
2007-07-29 06:11 d——– C:\Program Files\Realtek AC97(2)
2007-07-28 04:26 15,900,672 –a—— C:\DOCUME~1\Danny\ntuser.dat
2007-07-28 04:24 245,408 –a—— C:\WINDOWS\system32\unicows.dll
2007-07-28 04:24 1,645,320 –a—— C:\WINDOWS\system32\gdiplus.dll
2007-07-28 04:24 d——– C:\Program Files\SanDisk
2007-07-24 23:19 d——– C:\Program Files\Windows Media Connect 2
2007-07-24 23:16 d——– C:\WINDOWS\system32\drivers\UMDF
2007-07-23 15:33 d——– C:\Program Files\Enigma Software Group
2007-07-22 17:54 d——– C:\Program Files\SpywareBlaster
2007-07-22 04:01 d——– C:\Program Files\Common Files\Download Manager
2007-07-21 17:02 d——– C:\Downloads
2007-07-21 17:02 d——– C:\DOCUME~1\Danny\APPLIC~1\GetRightToGo
2007-07-21 16:19 d——– C:\!KillBox
2007-07-20 04:29 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-07-20 03:27 d——– C:\DOCUME~1\Danny\APPLIC~1\Uniblue
2007-07-18 20:59 d——– C:\Temp\brr
2007-07-18 20:59 d——– C:\Temp
2007-07-18 16:15 d——– C:\Program Files\iTunes
2007-07-18 16:15 d——– C:\Program Files\iPod
2007-07-18 15:59 d—-c— C:\WINDOWS\system32\DRVSTORE
2007-07-18 15:59 d——– C:\Program Files\Common Files\Apple
2007-07-17 22:28 d——– C:\Program Files\Virtools
2007-07-15 21:17 369 –a—— C:\WINDOWS\ereg077.dat
2007-07-15 21:17 d——– C:\WINDOWS\BBSTORE
2007-07-14 23:51 d——– C:\DOCUME~1\Shyla\WINDOWS
2007-07-14 14:25 d——– C:\Program Files\Atari
2007-07-13 21:35 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\QuickTime
2007-07-13 21:33 d——– C:\DOCUME~1\Shyla\APPLIC~1\InstallShield
2007-07-12 22:26 d——– C:\Program Files\Apple Software Update
2007-07-12 22:26 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple
2007-07-11 03:11 d——– C:\DOCUME~1\Aerin\APPLIC~1\dvdcss
2007-07-10 05:08 d——– C:\DOCUME~1\Danny\APPLIC~1\Creative
2007-07-09 18:33 41,984 ——— C:\WINDOWS\Ctregrun.exe
2007-07-09 18:32 d——– C:\Program Files\Audible
2007-07-09 18:30 221,184 –a—— C:\WINDOWS\system32\wmpns.dll
2007-07-09 18:27 d——– C:\Program Files\Creative
2007-07-07 04:12 d——– C:\DOCUME~1\Danny\APPLIC~1\GameHouse

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-07-31 22:32 ——— d——– C:\Program Files\Documents To Go
2007-07-31 22:32 ——— d——– C:\Program Files\DivX
2007-07-31 22:32 ——— d——– C:\Program Files\DDD Pool
2007-07-31 22:32 ——— d——– C:\Program Files\Carls Classics
2007-07-31 22:31 ——— d——– C:\Program Files\Ballistik
2007-07-31 22:27 ——— d——– C:\Program Files\Atlantis Quest
2007-07-31 22:27 ——— d——– C:\Program Files\Apollo DivX to DVD Creator
2007-07-31 22:27 ——— d——– C:\Program Files\5 Spots II
2007-07-31 22:27 ——— d——– C:\Program Files\5 Spots
2007-07-31 18:08 ——— d——– C:\Program Files\Morpheus
2007-07-29 15:40 ——— d——– C:\DOCUME~1\Danny\APPLIC~1\Arcsoft
2007-07-29 15:39 ——— d——– C:\DOCUME~1\Danny\APPLIC~1\dvdcss
2007-07-28 04:24 ——— d–h—– C:\Program Files\InstallShield Installation Information
2007-07-22 15:29 ——— d——– C:\DOCUME~1\Danny\APPLIC~1\Symantec
2007-07-19 05:23 ——— d——– C:\Program Files\nbpro
2007-07-15 10:51 ——— d——– C:\Program Files\Big Kahuna Reef 2
2007-07-14 15:25 ——— d——– C:\Program Files\Fish Tycoon
2007-07-13 21:34 ——— d——– C:\Program Files\Disney Interactive
2007-06-30 01:46 ——— d——– C:\Program Files\Yahoo! Games
2007-06-29 00:43 37376 –a—— C:\WINDOWS\system32\nvcod(2).dll
2007-06-29 00:43 1018772 –a—— C:\WINDOWS\system32\nvucode.bin
2007-06-23 16:16 ——— d——– C:\Program Files\InSpheration
2007-06-23 16:13 ——— d——– C:\Program Files\Feeding Frenzy 2
2007-06-23 16:13 ——— d——– C:\Program Files\Fatman Adventures
2007-06-23 16:13 ——— d——– C:\Program Files\Electra
2007-06-23 16:11 ——— d——– C:\Program Files\Chainz 2
2007-06-23 16:10 ——— d——– C:\Program Files\Elythril The Elf Treasure
2007-06-23 16:10 ——— d——– C:\Program Files\Charm Tale
2007-06-23 16:09 ——— d——– C:\Program Files\Aqua Pearls
2007-06-23 16:08 ——— d——– C:\Program Files\Gold Sprinter
2007-06-23 16:07 ——— d——– C:\Program Files\Charm Solitaire
2007-06-23 16:06 ——— d——– C:\Program Files\Deep Sea Adventures
2007-06-21 19:25 ——— d——– C:\Program Files\support.com
2007-06-19 15:14 ——— d——– C:\Program Files\Symantec
2007-06-19 15:14 ——— d——– C:\Program Files\Common Files\Symantec Shared
2007-06-19 15:09 ——— d——– C:\Program Files\Norton AntiVirus
2007-06-07 18:13 ——— d——– C:\DOCUME~1\Danny\APPLIC~1\Zylom
2007-06-07 18:03 ——— d——– C:\Program Files\Zylom Games
2007-06-06 00:52 ——— d——– C:\DOCUME~1\Danny\APPLIC~1\Oxin's Style!
2007-06-02 19:32 ——— d——– C:\Program Files\palmOne
2007-05-15 06:51 43520 –a—— C:\WINDOWS\system32\CmdLineExt03.dll
2006-12-14 05:57 836783 –a—— C:\Program Files\7z442.exe

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2006-03-01 16:22 C:\WINDOWS\soundman.exe]
"nwiz"="nwiz.exe" [2006-10-22 12:22 C:\WINDOWS\system32\nwiz.exe]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-04 02:56 C:\WINDOWS\system32\bthprops.cpl]
"Adobe Photo Downloader"="D:\Program Files\Adobe\Photoshop Elements 5.0\apdproxy.exe" [2006-09-14 08:55]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" [2007-04-22 10:22]
"Zboard"="F:\Program Files\Ideazon\ZEngine\Zboard.exe" [2007-04-03 19:46]
"QuickTime Task"="D:\Program Files\QuickTime\QTTask.exe" [2007-06-29 06:24]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-07-10 09:18]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PopUpStopperFreeEdition"="C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe" [2005-03-17 11:10]
"Uniblue RegistryBooster 2"="C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe" []
"ISMModule"="C:\Program Files\ISM\ISMModule.exe" []

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"NvMediaCenter"=RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
"ALUAlert"=C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe

C:\Documents and Settings\Danny\Start Menu\Programs\Startup\
NYKO Gamepad Mapping Tools.lnk - C:\Program Files\NYKO\Gamepad Mapping Tools\ngpmap.exe [2006-10-14 03:53:26]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26]
HotSync Manager.lnk - C:\Program Files\palmOne\Hotsync.exe [2004-06-09 14:16:08]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{93994DE8-8239-4655-B1D1-5F4E91300429}"= d:\PROGRA~1\DVDREG~1\DVDShell.dll [2004-10-09 16:18 49152]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AVG Anti-Spyware Driver]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AVG Anti-Spyware Guard]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]

R0 imagedrv;imagedrv;C:\WINDOWS\system32\Drivers\imagedrv.sys
R0 imagesrv;imagesrv;C:\WINDOWS\system32\DRIVERS\imagesrv.sys
R0 SI3112r;Silicon Image SiI 3112 SATARaid Controller;C:\WINDOWS\system32\DRIVERS\SI3112r.sys
R0 SiFilter;SATALink driver accelerator;C:\WINDOWS\system32\DRIVERS\SiWinAcc.sys
R2 BthServ;Bluetooth Support Service;C:\WINDOWS\system32\svchost.exe -k bthsvcs
R2 hardlock;hardlock;\??\C:\WINDOWS\system32\drivers\hardlock.sys
R2 Haspnt;Haspnt;\??\C:\WINDOWS\system32\drivers\Haspnt.sys
R2 MaVctrl;MaVctrl;C:\WINDOWS\system32\DRIVERS\MaVc2K.sys
R2 SVKP;SVKP;\??\C:\WINDOWS\system32\SVKP.sys
R3 Afc;PPdus ASPI Shell;C:\WINDOWS\system32\drivers\Afc.sys
R3 Alpham1;Ideazon ZBoard USB Human Interface Device;C:\WINDOWS\system32\DRIVERS\Alpham1.sys
R3 Alpham2;Ideazon ZBoard MM USB Human Interface Device;C:\WINDOWS\system32\DRIVERS\Alpham2.sys
R3 ASAPIW2k;ASAPIW2K;C:\WINDOWS\system32\drivers\ASAPIW2k.sys
R3 Ma730Pt;MA730 Bluetooth VCOM Driver;C:\WINDOWS\system32\DRIVERS\Ma730Pt.sys
R3 Ma730Vad;MA730 Bluetooth Audio;C:\WINDOWS\system32\DRIVERS\Ma730Vad.sys
R3 Pcouffin;Low level access layer for CD devices;C:\WINDOWS\system32\Drivers\Pcouffin.sys
R3 ROOTMODEM;Microsoft Legacy Modem Driver;C:\WINDOWS\system32\Drivers\RootMdm.sys
R3 usbbus;LGE CDMA Composite USB Device;C:\WINDOWS\system32\DRIVERS\lgusbbus.sys
R3 vaxscsi;vaxscsi;C:\WINDOWS\system32\Drivers\vaxscsi.sys
S2 windev-ad3-30cc;windev-ad3-30cc;\??\C:\WINDOWS\system32\windev-ad3-30cc.sys
S3 61883;61883 Unit Device;C:\WINDOWS\system32\DRIVERS\61883.sys
S3 Alpham;Ideazon ZBoard Composite Keyboard Driver;C:\WINDOWS\system32\DRIVERS\Alpham.sys
S3 Amsmpu4p;Amsmpu4p;\??\C:\DOCUME~1\Danny\LOCALS~1\Temp\Amsmpu4p.sys
S3 Avc;AVC Device;C:\WINDOWS\system32\DRIVERS\avc.sys
S3 BthEnum;Bluetooth Request Block Driver;C:\WINDOWS\system32\DRIVERS\BthEnum.sys
S3 BTHMODEM;Bluetooth Serial Communications Driver;C:\WINDOWS\system32\DRIVERS\bthmodem.sys
S3 BthPan;Bluetooth Device (Personal Area Network);C:\WINDOWS\system32\DRIVERS\bthpan.sys
S3 BTHPORT;Bluetooth Port Driver;C:\WINDOWS\system32\Drivers\BTHport.sys
S3 BTHUSB;Bluetooth Radio USB Driver;C:\WINDOWS\system32\Drivers\BTHUSB.sys
S3 mam4410c;mam4410c;C:\WINDOWS\system32\Drivers\mam4410c.sys
S3 mam4410m;mam4410m;C:\WINDOWS\system32\Drivers\mam4410m.sys
S3 mam4410u;mam4410u;C:\WINDOWS\system32\Drivers\mam4410u.sys
S3 MarvinBus;Pinnacle Marvin Bus;C:\WINDOWS\system32\DRIVERS\MarvinBus.sys
S3 MSDV;Microsoft DV Camera and VCR;C:\WINDOWS\system32\DRIVERS\msdv.sys
S3 PalmUSBD;PalmUSBD;C:\WINDOWS\system32\drivers\PalmUSBD.sys
S3 RFCOMM;Bluetooth Device (RFCOMM Protocol TDI);C:\WINDOWS\system32\DRIVERS\rfcomm.sys
S3 UsbDiag;LGE CDMA USB Serial Port;C:\WINDOWS\system32\DRIVERS\lgusbdiag.sys
S3 USBModem;LGE CDMA USB Modem;C:\WINDOWS\system32\DRIVERS\lgusbmodem.sys

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs BthServ

Contents of the 'Scheduled Tasks' folder
2007-07-26 14:21:09 C:\WINDOWS\tasks\AppleSoftwareUpdate.job
2007-08-01 19:49:11 C:\WINDOWS\tasks\Symantec NetDetect.job

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-01 15:16:27
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden registry entries …

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher]
"TracesProcessed"=dword:000005c3

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-08-01 15:17:22
C:\ComboFix-quarantined-files.txt … 2007-08-01 15:16
C:\ComboFix2.txt … 2007-07-31 20:56
C:\ComboFix3.txt … 2007-07-31 18:29

— E O F —

###########################

Logfile of HijackThis v1.99.1
Scan saved at 3:26:12 PM, on 8/1/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
D:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
i:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\SOUNDMAN.EXE
D:\Program Files\Adobe\Photoshop Elements 5.0\apdproxy.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
F:\Program Files\Ideazon\ZEngine\Zboard.exe
D:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe
C:\Program Files\palmOne\Hotsync.exe
C:\Program Files\NYKO\Gamepad Mapping Tools\ngpmap.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Danny\Desktop\HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: MorpheusToolbar BHO - {3F3714A1-89A4-46be-8AF3-D0C9D1FB03F9} - C:\Program Files\MorpheusBar\bar\1.bin\MORPHBAR.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O3 - Toolbar: Morpheus Toolbar - {3F3714A9-89A4-46be-8AF3-D0C9D1FB03F9} - C:\Program Files\MorpheusBar\bar\1.bin\MORPHBAR.DLL
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [Adobe Photo Downloader] "D:\Program Files\Adobe\Photoshop Elements 5.0\apdproxy.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Zboard] F:\Program Files\Ideazon\ZEngine\Zboard.exe
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe"
O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe /S
O4 - HKCU\..\Run: [ISMModule] "C:\Program Files\ISM\ISMModule.exe"
O4 - Startup: NYKO Gamepad Mapping Tools.lnk = C:\Program Files\NYKO\Gamepad Mapping Tools\ngpmap.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HotSync Manager.lnk = C:\Program Files\palmOne\Hotsync.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Absolute Poker Basic - {5E72AD5A-20DF-4ca4-9B7B-D9717FFDE0C5} - C:\Documents and Settings\Danny\Start Menu\Programs\Absolute Poker Basic\Absolute Poker Basic.lnk
O9 - Extra 'Tools' menuitem: Absolute Poker Basic - {5E72AD5A-20DF-4ca4-9B7B-D9717FFDE0C5} - C:\Documents and Settings\Danny\Start Menu\Programs\Absolute Poker Basic\Absolute Poker Basic.lnk
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: UltimateBet - {94148DB5-B42D-4915-95DA-2CBB4F7095BF} - E:\Program Files\UltimateBet\UltimateBet.exe (file missing)
O9 - Extra 'Tools' menuitem: UltimateBet - {94148DB5-B42D-4915-95DA-2CBB4F7095BF} - E:\Program Files\UltimateBet\UltimateBet.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15030/CTSUEng.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www.ca.com/us/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {B030900C-746A-47BF-8B1D-EA3FB3395563} (CoxFastConnect20 Control) - https://fastconnect.cox.net/cd20/CoxFastConnect20.ocx
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/5m/vir…l/installer.exe
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15030/CTPID.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe Active File Monitor V5 (AdobeActiveFileMonitor5.0) - Unknown owner - D:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - i:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: .NET Runtime Optimization Service v2.0.50727_X86 (clr_optimization_v2.0.50727_32) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

Trevuren

Post #15August 1, 2007, 8:59 PM UTC

A. Please run HijackThis, click Scan and place a checkmark beside the following entries:

O4 - HKCU\..\Run: [ISMModule] "C:\Program Files\ISM\ISMModule.exe"
O9 - Extra button: UltimateBet - {94148DB5-B42D-4915-95DA-2CBB4F7095BF} - E:\Program Files\UltimateBet\UltimateBet.exe (file missing)
O9 - Extra 'Tools' menuitem: UltimateBet - {94148DB5-B42D-4915-95DA-2CBB4F7095BF} - E:\Program Files\UltimateBet\UltimateBet.exe (file missing)

Now with all windows closed, click Fix checked and EXIT the program.

B. You will have to reinstall the program UltimateBet if you still want to keep it.

C. Now, with your logs looking OK, it is time we give your entire system a good looking over to make sure no nasties are still lurking in the shadows:

Please use the Internet Explorer browser, and do an online scan with Kaspersky Online Scanner
Click Yes, when prompted to install its ActiveX component.
(Note.. for Internet Explorer 7 users: If at any time you have trouble with the "Accept" button of the license, click on the "Zoom" tool located at the bottom right of the IE window and set the zoom to 75 %. Once the license has been accepted, reset to 100%.)
The program launches and downloads the latest definition files.

Once the files are downloaded click on Next
Click on Scan Settings and configure as follows:
- Scan using the following Anti-Virus database:
  - Extended
- Scan Options:Scan Archives
  Scan Mail Bases
Click OK and, under select a target to scan, select My Computer

When the scan is done, in the Scan is completed window (below), any infection is displayed.
There is no option to clean/disinfect, however, we need to analyze the information on the report.
[external image: Posted Image]
[external image: Posted Image]
To obtain the report:
Click on: Save Report As (above - red blinking arrow)
Next, in the Save as prompt, Save in area, select: Desktop
In the File name area, use KScan, or something similar
In Save as type, click the drop arrow and select: Text file [*.txt]
Then, click: Save
Please post the Kaspersky Online Scanner Report in your reply,

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved]Winantivirus.com Pop-up/ Lock-ups

✨ Ask AI

Ask AI