Spyware / Malware / Virus Removal

[Resolved]Hijackthis Log (i Suspect A Problem)

8 min read

Looking for the outcome? Ask AI

Clownmite Topic Starter

Post #1July 30, 2007, 3:55 AM UTC

Hello everyone.
I'm pretty sure I caught a virus or something. When I do a hijackthis scan, I see entries for winlogon notify, which I think is a virus. I've seen the sticky in the other forum with regards on how to remove this, but nothing I do seems to work. I've tried both Look2Me-Destroyer and VundoFix, but neither seem to do anything. If somone can tell me a step by step guide on how to remove everything malicious in my log posted below, I would be eternally grateful.

Logfile of HijackThis v1.99.1
Scan saved at 11:47:30 PM, on 7/29/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\a-squared free\a2service.exe
C:\Program Files\Kerio\Personal Firewall\persfw.exe
C:\Program Files\SiteAdvisor\6066\SAService.exe
C:\WINDOWS\system32\svchost.exe
C:\Acer\Empowering Technology\eRecovery\Monitor.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\SiteAdvisor\6066\SiteAdv.exe
C:\Program Files\IObit\IObit SmartDefrag\IObit SmartDefrag.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Last.fm\LastFMHelper.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Hjt\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://global.acer.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6066\SiteAdv.dll
O2 - BHO: (no name) - {474EC871-E0E2-4F5E-B842-08B7F4E47ADF} - c:\windows\system32\svniwljq.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O2 - BHO: Internet Explorer - {7A4794A7-4A4A-347A-4174-24A7A478B47E} - C:\WINDOWS\system\wasctn32.dll
O2 - BHO: (no name) - {A78E89D9-8068-48ED-8F4E-B7AFD557C0FF} - C:\WINDOWS\system32\loghour.dll
O2 - BHO: (no name) - {A9E0DC2C-9B4F-4C59-9C9E-B48ABE7BB539} - c:\windows\system32\cijncij.dll
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6066\SiteAdv.dll
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\Monitor.exe
O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6066\SiteAdv.exe
O4 - HKLM\..\Run: [SmartDefrag] "C:\Program Files\IObit\IObit SmartDefrag\IObit SmartDefrag.exe" /startup
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - Global Startup: Last.fm Helper.lnk = C:\Program Files\Last.fm\LastFMHelper.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O16 - DPF: {556DDE35-E955-11D0-A707-000000521957} - http://www.xblock.com/download/xclean_micro.exe
O18 - Protocol: siteadvisor - {3A5DC592-7723-4EAA-9EE6-AF4222BCF879} - C:\Program Files\SiteAdvisor\6066\SiteAdv.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O20 - Winlogon Notify: wyiqjbed - C:\WINDOWS\SYSTEM32\cijncij.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - c:\program files\a-squared free\a2service.exe
O23 - Service: Kerio Personal Firewall (PersFw) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall\persfw.exe
O23 - Service: SiteAdvisor Service - McAfee, Inc. - C:\Program Files\SiteAdvisor\6066\SAService.exe

Scotty

Post #2July 30, 2007, 2:37 PM UTC

Hi! Welcome to the Tom Coyote forums.
My name is Scotty. I would be glad to take a look at your log and help you with solving any malware problems. HijackThis logs can take a while to research.
Please be patient and I'd be grateful if you would note the following:

I will working be on your Malware issues, this may or may not, solve other issues you have with your machine.
The fixes are specific to your problem and should only be used for this issue on this machine.
Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
It's often worth reading through these instructions and printing them for ease of reference.
If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
Please reply to this thread. Do not start a new topic.

Please make a uninstall list using HijackThis
To access the Uninstall Manager you would do the following:

1. Start HijackThis
2. Click on the Config button
3. Click on the Misc Tools button
4. Click on the Open Uninstall Manager button.
5. Click on the Save list… button and specify where you would like to save this file. When you press Save button a notepad will open with the contents of that file. Simply copy and paste the contents of that notepad here in a reply.

Download AVG Anti-Spyware.

Install AVG Anti-Spyware.
Launch AVG by double-clicking on the icon.
The program will now open to the main screen.
You will need to update AVG to the latest definition files.
At the top of the main screen click Update.
Then in the Manual Update section, click on Start Update.

[*]The update will start and a progress bar will show the updates being installed.

[*]When updates are completed, close AVG.

If you are having problems with the updater, you can use this link to manually update AVG.
AVG manual updates

Download and Run ComboFix

Download this file from below:

Here
Then double click combofix.exe & follow the prompts.
When finished, it shall produce a log for you. Post that log in your next reply with a new HijackThis log.

Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall

Reboot into SAFE MODEBy pressing the F8 key right when Windows starts, usually right after you hear your computer
beep when you reboot it (some versions of windows will display 'Starting Windows' with a grey progress bar)
you will be brought to a menu where you can choose to boot into safe mode.

If it does not work on the first try, reboot and try again, as you have to be quick when you press it.

I have found that during boot up, right after the computer displays the equipment , memory, etc
installed on your computer, if you start lightly tapping the F8 key, the system will usually display the menu.
Run a scan with AVG.

Click on Scanner
- Click on the Settings tab, and set the following settings.
  - How to act
  - Click on Recommended actions, and set to Quarantine.
- How to scan
  - Check all options.
- Possibly unwanted software.
  - Check all options.
- Reports
  - Check Do not automatically generate reports after every scan.
- What to scan
  - Check Scan every file.
Click on the Scan tab.
- Click on Complete System Scan and the scan will begin.
- When the scan has finished
- Make sure that Set all elements to: shows Quarantine, if not click on the link and choose Quarantine from the popup menu.
- At the bottom of the window click on the Apply all Actions button.

Note: Don't save the report before you hit the Apply action button.

Close AVG Anti-Spyware.

AVG will save a report in the following location C:\Program Files\Grisoft\AVG anti-spyware 7.5\Reports

Before running Combofix, disconnect from the Internet and turn off all real-time scanners, eg anti-virus and anti-spyware.

Post back with the Combofix log, AVG report and a new HijackThis report. Run HJT after running AVG and CF.

Clownmite

Post #3July 30, 2007, 5:35 PM UTC

Ok, I did everything you said. Here are the reports:

First the hijackthis uninstall log:

Acer GridVista
Ad-Aware SE Personal
Adobe Flash Player 9 ActiveX
Adobe Photoshop 7.0
Adobe Reader 7.0.7
Adobe Shockwave Player
Advanced WindowsCare 2.51 Personal
Agere Systems AC'97 Modem
Apple Mobile Device Support
Apple Software Update
Arcade 3.0
a-squared Free 2.1
Belkin SOHO Networking Utilities
CCleaner (remove only)
Cool Edit Pro 2.1
DC++ 0.698
Dell Digital Jukebox Driver
Dell DJ Explorer
DivX
EasyCleaner
Guitar Pro 5.0
HijackThis 1.99.1
IObit SmartDefrag Beta3
iScrobbler
iTunes
J2SE Runtime Environment 5.0 Update 6
J2SE Runtime Environment 5.0 Update 8
Kerio Personal Firewall 2.1.5
Last.fm [removed]
Launch Manager
McAfee SiteAdvisor
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Office Professional Edition 2003
Microsoft User-Mode Driver Framework Feature Pack 1.0
MINITAB 14 Student
Mozilla Firefox (2.0.0.5)
MSXML 4.0 SP2 (KB927978)
MusicBrainz Picard 0.7.2
Musicmatch® Jukebox
NTI Backup NOW! 4
NTI CD & DVD-Maker Gold
OpenSSL 0.9.6m
Power Tab Editor 1.7
PowerProducer
QuickTime
RealPlayer
Realtek AC'97 Audio
SiS 900 PCI Fast Ethernet Adapter Driver
SiS VGA Utilities
SiSAGP driver
Snood for Windows version 3.52-W
SpeedFan (remove only)
Spybot - Search & Destroy 1.4
SpywareBlaster v3.5.1
Starsiege (1.004)
Synaptics Pointing Device Driver
Total Annihilation
Trillian
Uniblue RegistryBooster 2
Winamp (remove only)
WinBoard
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Player 11
Windows Media Player 11
WinRAR archiver
Wolfenstein - Enemy Territory

Now the log from ComboFix (NOTE: The first time I ran it I wasn't disconnected from the internet as I didn't see that bit at the bottom of your post; I ran it again, making sure to disconnect from the internet, after I did the AVG scan in safe mode, so I'll be posting both logs.) Here's the first time I ran it:

ComboFix 07-07-30.2 - "Josh Coppola" 2007-07-30 12:29:45.1 [GMT -4:00] - FAT32
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.True
* Created a new restore point

/wow section - STAGE #6I

(((((((((((((((((((((((((((((((((((((((((((( V Log )))))))))))))))))))))))))))))))))))))))))))))))))))))))

* * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

C:\WINDOWS\system32\cijncij.dll
C:\WINDOWS\system32\cijncij.dll.bak
C:\WINDOWS\system32\drivers\uotmnzrw.sys

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

——-\LEGACY_BEQQKHRL
——-\LEGACY_IOP53
——-\LEGACY_LKZZOSSM
——-\beqqkhrl
——-\lkzzossm

((((((((((((((((((((((((( Files Created from 2007-06-28 to 2007-07-30 )))))))))))))))))))))))))))))))

2007-07-30 12:29 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-07-30 12:25 10,872 –a—— C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-07-29 23:34 d——– C:\Hjt
2007-07-29 23:27 d——– C:\VundoFix Backups
2007-07-29 19:26 d——– C:\Program Files\Uniblue
2007-07-29 19:26 d——– C:\DOCUME~1\JOSHCO~1\APPLIC~1\Uniblue
2007-07-25 00:50 d——– C:\Temp\backups
2007-07-25 00:47 1,308,216 –a—— C:\Temp\Spyware.exe
2007-07-25 00:26 512 –a—— C:\drmHeader.bin
2007-07-24 14:53 94,208 –a—— C:\WINDOWS\system32\tkexuwqe.dll
2007-07-24 14:53 751,616 –a—— C:\WINDOWS\system32\hdrstqbl.dll
2007-07-24 14:53 63,488 –a—— C:\WINDOWS\system32\svniwljq.dll
2007-07-24 14:53 41,984 –a—— C:\WINDOWS\system32\qmshksed.dll
2007-07-24 14:53 122,880 –a—— C:\WINDOWS\system32\ropiqkft.dll
2007-07-24 14:49 2,720,456 –a—— C:\Temp\ccsetup141.exe
2007-07-24 14:34 168,960 –a—— C:\WINDOWS\system32\drivers\Iop53.sys
2007-07-24 14:33 84,696 –a—— C:\WINDOWS\system32\loghour.dll
2007-07-24 14:33 168,960 –a—— C:\WINDOWS\system32\drivers\symavc32.sys
2007-07-16 22:44 d——– C:\Program Files\iPod
2007-07-16 22:43 d——– C:\Program Files\QuickTime
2007-07-16 22:42 d——– C:\WINDOWS\system32\DRVSTORE
2007-07-16 22:42 d——– C:\Program Files\Common Files\Apple
2007-07-16 22:42 d——– C:\Program Files\Apple Software Update
2007-07-16 22:42 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple
2007-07-16 22:40 49,943,864 –a—— C:\Temp\iTunesSetup.exe
2007-06-27 18:27 4,734,288 –a—— C:\Temp\AWCSetup.exe
2007-06-16 23:09 d–hs—- C:\FOUND.007
2007-06-14 21:31 5,632 –a—— C:\WINDOWS\system32\ptpusb.dll
2007-06-14 21:31 159,232 –a—— C:\WINDOWS\system32\ptpusd.dll
2007-06-14 21:31 15,104 –a—— C:\WINDOWS\system32\drivers\usbscan.sys
2007-06-11 22:21 d——– C:\DOCUME~1\JOSHCO~1\APPLIC~1\uTorrent
2007-06-11 11:58 d–hs—- C:\FOUND.006
2007-06-08 22:53 d–hs—- C:\FOUND.005
2007-06-03 20:10 d–hs—- C:\FOUND.004
2007-06-01 18:44 d–hs—- C:\FOUND.003

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-06-12 23:27 ——— d——– C:\Program Files\Legends
2007-05-20 22:38 155648 –a—— C:\WINDOWS\system32\libssl32.dll

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{474EC871-E0E2-4F5E-B842-08B7F4E47ADF}]
2007-07-24 14:53 63488 –a—— c:\windows\system32\svniwljq.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7A4794A7-4A4A-347A-4174-24A7A478B47E}]
C:\WINDOWS\system\wasctn32.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A78E89D9-8068-48ED-8F4E-B7AFD557C0FF}]
2004-08-04 05:00 84696 –a—— C:\WINDOWS\system32\loghour.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A9E0DC2C-9B4F-4C59-9C9E-B48ABE7BB539}]
c:\windows\system32\cijncij.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"eRecoveryService"="C:\Acer\Empowering Technology\eRecovery\Monitor.exe" [2005-11-16 16:54]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 05:25]
"SiSPower"="SiSPower.dll" [2005-07-13 02:55 C:\WINDOWS\system32\SiSPower.dll]
"SiteAdvisor"="C:\Program Files\SiteAdvisor\6066\SiteAdv.exe" [2006-07-31 11:03]
"SmartDefrag"="C:\Program Files\IObit\IObit SmartDefrag\IObit SmartDefrag.exe" [2007-06-06 19:22]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-04-02 11:12]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 06:24]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Last.fm Helper.lnk - C:\Program Files\Last.fm\LastFMHelper.exe [2007-07-13 11:43:32]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"LinkResolveIgnoreLinkInfo"=0 (0x0)
"NoResolveSearch"=1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"LinkResolveIgnoreLinkInfo"=0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\System Reserved]
@="Driver Group"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Utility Tray.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Utility Tray.lnk
backup=C:\WINDOWS\pss\Utility Tray.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\a-squared]
"C:\Program Files\a2\a2guard.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AGRSMMSG]
AGRSMMSG.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]
"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
"C:\Program Files\iTunes\iTunesHelper.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
%systemroot%\system32\dumprep 0 -k

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LaunchApp]
Alaunch

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LManager]
C:\Program Files\Launch Manager\QtZgAcer.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MimBoot]
C:\PROGRA~1\MUSICM~1\MUSICM~1\mimboot.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MMTray]
"C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSPY2002]
C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCMService]
"C:\Program Files\Arcade\PCMService.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002A]
C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync]
C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
"C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPLpr]
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"iPod Service"=3 (0x3)
"Fax"=2 (0x2)
"IDriverT"=3 (0x3)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" -atboottime

R0 gagp30kx;Microsoft Generic AGPv3.0 Filter for K8 Processor Platforms;C:\WINDOWS\system32\DRIVERS\gagp30kx.sys
R0 speedfan;speedfan;C:\WINDOWS\system32\speedfan.sys
R1 AmdK8;AMD Processor Driver;C:\WINDOWS\system32\DRIVERS\AmdK8.sys
R1 fwdrv;Kerio Personal Firewall Driver;C:\WINDOWS\system32\Drivers\fwdrv.sys
R1 UBHelper;UBHelper;C:\WINDOWS\system32\drivers\UBHelper.sys
R2 int15.sys;int15.sys;\??\C:\Acer\Empowering Technology\eRecovery\int15.sys
R3 DKbFltr;Dritek HotKey Keyboard Filter Driver;C:\WINDOWS\system32\Drivers\DKbFltr.sys
R3 NTIDrvr;Upper Class Filter Driver;C:\WINDOWS\system32\DRIVERS\NTIDrvr.sys
R3 SISNICXP;SiS PCI Fast Ethernet Adapter Driver for NDIS51;C:\WINDOWS\system32\DRIVERS\sisnicxp.sys
R3 SynTP;Synaptics TouchPad Driver;C:\WINDOWS\system32\DRIVERS\SynTP.sys
S0 ntcdrdrv;ntcdrdrv;C:\WINDOWS\system32\DRIVERS\ntcdrdrv.sys
S3 AdWatchDrv;AW Realtime Driver;\??\C:\WINDOWS\system32\drivers\AWRTPD.sys
S3 Jukebox;Jukebox;C:\WINDOWS\system32\DRIVERS\ctpdusb2.sys
S3 wltwo51b;2Wire Wireless USB adapter Driver;C:\WINDOWS\system32\DRIVERS\wltwo51b.sys

Contents of the 'Scheduled Tasks' folder
2007-07-30 03:21:18 C:\WINDOWS\Tasks\At1.job
2007-07-30 03:23:10 C:\WINDOWS\Tasks\At2.job - C:\DOCUME~1\JOSHCO~1\Desktop\Look2Me-Destroyer.exe

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-30 12:33:31
Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-07-30 12:34:24 - machine was rebooted
C:\ComboFix-quarantined-files.txt … 2007-07-30 12:34

— E O F —

Here's the Second time, after I ran AVG and made sure to disconnect from the internet:

ComboFix 07-07-30.2 - "Josh Coppola" 2007-07-30 13:24:04.2 [GMT -4:00] - FAT32
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.True

((((((((((((((((((((((((( Files Created from 2007-06-28 to 2007-07-30 )))))))))))))))))))))))))))))))

2007-07-30 12:29 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-07-30 12:25 10,872 –a—— C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-07-29 23:34 d——– C:\Hjt
2007-07-29 23:27 d——– C:\VundoFix Backups
2007-07-29 19:26 d——– C:\Program Files\Uniblue
2007-07-29 19:26 d——– C:\DOCUME~1\JOSHCO~1\APPLIC~1\Uniblue
2007-07-25 00:50 d——– C:\Temp\backups
2007-07-25 00:47 1,308,216 –a—— C:\Temp\Spyware.exe
2007-07-25 00:26 512 –a—— C:\drmHeader.bin
2007-07-24 14:53 94,208 –a—— C:\WINDOWS\system32\tkexuwqe.dll
2007-07-24 14:53 751,616 –a—— C:\WINDOWS\system32\hdrstqbl.dll
2007-07-24 14:53 63,488 –a—— C:\WINDOWS\system32\svniwljq.dll
2007-07-24 14:53 41,984 –a—— C:\WINDOWS\system32\qmshksed.dll
2007-07-24 14:53 122,880 –a—— C:\WINDOWS\system32\ropiqkft.dll
2007-07-24 14:49 2,720,456 –a—— C:\Temp\ccsetup141.exe
2007-07-24 14:34 168,960 –a—— C:\WINDOWS\system32\drivers\Iop53.sys
2007-07-24 14:33 84,696 –a—— C:\WINDOWS\system32\loghour.dll
2007-07-24 14:33 168,960 –a—— C:\WINDOWS\system32\drivers\symavc32.sys
2007-07-16 22:44 d——– C:\Program Files\iPod
2007-07-16 22:43 d——– C:\Program Files\QuickTime
2007-07-16 22:42 d——– C:\WINDOWS\system32\DRVSTORE
2007-07-16 22:42 d——– C:\Program Files\Common Files\Apple
2007-07-16 22:42 d——– C:\Program Files\Apple Software Update
2007-07-16 22:42 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple
2007-07-16 22:40 49,943,864 –a—— C:\Temp\iTunesSetup.exe
2007-06-27 18:27 4,734,288 –a—— C:\Temp\AWCSetup.exe
2007-06-16 23:09 d–hs—- C:\FOUND.007
2007-06-14 21:31 5,632 –a—— C:\WINDOWS\system32\ptpusb.dll
2007-06-14 21:31 159,232 –a—— C:\WINDOWS\system32\ptpusd.dll
2007-06-14 21:31 15,104 –a—— C:\WINDOWS\system32\drivers\usbscan.sys
2007-06-11 22:21 d——– C:\DOCUME~1\JOSHCO~1\APPLIC~1\uTorrent
2007-06-11 11:58 d–hs—- C:\FOUND.006
2007-06-08 22:53 d–hs—- C:\FOUND.005
2007-06-03 20:10 d–hs—- C:\FOUND.004
2007-06-01 18:44 d–hs—- C:\FOUND.003

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-06-12 23:27 ——— d——– C:\Program Files\Legends
2007-05-20 22:38 155648 –a—— C:\WINDOWS\system32\libssl32.dll

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{474EC871-E0E2-4F5E-B842-08B7F4E47ADF}]
2007-07-24 14:53 63488 –a—— c:\windows\system32\svniwljq.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7A4794A7-4A4A-347A-4174-24A7A478B47E}]
C:\WINDOWS\system\wasctn32.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A78E89D9-8068-48ED-8F4E-B7AFD557C0FF}]
2004-08-04 05:00 84696 –a—— C:\WINDOWS\system32\loghour.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A9E0DC2C-9B4F-4C59-9C9E-B48ABE7BB539}]
c:\windows\system32\cijncij.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"eRecoveryService"="C:\Acer\Empowering Technology\eRecovery\Monitor.exe" [2005-11-16 16:54]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 05:25]
"SiSPower"="SiSPower.dll" [2005-07-13 02:55 C:\WINDOWS\system32\SiSPower.dll]
"SiteAdvisor"="C:\Program Files\SiteAdvisor\6066\SiteAdv.exe" [2006-07-31 11:03]
"SmartDefrag"="C:\Program Files\IObit\IObit SmartDefrag\IObit SmartDefrag.exe" [2007-06-06 19:22]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-04-02 11:12]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 06:24]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Last.fm Helper.lnk - C:\Program Files\Last.fm\LastFMHelper.exe [2007-07-13 11:43:32]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"LinkResolveIgnoreLinkInfo"=0 (0x0)
"NoResolveSearch"=1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"LinkResolveIgnoreLinkInfo"=0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\System Reserved]
@="Driver Group"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Utility Tray.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Utility Tray.lnk
backup=C:\WINDOWS\pss\Utility Tray.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\a-squared]
"C:\Program Files\a2\a2guard.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AGRSMMSG]
AGRSMMSG.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]
"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
"C:\Program Files\iTunes\iTunesHelper.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
%systemroot%\system32\dumprep 0 -k

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LaunchApp]
Alaunch

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LManager]
C:\Program Files\Launch Manager\QtZgAcer.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MimBoot]
C:\PROGRA~1\MUSICM~1\MUSICM~1\mimboot.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MMTray]
"C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSPY2002]
C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCMService]
"C:\Program Files\Arcade\PCMService.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002A]
C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync]
C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
"C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPLpr]
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"iPod Service"=3 (0x3)
"Fax"=2 (0x2)
"IDriverT"=3 (0x3)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" -atboottime

R0 gagp30kx;Microsoft Generic AGPv3.0 Filter for K8 Processor Platforms;C:\WINDOWS\system32\DRIVERS\gagp30kx.sys
R0 speedfan;speedfan;C:\WINDOWS\system32\speedfan.sys
R1 AmdK8;AMD Processor Driver;C:\WINDOWS\system32\DRIVERS\AmdK8.sys
R1 fwdrv;Kerio Personal Firewall Driver;C:\WINDOWS\system32\Drivers\fwdrv.sys
R1 UBHelper;UBHelper;C:\WINDOWS\system32\drivers\UBHelper.sys
R2 int15.sys;int15.sys;\??\C:\Acer\Empowering Technology\eRecovery\int15.sys
R3 DKbFltr;Dritek HotKey Keyboard Filter Driver;C:\WINDOWS\system32\Drivers\DKbFltr.sys
R3 NTIDrvr;Upper Class Filter Driver;C:\WINDOWS\system32\DRIVERS\NTIDrvr.sys
R3 SISNICXP;SiS PCI Fast Ethernet Adapter Driver for NDIS51;C:\WINDOWS\system32\DRIVERS\sisnicxp.sys
R3 SynTP;Synaptics TouchPad Driver;C:\WINDOWS\system32\DRIVERS\SynTP.sys
S0 ntcdrdrv;ntcdrdrv;C:\WINDOWS\system32\DRIVERS\ntcdrdrv.sys
S3 AdWatchDrv;AW Realtime Driver;\??\C:\WINDOWS\system32\drivers\AWRTPD.sys
S3 Jukebox;Jukebox;C:\WINDOWS\system32\DRIVERS\ctpdusb2.sys
S3 wltwo51b;2Wire Wireless USB adapter Driver;C:\WINDOWS\system32\DRIVERS\wltwo51b.sys

*Newly Created Service* - INT15.SYS

Contents of the 'Scheduled Tasks' folder
2007-07-30 03:21:18 C:\WINDOWS\Tasks\At1.job
2007-07-30 03:23:10 C:\WINDOWS\Tasks\At2.job - C:\DOCUME~1\JOSHCO~1\Desktop\Look2Me-Destroyer.exe

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-30 13:25:23
Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-07-30 13:25:51
C:\ComboFix-quarantined-files.txt … 2007-07-30 13:25
C:\ComboFix2.txt … 2007-07-30 12:34

— E O F —

Here's the safe-mode AVG log:

———————————————————
AVG Anti-Spyware - Scan Report
———————————————————

+ Created at: 1:19:34 PM 7/30/2007

+ Scan result:

C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP6\A0003101.dll -> Logger.Agent.ir : Cleaned.
:mozilla.107:C:\Documents and Settings\Josh Coppola\Application Data\Mozilla\Firefox\Profiles\mfyfmb8z.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.108:C:\Documents and Settings\Josh Coppola\Application Data\Mozilla\Firefox\Profiles\mfyfmb8z.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.150:C:\Documents and Settings\Josh Coppola\Application Data\Mozilla\Firefox\Profiles\mfyfmb8z.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.293:C:\Documents and Settings\Josh Coppola\Application Data\Mozilla\Firefox\Profiles\mfyfmb8z.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.294:C:\Documents and Settings\Josh Coppola\Application Data\Mozilla\Firefox\Profiles\mfyfmb8z.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.35:C:\Documents and Settings\Josh Coppola\Application Data\Mozilla\Firefox\Profiles\mfyfmb8z.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.36:C:\Documents and Settings\Josh Coppola\Application Data\Mozilla\Firefox\Profiles\mfyfmb8z.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.37:C:\Documents and Settings\Josh Coppola\Application Data\Mozilla\Firefox\Profiles\mfyfmb8z.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.38:C:\Documents and Settings\Josh Coppola\Application Data\Mozilla\Firefox\Profiles\mfyfmb8z.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.39:C:\Documents and Settings\Josh Coppola\Application Data\Mozilla\Firefox\Profiles\mfyfmb8z.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.40:C:\Documents and Settings\Josh Coppola\Application Data\Mozilla\Firefox\Profiles\mfyfmb8z.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.41:C:\Documents and Settings\Josh Coppola\Application Data\Mozilla\Firefox\Profiles\mfyfmb8z.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.109:C:\Documents and Settings\Josh Coppola\Application Data\Mozilla\Firefox\Profiles\mfyfmb8z.default\cookies.txt -> TrackingCookie.Burstbeacon : Cleaned.
:mozilla.126:C:\Documents and Settings\Josh Coppola\Application Data\Mozilla\Firefox\Profiles\mfyfmb8z.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned.
:mozilla.128:C:\Documents and Settings\Josh Coppola\Application Data\Mozilla\Firefox\Profiles\mfyfmb8z.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned.
:mozilla.129:C:\Documents and Settings\Josh Coppola\Application Data\Mozilla\Firefox\Profiles\mfyfmb8z.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned.
:mozilla.361:C:\Documents and Settings\Josh Coppola\Application Data\Mozilla\Firefox\Profiles\mfyfmb8z.default\cookies.txt -> TrackingCookie.Com : Cleaned.
:mozilla.288:C:\Documents and Settings\Josh Coppola\Application Data\Mozilla\Firefox\Profiles\mfyfmb8z.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned.
:mozilla.289:C:\Documents and Settings\Josh Coppola\Application Data\Mozilla\Firefox\Profiles\mfyfmb8z.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned.
:mozilla.290:C:\Documents and Settings\Josh Coppola\Application Data\Mozilla\Firefox\Profiles\mfyfmb8z.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned.
:mozilla.291:C:\Documents and Settings\Josh Coppola\Application Data\Mozilla\Firefox\Profiles\mfyfmb8z.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned.
:mozilla.292:C:\Documents and Settings\Josh Coppola\Application Data\Mozilla\Firefox\Profiles\mfyfmb8z.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned.
:mozilla.24:C:\Documents and Settings\Josh Coppola\Application Data\Mozilla\Firefox\Profiles\mfyfmb8z.default\cookies.txt -> TrackingCookie.Imrworldwide : Cleaned.
:mozilla.25:C:\Documents and Settings\Josh Coppola\Application Data\Mozilla\Firefox\Profiles\mfyfmb8z.default\cookies.txt -> TrackingCookie.Imrworldwide : Cleaned.
:mozilla.430:C:\Documents and Settings\Josh Coppola\Application Data\Mozilla\Firefox\Profiles\mfyfmb8z.default\cookies.txt -> TrackingCookie.Intelli-direct : Cleaned.
:mozilla.12:C:\Documents and Settings\Josh Coppola\Application Data\Mozilla\Firefox\Profiles\mfyfmb8z.default\cookies.txt -> TrackingCookie.Netflame : Cleaned.
:mozilla.489:C:\Documents and Settings\Josh Coppola\Application Data\Mozilla\Firefox\Profiles\mfyfmb8z.default\cookies.txt -> TrackingCookie.Oewabox : Cleaned.
:mozilla.196:C:\Documents and Settings\Josh Coppola\Application Data\Mozilla\Firefox\Profiles\mfyfmb8z.default\cookies.txt -> TrackingCookie.Paypal : Cleaned.
:mozilla.100:C:\Documents and Settings\Josh Coppola\Application Data\Mozilla\Firefox\Profiles\mfyfmb8z.default\cookies.txt -> TrackingCookie.Realmedia : Cleaned.
:mozilla.101:C:\Documents and Settings\Josh Coppola\Application Data\Mozilla\Firefox\Profiles\mfyfmb8z.default\cookies.txt -> TrackingCookie.Realmedia : Cleaned.
:mozilla.96:C:\Documents and Settings\Josh Coppola\Application Data\Mozilla\Firefox\Profiles\mfyfmb8z.default\cookies.txt -> TrackingCookie.Realmedia : Cleaned.
:mozilla.97:C:\Documents and Settings\Josh Coppola\Application Data\Mozilla\Firefox\Profiles\mfyfmb8z.default\cookies.txt -> TrackingCookie.Realmedia : Cleaned.
:mozilla.98:C:\Documents and Settings\Josh Coppola\Application Data\Mozilla\Firefox\Profiles\mfyfmb8z.default\cookies.txt -> TrackingCookie.Realmedia : Cleaned.
:mozilla.99:C:\Documents and Settings\Josh Coppola\Application Data\Mozilla\Firefox\Profiles\mfyfmb8z.default\cookies.txt -> TrackingCookie.Realmedia : Cleaned.
:mozilla.520:C:\Documents and Settings\Josh Coppola\Application Data\Mozilla\Firefox\Profiles\mfyfmb8z.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.521:C:\Documents and Settings\Josh Coppola\Application Data\Mozilla\Firefox\Profiles\mfyfmb8z.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.522:C:\Documents and Settings\Josh Coppola\Application Data\Mozilla\Firefox\Profiles\mfyfmb8z.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.523:C:\Documents and Settings\Josh Coppola\Application Data\Mozilla\Firefox\Profiles\mfyfmb8z.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.524:C:\Documents and Settings\Josh Coppola\Application Data\Mozilla\Firefox\Profiles\mfyfmb8z.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.525:C:\Documents and Settings\Josh Coppola\Application Data\Mozilla\Firefox\Profiles\mfyfmb8z.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.526:C:\Documents and Settings\Josh Coppola\Application Data\Mozilla\Firefox\Profiles\mfyfmb8z.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.527:C:\Documents and Settings\Josh Coppola\Application Data\Mozilla\Firefox\Profiles\mfyfmb8z.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.528:C:\Documents and Settings\Josh Coppola\Application Data\Mozilla\Firefox\Profiles\mfyfmb8z.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.529:C:\Documents and Settings\Josh Coppola\Application Data\Mozilla\Firefox\Profiles\mfyfmb8z.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.530:C:\Documents and Settings\Josh Coppola\Application Data\Mozilla\Firefox\Profiles\mfyfmb8z.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.531:C:\Documents and Settings\Josh Coppola\Application Data\Mozilla\Firefox\Profiles\mfyfmb8z.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.160:C:\Documents and Settings\Josh Coppola\Application Data\Mozilla\Firefox\Profiles\mfyfmb8z.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.161:C:\Documents and Settings\Josh Coppola\Application Data\Mozilla\Firefox\Profiles\mfyfmb8z.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.162:C:\Documents and Settings\Josh Coppola\Application Data\Mozilla\Firefox\Profiles\mfyfmb8z.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.163:C:\Documents and Settings\Josh Coppola\Application Data\Mozilla\Firefox\Profiles\mfyfmb8z.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.164:C:\Documents and Settings\Josh Coppola\Application Data\Mozilla\Firefox\Profiles\mfyfmb8z.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.165:C:\Documents and Settings\Josh Coppola\Application Data\Mozilla\Firefox\Profiles\mfyfmb8z.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.104:C:\Documents and Settings\Josh Coppola\Application Data\Mozilla\Firefox\Profiles\mfyfmb8z.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.110:C:\Documents and Settings\Josh Coppola\Application Data\Mozilla\Firefox\Profiles\mfyfmb8z.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.116:C:\Documents and Settings\Josh Coppola\Application Data\Mozilla\Firefox\Profiles\mfyfmb8z.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.117:C:\Documents and Settings\Josh Coppola\Application Data\Mozilla\Firefox\Profiles\mfyfmb8z.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.118:C:\Documents and Settings\Josh Coppola\Application Data\Mozilla\Firefox\Profiles\mfyfmb8z.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.120:C:\Documents and Settings\Josh Coppola\Application Data\Mozilla\Firefox\Profiles\mfyfmb8z.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.125:C:\Documents and Settings\Josh Coppola\Application Data\Mozilla\Firefox\Profiles\mfyfmb8z.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.586:C:\Documents and Settings\Josh Coppola\Application Data\Mozilla\Firefox\Profiles\mfyfmb8z.default\cookies.txt -> TrackingCookie.Web-stat : Cleaned.
:mozilla.587:C:\Documents and Settings\Josh Coppola\Application Data\Mozilla\Firefox\Profiles\mfyfmb8z.default\cookies.txt -> TrackingCookie.Web-stat : Cleaned.
:mozilla.596:C:\Documents and Settings\Josh Coppola\Application Data\Mozilla\Firefox\Profiles\mfyfmb8z.default\cookies.txt -> TrackingCookie.Yadro : Cleaned.
:mozilla.26:C:\Documents and Settings\Josh Coppola\Application Data\Mozilla\Firefox\Profiles\mfyfmb8z.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.27:C:\Documents and Settings\Josh Coppola\Application Data\Mozilla\Firefox\Profiles\mfyfmb8z.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.28:C:\Documents and Settings\Josh Coppola\Application Data\Mozilla\Firefox\Profiles\mfyfmb8z.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.29:C:\Documents and Settings\Josh Coppola\Application Data\Mozilla\Firefox\Profiles\mfyfmb8z.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.30:C:\Documents and Settings\Josh Coppola\Application Data\Mozilla\Firefox\Profiles\mfyfmb8z.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.197:C:\Documents and Settings\Josh Coppola\Application Data\Mozilla\Firefox\Profiles\mfyfmb8z.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.
:mozilla.198:C:\Documents and Settings\Josh Coppola\Application Data\Mozilla\Firefox\Profiles\mfyfmb8z.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.
:mozilla.199:C:\Documents and Settings\Josh Coppola\Application Data\Mozilla\Firefox\Profiles\mfyfmb8z.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.

::Report end

And now for the HijackThis log:

Logfile of HijackThis v1.99.1
Scan saved at 1:31:11 PM, on 7/30/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\a-squared free\a2service.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Kerio\Personal Firewall\persfw.exe
C:\Program Files\SiteAdvisor\6066\SAService.exe
C:\WINDOWS\system32\svchost.exe
C:\Acer\Empowering Technology\eRecovery\Monitor.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\SiteAdvisor\6066\SiteAdv.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Last.fm\LastFMHelper.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\explorer.exe
C:\Hjt\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://global.acer.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6066\SiteAdv.dll
O2 - BHO: (no name) - {474EC871-E0E2-4F5E-B842-08B7F4E47ADF} - c:\windows\system32\svniwljq.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O2 - BHO: Internet Explorer - {7A4794A7-4A4A-347A-4174-24A7A478B47E} - C:\WINDOWS\system\wasctn32.dll (file missing)
O2 - BHO: (no name) - {A78E89D9-8068-48ED-8F4E-B7AFD557C0FF} - C:\WINDOWS\system32\loghour.dll
O2 - BHO: (no name) - {A9E0DC2C-9B4F-4C59-9C9E-B48ABE7BB539} - c:\windows\system32\cijncij.dll (file missing)
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6066\SiteAdv.dll
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\Monitor.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6066\SiteAdv.exe
O4 - HKLM\..\Run: [SmartDefrag] "C:\Program Files\IObit\IObit SmartDefrag\IObit SmartDefrag.exe" /startup
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - Global Startup: Last.fm Helper.lnk = C:\Program Files\Last.fm\LastFMHelper.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O16 - DPF: {556DDE35-E955-11D0-A707-000000521957} - http://www.xblock.com/download/xclean_micro.exe
O18 - Protocol: siteadvisor - {3A5DC592-7723-4EAA-9EE6-AF4222BCF879} - C:\Program Files\SiteAdvisor\6066\SiteAdv.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - c:\program files\a-squared free\a2service.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Kerio Personal Firewall (PersFw) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall\persfw.exe
O23 - Service: SiteAdvisor Service - McAfee, Inc. - C:\Program Files\SiteAdvisor\6066\SAService.exe

Thank you for your quick reply and general helpfulness!

Scotty

Post #4July 30, 2007, 6:33 PM UTC

Hello Clownmite

Open Notepad and Copy/Paste the text in the codebox below into it:

File::
C:\WINDOWS\system32\tkexuwqe.dll
C:\WINDOWS\system32\hdrstqbl.dll
C:\WINDOWS\system32\svniwljq.dll
C:\WINDOWS\system32\qmshksed.dll
C:\WINDOWS\system32\ropiqkft.dll
C:\WINDOWS\system32\drivers\Iop53.sys
C:\WINDOWS\system32\loghour.dll
C:\WINDOWS\system32\drivers\symavc32.sys

Folder::
C:\VundoFix Backups
C:\FOUND.007
C:\FOUND.006
C:\FOUND.005
C:\FOUND.004
C:\FOUND.003

Registry::
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{474EC871-E0E2-4F5E-B842-08B7F4E47ADF}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7A4794A7-4A4A-347A-4174-24A7A478B47E}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A78E89D9-8068-48ED-8F4E-B7AFD557C0FF}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A9E0DC2C-9B4F-4C59-9C9E-B48ABE7BB539}]

Save this as "CFScript"

[external image: Posted Image]

Refering to the picture above, drag CFScript into ComboFix.exe
Then post the resultant log with a new HijackThis log. <— run after the ComboScript

Clownmite

Post #5July 30, 2007, 7:03 PM UTC

Here's the ComboFix log:

ComboFix 07-07-30.2 - "Josh Coppola" 2007-07-30 14:58:33.3 [GMT -4:00] - FAT32
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.True
Command switches used :: C:\Documents and Settings\Josh Coppola\Desktop\CFScript.txt
* Created a new restore point

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

C:\FOUND.003
C:\FOUND.003\FILE0000.CHK
C:\FOUND.004
C:\FOUND.004\FILE0000.CHK
C:\FOUND.004\FILE0001.CHK
C:\FOUND.005
C:\FOUND.005\FILE0000.CHK
C:\FOUND.006
C:\FOUND.006\FILE0000.CHK
C:\FOUND.007
C:\FOUND.007\FILE0000.CHK
C:\VundoFix Backups
C:\WINDOWS\system32\drivers\Iop53.sys
C:\WINDOWS\system32\drivers\symavc32.sys
C:\WINDOWS\system32\hdrstqbl.dll
C:\WINDOWS\system32\loghour.dll
C:\WINDOWS\system32\qmshksed.dll
C:\WINDOWS\system32\ropiqkft.dll
C:\WINDOWS\system32\svniwljq.dll
C:\WINDOWS\system32\tkexuwqe.dll

((((((((((((((((((((((((( Files Created from 2007-06-28 to 2007-07-30 )))))))))))))))))))))))))))))))

2007-07-30 12:29 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-07-30 12:25 10,872 –a—— C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-07-29 23:34 d——– C:\Hjt
2007-07-29 19:26 d——– C:\Program Files\Uniblue
2007-07-29 19:26 d——– C:\DOCUME~1\JOSHCO~1\APPLIC~1\Uniblue
2007-07-25 00:50 d——– C:\Temp\backups
2007-07-25 00:47 1,308,216 –a—— C:\Temp\Spyware.exe
2007-07-25 00:26 512 –a—— C:\drmHeader.bin
2007-07-24 14:49 2,720,456 –a—— C:\Temp\ccsetup141.exe
2007-07-16 22:44 d——– C:\Program Files\iPod
2007-07-16 22:43 d——– C:\Program Files\QuickTime
2007-07-16 22:42 d——– C:\WINDOWS\system32\DRVSTORE
2007-07-16 22:42 d——– C:\Program Files\Common Files\Apple
2007-07-16 22:42 d——– C:\Program Files\Apple Software Update
2007-07-16 22:42 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple
2007-07-16 22:40 49,943,864 –a—— C:\Temp\iTunesSetup.exe
2007-06-27 18:27 4,734,288 –a—— C:\Temp\AWCSetup.exe
2007-06-14 21:31 5,632 –a—— C:\WINDOWS\system32\ptpusb.dll
2007-06-14 21:31 159,232 –a—— C:\WINDOWS\system32\ptpusd.dll
2007-06-14 21:31 15,104 –a—— C:\WINDOWS\system32\drivers\usbscan.sys
2007-06-11 22:21 d——– C:\DOCUME~1\JOSHCO~1\APPLIC~1\uTorrent

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-06-12 23:27 ——— d——– C:\Program Files\Legends
2007-05-20 22:38 155648 –a—— C:\WINDOWS\system32\libssl32.dll

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{474EC871-E0E2-4F5E-B842-08B7F4E47ADF}]
c:\windows\system32\svniwljq.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7A4794A7-4A4A-347A-4174-24A7A478B47E}]
C:\WINDOWS\system\wasctn32.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A78E89D9-8068-48ED-8F4E-B7AFD557C0FF}]
C:\WINDOWS\system32\loghour.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A9E0DC2C-9B4F-4C59-9C9E-B48ABE7BB539}]
c:\windows\system32\cijncij.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"eRecoveryService"="C:\Acer\Empowering Technology\eRecovery\Monitor.exe" [2005-11-16 16:54]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 05:25]
"SiSPower"="SiSPower.dll" [2005-07-13 02:55 C:\WINDOWS\system32\SiSPower.dll]
"SiteAdvisor"="C:\Program Files\SiteAdvisor\6066\SiteAdv.exe" [2006-07-31 11:03]
"SmartDefrag"="C:\Program Files\IObit\IObit SmartDefrag\IObit SmartDefrag.exe" [2007-06-06 19:22]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-04-02 11:12]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 06:24]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Last.fm Helper.lnk - C:\Program Files\Last.fm\LastFMHelper.exe [2007-07-13 11:43:32]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"LinkResolveIgnoreLinkInfo"=0 (0x0)
"NoResolveSearch"=1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"LinkResolveIgnoreLinkInfo"=0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\System Reserved]
@="Driver Group"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Utility Tray.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Utility Tray.lnk
backup=C:\WINDOWS\pss\Utility Tray.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\a-squared]
"C:\Program Files\a2\a2guard.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AGRSMMSG]
AGRSMMSG.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]
"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
"C:\Program Files\iTunes\iTunesHelper.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
%systemroot%\system32\dumprep 0 -k

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LaunchApp]
Alaunch

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LManager]
C:\Program Files\Launch Manager\QtZgAcer.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MimBoot]
C:\PROGRA~1\MUSICM~1\MUSICM~1\mimboot.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MMTray]
"C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSPY2002]
C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCMService]
"C:\Program Files\Arcade\PCMService.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002A]
C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync]
C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
"C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPLpr]
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"iPod Service"=3 (0x3)
"Fax"=2 (0x2)
"IDriverT"=3 (0x3)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" -atboottime

R0 gagp30kx;Microsoft Generic AGPv3.0 Filter for K8 Processor Platforms;C:\WINDOWS\system32\DRIVERS\gagp30kx.sys
R0 speedfan;speedfan;C:\WINDOWS\system32\speedfan.sys
R1 AmdK8;AMD Processor Driver;C:\WINDOWS\system32\DRIVERS\AmdK8.sys
R1 fwdrv;Kerio Personal Firewall Driver;C:\WINDOWS\system32\Drivers\fwdrv.sys
R1 UBHelper;UBHelper;C:\WINDOWS\system32\drivers\UBHelper.sys
R2 int15.sys;int15.sys;\??\C:\Acer\Empowering Technology\eRecovery\int15.sys
R3 DKbFltr;Dritek HotKey Keyboard Filter Driver;C:\WINDOWS\system32\Drivers\DKbFltr.sys
R3 NTIDrvr;Upper Class Filter Driver;C:\WINDOWS\system32\DRIVERS\NTIDrvr.sys
R3 SISNICXP;SiS PCI Fast Ethernet Adapter Driver for NDIS51;C:\WINDOWS\system32\DRIVERS\sisnicxp.sys
R3 SynTP;Synaptics TouchPad Driver;C:\WINDOWS\system32\DRIVERS\SynTP.sys
S0 ntcdrdrv;ntcdrdrv;C:\WINDOWS\system32\DRIVERS\ntcdrdrv.sys
S3 AdWatchDrv;AW Realtime Driver;\??\C:\WINDOWS\system32\drivers\AWRTPD.sys
S3 Jukebox;Jukebox;C:\WINDOWS\system32\DRIVERS\ctpdusb2.sys
S3 wltwo51b;2Wire Wireless USB adapter Driver;C:\WINDOWS\system32\DRIVERS\wltwo51b.sys

*Newly Created Service* - INT15.SYS

Contents of the 'Scheduled Tasks' folder
2007-07-30 03:21:18 C:\WINDOWS\Tasks\At1.job
2007-07-30 03:23:10 C:\WINDOWS\Tasks\At2.job - C:\DOCUME~1\JOSHCO~1\Desktop\Look2Me-Destroyer.exe

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-30 14:59:13
Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-07-30 14:59:34
C:\ComboFix-quarantined-files.txt … 2007-07-30 14:59
C:\ComboFix3.txt … 2007-07-30 12:34
C:\ComboFix2.txt … 2007-07-30 13:25

— E O F —

And the new HijackThis log:

Logfile of HijackThis v1.99.1
Scan saved at 3:00:40 PM, on 7/30/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\a-squared free\a2service.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Kerio\Personal Firewall\persfw.exe
C:\Program Files\SiteAdvisor\6066\SAService.exe
C:\WINDOWS\system32\svchost.exe
C:\Acer\Empowering Technology\eRecovery\Monitor.exe
C:\Program Files\SiteAdvisor\6066\SiteAdv.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Last.fm\LastFMHelper.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\explorer.exe
C:\Hjt\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://global.acer.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6066\SiteAdv.dll
O2 - BHO: (no name) - {474EC871-E0E2-4F5E-B842-08B7F4E47ADF} - c:\windows\system32\svniwljq.dll (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O2 - BHO: Internet Explorer - {7A4794A7-4A4A-347A-4174-24A7A478B47E} - C:\WINDOWS\system\wasctn32.dll (file missing)
O2 - BHO: (no name) - {A78E89D9-8068-48ED-8F4E-B7AFD557C0FF} - C:\WINDOWS\system32\loghour.dll (file missing)
O2 - BHO: (no name) - {A9E0DC2C-9B4F-4C59-9C9E-B48ABE7BB539} - c:\windows\system32\cijncij.dll (file missing)
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6066\SiteAdv.dll
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\Monitor.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6066\SiteAdv.exe
O4 - HKLM\..\Run: [SmartDefrag] "C:\Program Files\IObit\IObit SmartDefrag\IObit SmartDefrag.exe" /startup
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - Global Startup: Last.fm Helper.lnk = C:\Program Files\Last.fm\LastFMHelper.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O16 - DPF: {556DDE35-E955-11D0-A707-000000521957} - http://www.xblock.com/download/xclean_micro.exe
O18 - Protocol: siteadvisor - {3A5DC592-7723-4EAA-9EE6-AF4222BCF879} - C:\Program Files\SiteAdvisor\6066\SiteAdv.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - c:\program files\a-squared free\a2service.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Kerio Personal Firewall (PersFw) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall\persfw.exe
O23 - Service: SiteAdvisor Service - McAfee, Inc. - C:\Program Files\SiteAdvisor\6066\SAService.exe

Scotty

Post #6July 30, 2007, 7:43 PM UTC

Hello Clownmite

Download ATF (Atribune Temp File) Cleaner© by Atribune to your desktop.

Double-click ATF Cleaner.exe to open it.

Under Main choose:
Windows Temp
Current User Temp
All Users Temp
Cookies
Temporary Internet Files
Prefetch
Java Cache
*The other boxes are optional*
Then click the Empty Selected button.

Firefox:
Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

Opera:
Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

Click Exit on the Main menu to close the program.

Run HijackThis, select Do a system scan only and place checks against the following entries (if they are still present):
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: (no name) - {474EC871-E0E2-4F5E-B842-08B7F4E47ADF} - c:\windows\system32\svniwljq.dll (file missing)
O2 - BHO: Internet Explorer - {7A4794A7-4A4A-347A-4174-24A7A478B47E} - C:\WINDOWS\system\wasctn32.dll (file missing)
O2 - BHO: (no name) - {A78E89D9-8068-48ED-8F4E-B7AFD557C0FF} - C:\WINDOWS\system32\loghour.dll (file missing)
O2 - BHO: (no name) - {A9E0DC2C-9B4F-4C59-9C9E-B48ABE7BB539} - c:\windows\system32\cijncij.dll (file missing)

WITH ALL OTHER WINDOWS CLOSED Click on Fix Checked and exit HijackThis.

Please go HERE to run PandaActiveScan…
Once you are on the Panda site click the Scan your PC button
A new window will open…click the Check Now button
Enter your Country
Enter your State/Province
Enter your e-mail address and click send
Select either Home User or Company
Click the big Scan Now button
If it wants to install an ActiveX component allow it
It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)
When download is complete, click on My Computer to start the scan
When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to your desktop.

Finally, post back with the Panda report and a new HijackThis log.

Clownmite

Post #7July 31, 2007, 3:26 AM UTC

Panda log:

Incident Status Location

Potentially unwanted tool:Application/NirCmd.A Not disinfected C:\WINDOWS\NIRCMD.EXE
Potentially unwanted tool:Application/NirCmd.A Not disinfected C:\Documents and Settings\Josh Coppola\Desktop\ComboFix.exe[nircmd.exe]
Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\Josh Coppola\Application Data\Mozilla\Firefox\Profiles\mfyfmb8z.default\COOKIES.TXT[ad.yieldmanager.com/]
Spyware:Cookie/BurstNet Not disinfected C:\Documents and Settings\Josh Coppola\Application Data\Mozilla\Firefox\Profiles\mfyfmb8z.default\COOKIES.TXT[.burstnet.com/]
Spyware:Cookie/BurstBeacon Not disinfected C:\Documents and Settings\Josh Coppola\Application Data\Mozilla\Firefox\Profiles\mfyfmb8z.default\COOKIES.TXT[www.burstbeacon.com/]
Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Josh Coppola\Application Data\Mozilla\Firefox\Profiles\mfyfmb8z.default\COOKIES.TXT[.realmedia.com/]

HijackThis log:

Logfile of HijackThis v1.99.1
Scan saved at 11:22:17 PM, on 7/30/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\a-squared free\a2service.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Kerio\Personal Firewall\persfw.exe
C:\Program Files\SiteAdvisor\6066\SAService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Acer\Empowering Technology\eRecovery\Monitor.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\SiteAdvisor\6066\SiteAdv.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Last.fm\LastFMHelper.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Hjt\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://global.acer.com
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6066\SiteAdv.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6066\SiteAdv.dll
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\Monitor.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6066\SiteAdv.exe
O4 - HKLM\..\Run: [SmartDefrag] "C:\Program Files\IObit\IObit SmartDefrag\IObit SmartDefrag.exe" /startup
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - Global Startup: Last.fm Helper.lnk = C:\Program Files\Last.fm\LastFMHelper.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O16 - DPF: {556DDE35-E955-11D0-A707-000000521957} - http://www.xblock.com/download/xclean_micro.exe
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O18 - Protocol: siteadvisor - {3A5DC592-7723-4EAA-9EE6-AF4222BCF879} - C:\Program Files\SiteAdvisor\6066\SiteAdv.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - c:\program files\a-squared free\a2service.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Kerio Personal Firewall (PersFw) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall\persfw.exe
O23 - Service: SiteAdvisor Service - McAfee, Inc. - C:\Program Files\SiteAdvisor\6066\SAService.exe

Scotty

Post #8July 31, 2007, 8:43 AM UTC

Hello Clownmite

How is the computer running now?

Please delete Combofix.exe from your Desktop then navigate to this folder C:\Qoobox and delete that. If you have a problem deleting Qoobox, let me know.

I would advise updating Adobe Reader, as the latest version clears up any vulnerabilities of previous versions.
First uninstall the version you have on your computer then download and install Adobe Reader 8.1.

Delete the older versions of Java and download the newest.
Please follow these steps to remove older version Java components.

Close any programmes you may have running, ESPECIALLY your web browser
Click Start > Control Panel.
Click Add/Remove Programs.
Check any item with Java Runtime Environment (JRE or J2SE) in the name.
Click the Remove or Change/Remove button.
Repeat as many times as necessary to remove all versions of Java.
Reboot your computer once all Java components are removed.

Then download the latest version of Java Runtime Environment (JRE) (4th one down the list), which is JRE6u2, and click Yes at the page warning, then accept the Licence Agreement before downloading the Offline file.

Then provide one more HijackThis log for me, please.

Clownmite

Post #9July 31, 2007, 3:23 PM UTC

Well, nothing seemed wrong in the first place, except for something kept trying to access the internet (I denied it of course), which is how I knew I had a virus. The PandaScan picked up 2 hijack/rootkits in the scan, were those in the folder you had me delete or are they still on my computer?

New HijackThis log:

Logfile of HijackThis v1.99.1
Scan saved at 11:11:59 AM, on 7/31/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\a-squared free\a2service.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Kerio\Personal Firewall\persfw.exe
C:\Program Files\SiteAdvisor\6066\SAService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Acer\Empowering Technology\eRecovery\Monitor.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\SiteAdvisor\6066\SiteAdv.exe
C:\Program Files\IObit\IObit SmartDefrag\IObit SmartDefrag.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\Last.fm\LastFMHelper.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\msiexec.exe
C:\Hjt\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://global.acer.com
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6066\SiteAdv.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6066\SiteAdv.dll
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\Monitor.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6066\SiteAdv.exe
O4 - HKLM\..\Run: [SmartDefrag] "C:\Program Files\IObit\IObit SmartDefrag\IObit SmartDefrag.exe" /startup
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - Global Startup: Last.fm Helper.lnk = C:\Program Files\Last.fm\LastFMHelper.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O16 - DPF: {556DDE35-E955-11D0-A707-000000521957} - http://www.xblock.com/download/xclean_micro.exe
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O18 - Protocol: siteadvisor - {3A5DC592-7723-4EAA-9EE6-AF4222BCF879} - C:\Program Files\SiteAdvisor\6066\SiteAdv.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - c:\program files\a-squared free\a2service.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Kerio Personal Firewall (PersFw) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall\persfw.exe
O23 - Service: SiteAdvisor Service - McAfee, Inc. - C:\Program Files\SiteAdvisor\6066\SAService.exe

Scotty

Post #10July 31, 2007, 5:15 PM UTC

Hello Clownmite

Did you mean the PUP's? Thats a freeware command line tool. I believe Combofix installs and uses that. The Qoobox folder does contain quarantined files, which is why I had you delete it. And next, as part of my all-clean speech, Ill have you flush out your System Restore, so there are no infected restore points left.

This is my usual speech for when you are clean, which you appear to be.

Please follow these simple steps in order to keep your computer clean and secure:
Disable and Enable System Restore. - If you are using Windows ME or XP then you should disable
and reenable system restore to make sure there are no infected files found in a restore point.

You can find instructions on how to enable and reenable system restore here:

Managing Windows Millenium System Restore

or

Windows XP System Restore Guide

Re-enable system restore with instructions from tutorial above
Make your Internet Explorer more secure - This can be done by following these simple instructions:
From within Internet Explorer click on the Tools menu and then click on Options.
Click once on the Security tab
Click once on the Internet icon so it becomes highlighted.
Click once on the Custom Level button.
- Change the Download signed ActiveX controls to Prompt
- Change the Download unsigned ActiveX controls to Disable
- Change the Initialize and script ActiveX controls not marked as safe to Disable
- Change the Installation of desktop items to Prompt
- Change the Launching programs and files in an IFRAME to Prompt
- Change the Navigate sub-frames across different domains to Prompt
- When all these settings have been made, click on the OK button.
- If it prompts you as to whether or not you want to save the settings, press the Yes button.
Next press the Apply button and then the OK to exit the Internet Properties page.

Set correct settings for files that should be hidden in Windows XP

Click Start > My Computer > Tools menu (at top of page) > Folder Options > View tab.
Under "Hidden files and folders" if necessary select Do not show hidden files and folders.
If unchecked please checkHide protected operating system files (Recommended)
If necessary check "Display content of system folders"
If necessary Uncheck Hide file extensions for known file types.
Click OK

And take a look at this LINKY for further recommendations and tips to stay clean.

Follow this list and your potential for being infected again will reduce dramatically.

Glad I was able to help.

Scotty

Post #11July 31, 2007, 10:48 PM UTC

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved]Hijackthis Log (i Suspect A Problem)

✨ Ask AI

Ask AI