What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Closed]Avsystemcare Malaware

10 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1 last edited
I have been trying for weeks to remove this malaware called "AVsystem care" through verious different software without success. List of tools used:
Spy bot search and destroy
Ad-Aware SE personal
AVG 7.5
AVG anti spyware 7.5
Noadware2.0
It seems that it is a browser hijack as it only occurs when browsing.
Here is the the log from HijackThis 1.99.1. Any help is greatly appreciated.


Logfile of HijackThis v1.99.1
Scan saved at 10:18:34 AM, on 8/9/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\LANDesk\Shared Files\residentagent.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\Executive Software\Diskeeper\DkService.exe
C:\PROGRA~1\NETWOR~1\MCAFEE~1\FireSvc.exe
c:\WINDOWS\System32\Hummingbird\Connectivity\9.00\Inetd\inetd32.exe
c:\Program Files\Hummingbird\Connectivity\9.00\Exceed\HumDisplayServer.exe
C:\LDClient\LOCALSCH.EXE
C:\WINDOWS\system32\cba\pds.exe
C:\LDClient\QIPCLNT.EXE
C:\LDClient\tmcsvc.exe
C:\Program Files\iPass\iPassConnect Continental RAS\iPassPeriodicUpdateService.exe
C:\WINDOWS\system32\lkcitdl.exe
C:\WINDOWS\system32\lkads.exe
C:\WINDOWS\system32\lktsrv.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\Program Files\National Instruments\MAX\nimxs.exe
C:\Program Files\National Instruments\Shared\Security\nidmsrv.exe
C:\WINDOWS\system32\nisvcloc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\LDClient\wuser32.exe
C:\WINDOWS\system32\MsgSys.EXE
C:\Program Files\iPass\iPassConnect Continental RAS\iPassPeriodicUpdateApp.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\LDClient\ranwait.exe
C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe
C:\PROGRA~1\NETWOR~1\MCAFEE~1\Firetray.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Seagate\SystemTray\StxMenuMgr.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft Office Communicator\Communicator.exe
C:\Program Files\Computing Edge\Download +Solution\DownSoln.exe
C:\Program Files\Lotus\Notes6\NLNOTES.EXE
C:\Program Files\Lotus\Notes6\ntaskldr.EXE
C:\PROGRA~1\INTERN~1\iexplore.exe
C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn1\YTBSDK.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Motorola
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: JavaConnect - https://dpim001.auto.contiwan.com/sametime/…JavaConnect.cab
O16 - DPF: {1E40C477-ECA7-48DC-A9FC-D4F77A365442} (STURLConnection Control) - https://dpim001.auto.contiwan.com/sametime/…rlConLoader.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {3BFFE033-BF43-11D5-A271-00A024A51325} (iNotes6 Class) - https://dplc001.cig.mot.com/iNotes6W.cab
O16 - DPF: {53F92AF2-3C1E-4A63-B2EA-2E33DA6286B7} (STAutoAway Control) - https://dpim001.auto.contiwan.com/sametime/…oAwayLoader.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1169088575480
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://www.nick.com/common/groove/gx/GrooveAX27.cab
O16 - DPF: {CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA} (Java Runtime Environment 1.5.0) - https://eetime3.adphc.com/a59estatic/plugin…dows-i586-p.exe
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = auto.contiwan.com
O17 - HKLM\Software\..\Telephony: DomainName = auto.contiwan.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{C4EBF198-3B6A-425A-968B-C1218D335796}: Domain = auto.contiwan.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = auto.contiwan.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = auto.contiwan.com,contiwan.com,cig.mot.com,corp.mot.com,ds.mot.com,sps.mot.com,m
t.com,adphc.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = auto.contiwan.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = auto.contiwan.com,contiwan.com,cig.mot.com,corp.mot.com,ds.mot.com,sps.mot.com,m
t.com,adphc.com
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = auto.contiwan.com
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: SearchList = auto.contiwan.com,contiwan.com,cig.mot.com,corp.mot.com,ds.mot.com,sps.mot.com,m
t.com,adphc.com
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = auto.contiwan.com,contiwan.com,cig.mot.com,corp.mot.com,ds.mot.com,sps.mot.com,m
t.com,adphc.com
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - AppInit_DLLs: secsolni.dll C:\PROGRA~1\Google\GO333C~1\GOEC62~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: LANDesk® Management Agent (CBA8) - LANDesk® Development, Ltd - C:\Program Files\LANDesk\Shared Files\residentagent.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\Diskeeper\DkService.exe
O23 - Service: McAfee Desktop Firewall Service (FireSvc) - McAfee, Inc. - C:\PROGRA~1\NETWOR~1\MCAFEE~1\FireSvc.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Hummingbird InetD (HCLInetd) - Hummingbird Ltd. - c:\WINDOWS\System32\Hummingbird\Connectivity\9.00\Inetd\inetd32.exe
O23 - Service: Hummingbird Exceed Display Management (HumDisplayServer) - Hummingbird Ltd. - c:\Program Files\Hummingbird\Connectivity\9.00\Exceed\HumDisplayServer.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Intel Local Scheduler Service - LANDesk Software Ltd. - C:\LDClient\LOCALSCH.EXE
O23 - Service: Intel PDS - Intel® Corporation - C:\WINDOWS\system32\cba\pds.exe
O23 - Service: Intel QIP Client Service - LANDesk Software Ltd. - C:\LDClient\QIPCLNT.EXE
O23 - Service: Intel Targeted Multicast - LANDesk Software Ltd. - C:\LDClient\tmcsvc.exe
O23 - Service: iPassConnectEngine - iPass, Inc. - C:\Program Files\iPass\iPassConnect Continental RAS\iPassConnectEngine.exe
O23 - Service: iPassPeriodicUpdateApp - iPass, Inc. - C:\Program Files\iPass\iPassConnect Continental RAS\iPassPeriodicUpdateApp.exe
O23 - Service: iPassPeriodicUpdateService - iPass, Inc. - C:\Program Files\iPass\iPassConnect Continental RAS\iPassPeriodicUpdateService.exe
O23 - Service: Lookout Citadel Server (LkCitadelServer) - National Instruments, Inc. - C:\WINDOWS\system32\lkcitdl.exe
O23 - Service: National Instruments PSP Server Locator (lkClassAds) - National Instruments, Inc. - C:\WINDOWS\system32\lkads.exe
O23 - Service: National Instruments Time Synchronization (lkTimeSync) - National Instruments, Inc. - C:\WINDOWS\system32\lktsrv.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Unknown owner - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe" /ServiceStart (file missing)
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: NI Configuration Manager (mxssvr) - National Instruments Corporation - C:\Program Files\National Instruments\MAX\nimxs.exe
O23 - Service: National Instruments Domain Service (NIDomainService) - National Instruments, Inc. - C:\Program Files\National Instruments\Shared\Security\nidmsrv.exe
O23 - Service: NI Service Locator (niSvcLoc) - National Instruments Corp. - C:\WINDOWS\system32\nisvcloc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe (file missing)
O23 - Service: Intel Remote Control Service (Wuser32) - LANDesk Software Ltd. - C:\LDClient\wuser32.exe
Post #2
Hi! Welcome to the Tom Coyote forums.
My name is Scotty. I would be glad to take a look at your log and help you with solving any malware problems. HijackThis logs can take a while to research.
Please be patient and I'd be grateful if you would note the following:
  • I will working be on your Malware issues, this may or may not, solve other issues you have with your machine.
  • The fixes are specific to your problem and should only be used for this issue on this machine.
  • Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
  • It's often worth reading through these instructions and printing them for ease of reference.
  • If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
  • Please reply to this thread. Do not start a new topic.

Please make a uninstall list using HijackThis
To access the Uninstall Manager you would do the following:

1. Start HijackThis
2. Click on the Config button
3. Click on the Misc Tools button
4. Click on the Open Uninstall Manager button.
5. Click on the Save list… button and specify where you would like to save this file. When you press Save button a notepad will open with the contents of that file. Simply copy and paste the contents of that notepad here in a reply.
Post #3
Hello Scotty here is the copy and paste 3D Groove Playback Engine AC3Filter (remove only) ACES Business Apps Ad-Aware SE Personal Adobe Acrobat 7.0.9 Professional Adobe Flash Player ActiveX Adobe Flash Player Plugin Apple Software Update AT&T Yahoo! Applications Avanquest update AVG 7.5 AVG Anti-Spyware 7.5 Blaze Media Pro Broadcom Gigabit Integrated Controller Cadence PSD 14.2 Products CCleaner (remove only) CCTD PTS - PC Cisco Aironet Installation Wizard Citrix ICA Client Citrix Web Client Command Prompt Here PowerToy Conexant HDA D110 MDC V.92 Modem Continental Lotus Notes 6.5.4 Diskeeper Professional Edition DivX Codec DivX Content Uploader DivX Converter DivX Player DivX Web Player eMusic - 50 Free MP3 offer Engineering Systems Web Client eyeQ ffdshow (remove only) FLV Player 1.3.3 FreeAgent Pro Tools Google Desktop Google Earth Google Photos Screensaver Google Toolbar for Firefox Google Toolbar for Internet Explorer Google Toolbar for Internet Explorer Google Updater High Definition Audio Driver Package - KB835221 Hijackthis 1.99.1 HijackThis 1.99.1 Hotfix for Windows Media Format 11 SDK (KB929399) Hotfix for Windows XP (KB896344) Hotfix for Windows XP (KB914440) Hotfix for Windows XP (KB915865) Hotfix for Windows XP (KB926239) Hotfix for Windows XP (KB928388) Hotfix for Windows XP (KB929120) Hotfix for Windows XP (KB935448) Hummingbird Exceed V9.0 i2 Explore [removed] IBM Lotus Sametime Connect 7.5 IE5 Registration Integrated Business Systems InterComm Expert 5.2 InterVideo DVDCopy 4 IPASS_CONNECT_351_XXX_CASIC_B01 J2SE Runtime Environment 5.0 Update 9 Java™ 6 Update 2 Java™ SE Runtime Environment 6 Update 1 Kerberos_MaxTokenSize_1000_ENU_CEIC_B01 KeyRipper 3.1 Lotus Notes LTspice/SwCADIII Mathcad 13 MaX Compression Client McAfee Anti-Spyware Enterprise Module McAfee VirusScan Enterprise Mentor Graphics Products MessengerSkinner Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 Hotfix (KB928366) Microsoft .NET Framework 2.0 Microsoft .NET Framework 3.0 Microsoft .NET Framework 3.0 Microsoft Base Smart Card Cryptographic Service Provider Package Microsoft Compression Client Pack 1.0 for Windows XP Microsoft Data Access Components KB870669 Microsoft Internationalized Domain Names Mitigation APIs Microsoft Kernel-Mode Driver Framework Feature Pack 1.5 Microsoft National Language Support Downlevel APIs Microsoft Office Communicator 2005 Microsoft Office Communicator 2005 MUI Pack Microsoft Office Professional Edition 2003 Microsoft Office Project Professional 2003 Microsoft Office Visio Professional 2003 Microsoft Organization Chart 2.0 Microsoft User-Mode Driver Framework Feature Pack 1.0 Microsoft Visio Viewer 2002 Motorola Phone Tools Mozilla Firefox (2.0.0.6) MSXML 4.0 SP2 (KB927978) MSXML 4.0 SP2 Parser and SDK MSXML 6.0 Parser MYRIAD Graphics File Viewer National Instruments Software NI EULA Depot NI MDF Support Norton Spyware Scan provided by Yahoo! NVIDIA Drivers Orban/Coding Technologies AAC/aacPlus Player Plugin™ 1.0 OZ776 SCR CardBus Windows Driver Panda ActiveScan Picasa 2 PowerDVD 5.9 PPCAN QuickTime RelexFMEA Rhapsody Player Engine Saber® X-2005.09 Saber® Z-2007.03 Sametime Client v6.5.1 SAPGUI_640PL23_BW350_11_complete_ServerBased_XXX_CASIC_B01 Security Update for CAPICOM (KB931906) Security Update for CAPICOM (KB931906) Security Update for Microsoft .NET Framework 2.0 (KB928365) Security Update for Windows Internet Explorer 7 (KB928090) Security Update for Windows Internet Explorer 7 (KB931768) Security Update for Windows Internet Explorer 7 (KB933566) Security Update for Windows Media Player (KB911564) Security Update for Windows Media Player 6.4 (KB925398) Security Update for Windows Media Player 9 (KB917734) Security Update for Windows XP (KB890046) Security Update for Windows XP (KB893066) Security Update for Windows XP (KB893756) Security Update for Windows XP (KB896358) Security Update for Windows XP (KB896422) Security Update for Windows XP (KB896423) Security Update for Windows XP (KB896424) Security Update for Windows XP (KB896428) Security Update for Windows XP (KB899587) Security Update for Windows XP (KB899589) Security Update for Windows XP (KB899591) Security Update for Windows XP (KB900725) Security Update for Windows XP (KB901017) Security Update for Windows XP (KB901190) Security Update for Windows XP (KB901214) Security Update for Windows XP (KB902400) Security Update for Windows XP (KB905414) Security Update for Windows XP (KB905749) Security Update for Windows XP (KB908519) Security Update for Windows XP (KB911562) Security Update for Windows XP (KB911927) Security Update for Windows XP (KB912919) Security Update for Windows XP (KB913580) Security Update for Windows XP (KB914388) Security Update for Windows XP (KB914389) Security Update for Windows XP (KB917344) Security Update for Windows XP (KB917422) Security Update for Windows XP (KB917953) Security Update for Windows XP (KB918118) Security Update for Windows XP (KB919007) Security Update for Windows XP (KB920213) Security Update for Windows XP (KB920670) Security Update for Windows XP (KB920683) Security Update for Windows XP (KB920685) Security Update for Windows XP (KB921398) Security Update for Windows XP (KB921883) Security Update for Windows XP (KB922616) Security Update for Windows XP (KB922819) Security Update for Windows XP (KB923191) Security Update for Windows XP (KB923414) Security Update for Windows XP (KB923689) Security Update for Windows XP (KB923694) Security Update for Windows XP (KB923789) Security Update for Windows XP (KB923980) Security Update for Windows XP (KB924191) Security Update for Windows XP (KB924270) Security Update for Windows XP (KB924496) Security Update for Windows XP (KB924667) Security Update for Windows XP (KB925454) Security Update for Windows XP (KB925902) Security Update for Windows XP (KB926247) Security Update for Windows XP (KB926255) Security Update for Windows XP (KB926436) Security Update for Windows XP (KB927779) Security Update for Windows XP (KB927802) Security Update for Windows XP (KB928255) Security Update for Windows XP (KB928843) Security Update for Windows XP (KB929123) Security Update for Windows XP (KB930178) Security Update for Windows XP (KB931261) Security Update for Windows XP (KB931784) Security Update for Windows XP (KB932168) Security Update for Windows XP (KB935839) Security Update for Windows XP (KB935840) Shockwave SigmaTel Audio Softing CAN Interface Driver V2.60 Softing CAN Layer2 V5.00 Sonic DLA Sonic RecordNow! Plus Sonic Update Manager Spybot - Search & Destroy 1.4 SUPERAntiSpyware Free Edition Update for Windows XP (KB898461) Update for Windows XP (KB900485) Update for Windows XP (KB904942) Update for Windows XP (KB908531) Update for Windows XP (KB910437) Update for Windows XP (KB911280) Update for Windows XP (KB914882) Update for Windows XP (KB916595) Update for Windows XP (KB920342) Update for Windows XP (KB920872) Update for Windows XP (KB922582) Update for Windows XP (KB925720) Update for Windows XP (KB925876) Update for Windows XP (KB927891) Update for Windows XP (KB929338) Update for Windows XP (KB930916) Update for Windows XP (KB931836) Update for Windows XP (KB936357) ViewMail for Outlook VpnClient_0408_ENU_CEIC_B01 Winamp (remove only) Windows Communication Foundation Windows Imaging Component Windows Installer 3.1 (KB893803) Windows Internet Explorer 7 Windows Live Messenger Windows Media Format 11 runtime Windows Media Format 11 runtime Windows Media Format SDK Hotfix - KB891122 Windows Media Player 11 Windows Media Player 11 Windows Media Player 9 Hotfix [See KB885492 for more information] Windows Presentation Foundation Windows Server 2003 Administration Tools Pack Windows Workflow Foundation Windows XP Hotfix - KB873333 Windows XP Hotfix - KB873339 Windows XP Hotfix - KB885250 Windows XP Hotfix - KB885835 Windows XP Hotfix - KB885836 Windows XP Hotfix - KB886185 Windows XP Hotfix - KB888113 Windows XP Hotfix - KB888302 Windows XP Hotfix - KB890047 Windows XP Hotfix - KB890175 Windows XP Hotfix - KB890859 Windows XP Hotfix - KB891781 Windows XP Hotfix - KB893086 Windows XP Service Pack 2 WinRAR archiver WinZip XoftSpySE
Post #4
Hi

Download and Run ComboFix
  • Download this file from below:

    Here
  • Disconnect from the Internet, than disable your anti-virus and any real-time anti-spyware monitors that are running.
  • Then double click combofix.exe & follow the prompts.
  • When finished, it shall produce a log for you. Post that log in your next reply with a new HijackThis log.
Note 1: Do not mouseclick combofix's window whilst it's running. That may cause it to stall
Note 2:Remember to re-enable your anti-virus and anti-spyware before reconnecting to the Internet.
Post #5
ComboFix 07-08-10.8 - "frm037" 2007-08-10 10:19:27.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1065 [GMT -5:00]


((((((((((((((((((((((((( Files Created from 2007-07-10 to 2007-08-10 )))))))))))))))))))))))))))))))


2007-08-10 10:07 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-08-09 15:37 d——– D:\Profiles\ALLUSE~1\APPLIC~1\Apple Computer
2007-08-09 15:37 d——– D:\Profiles\ALLUSE~1\APPLIC~1\Apple
2007-08-09 15:37 d——– C:\Program Files\QuickTime
2007-08-09 15:37 d——– C:\Program Files\Apple Software Update
2007-08-09 10:56 d——– C:\Program Files\Common Files\Wise Installation Wizard
2007-08-09 10:55 d——– C:\WINDOWS\system32\ActiveScan
2007-08-09 10:55 d——– C:\WINDOWS\LastGood
2007-08-09 07:48 d——– C:\Program Files\XoftSpySE
2007-08-09 00:07 d——– D:\Profiles\FRM037~1.DPL\APPLIC~1\Network Associates
2007-08-09 00:06 1,327 –a—— D:\Profiles\FRM037~1.DPL\clean.reg
2007-08-08 23:58 d——– C:\WINDOWS\ERUNT
2007-08-08 16:13 d——– D:\Profiles\TROUBL~1\APPLIC~1\Lavasoft
2007-08-08 14:32 d——– D:\Profiles\FRM037~1.DPL\APPLIC~1\Lavasoft
2007-08-08 13:51 2,621,440 –ah—– D:\Profiles\FRM037~1.DPL\ntuser.dat
2007-08-08 13:51 d–hs—- D:\Profiles\FRM037~1.DPL\UserData
2007-08-08 13:51 d——– D:\Profiles\FRM037~1.DPL\APPLIC~1\Leadertech
2007-08-08 13:51 d——– D:\Profiles\FRM037~1.DPL\APPLIC~1\Hummingbird
2007-08-08 13:51 d——– D:\Profiles\FRM037~1.DPL\APPLIC~1\AdobeUM
2007-08-08 10:48 d——– C:\Program Files\CCleaner
2007-08-08 10:47 10,872 –a—— C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-08-07 23:31 d——– D:\Profiles\TROUBL~1\APPLIC~1\Google
2007-08-07 15:49 664 –a—— C:\WINDOWS\system32\d3d9caps.dat
2007-08-06 08:52 d——– C:\WINDOWS\pss
2007-08-03 20:47 d——– C:\Program Files\MSXML 6.0
2007-08-03 20:46 d——– C:\Program Files\MSBuild
2007-08-03 20:43 d——– C:\WINDOWS\system32\XPSViewer
2007-08-03 20:43 d——– C:\Program Files\Reference Assemblies
2007-08-03 20:42 14,048 ——— C:\WINDOWS\system32\spmsg2.dll
2007-08-03 20:42 d——– C:\Program Files\Messenger
2007-08-03 15:45 d——– C:\Program Files\RogueRemover FREE
2007-07-30 10:33 d——– D:\Profiles\FRM037\APPLIC~1\SUPERAntiSpyware.com
2007-07-30 10:33 d——– D:\Profiles\ALLUSE~1\APPLIC~1\SUPERAntiSpyware.com
2007-07-30 10:33 d——– C:\Program Files\SUPERAntiSpyware
2007-07-27 11:03 21,419 –a—— C:\WINDOWS\system32\drivers\iPassP.sys
2007-07-27 11:03 d——– D:\Profiles\ALLUSE~1\APPLIC~1\iPass
2007-07-27 10:59 d——– C:\Program Files\Common Files\Deterministic Networks
2007-07-27 10:49 53,536 –a—— C:\WINDOWS\system32\_DelAll.EXE
2007-07-27 10:49 2,857 –a—— C:\WINDOWS\system32\Dosshell.pif
2007-07-26 14:29 84,992 –a—— C:\WINDOWS\system32\ATL70.DLL
2007-07-26 14:29 65,536 –a—— C:\WINDOWS\system32\YCRWin32.dll
2007-07-26 13:05 d——– C:\WINDOWS\SxsCaPendDel
2007-07-26 08:39 d——– D:\Profiles\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
2007-07-26 05:28 d——– D:\Profiles\ALLUSE~1\APPLIC~1\STOPzilla!
2007-07-25 20:40 d——– C:\Program Files\NoAdware5.0
2007-07-21 07:41 d——– D:\Profiles\FRM037\.housecall6.6
2007-07-20 11:15 d——– D:\Profiles\FRM037\Contacts
2007-07-20 09:44 d——– D:\Profiles\ALLUSE~1\APPLIC~1\Windows Live Toolbar
2007-07-20 09:44 d——– C:\Program Files\Windows Live Toolbar
2007-07-20 09:44 d——– C:\Program Files\Real
2007-07-20 09:34 d——– C:\Program Files\MSN Messenger
2007-07-18 15:19 d——– D:\Profiles\FRM037\APPLIC~1\MessengerSkinner
2007-07-18 15:10 d——– C:\Program Files\MessengerSkinner
2007-07-18 10:03 d——– D:\Profiles\FRM037\SametimeTranscripts
2007-07-18 08:56 d——– D:\Profiles\FRM037\APPLIC~1\Sametime
2007-07-18 08:56 d——– C:\Program Files\IBM
2007-07-17 09:51 4,141,056 –a—— C:\WINDOWS\eyeQ Screen Saver.scr
2007-07-17 09:51 d——– C:\Program Files\Infinite Mind LC
2007-07-16 10:22 d——– C:\Program Files\Winamp
2007-07-12 15:47 d—-c— C:\WINDOWS\system32\DRVSTORE


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-08-09 16:15 ——— d——– C:\Program Files\Microsoft Office Communicator
2007-08-09 16:07 ——— d——– C:\Program Files\Google
2007-08-08 14:21 ——— d——– D:\Profiles\FRM037\APPLIC~1\Lavasoft
2007-08-08 14:21 ——— d——– C:\Program Files\Lavasoft
2007-08-07 23:56 ——— d–h—– C:\Program Files\InstallShield Installation Information
2007-08-07 23:43 ——— d——– C:\Program Files\Yahoo!
2007-08-06 10:57 ——— d——– C:\Program Files\Common Files\Scanner
2007-07-27 11:05 ——— d——– C:\Program Files\MyApp
2007-07-27 10:06 ——— d——– C:\Program Files\Intel
2007-07-25 14:18 ——— d——– D:\Profiles\FRM037\APPLIC~1\U3
2007-07-22 13:37 ——— d——– C:\Program Files\Blaze Media Pro
2007-07-11 08:22 ——— d——– D:\Profiles\FRM037\APPLIC~1\Uniblue
2007-07-11 08:21 ——— d——– C:\Program Files\Motorola MVP
2007-06-30 11:54 ——— d–h—– D:\Profiles\FRM037\APPLIC~1\ijjigame
2007-06-28 11:06 ——— d——– D:\Profiles\FRM037\APPLIC~1\iPassConnect
2007-06-28 11:03 ——— d——– C:\Program Files\iPass
2007-06-28 10:56 ——— d——– C:\Program Files\Cisco Systems
2007-06-28 10:44 ——— d——– C:\Program Files\SAPPC
2007-06-28 10:44 ——— d——– C:\Program Files\Common Files\ESRI
2007-06-28 10:42 ——— d——– C:\Program Files\Common Files\SAP Shared
2007-06-23 08:06 ——— d——– C:\Program Files\Orban
2007-06-22 12:04 94208 –a—— C:\WINDOWS\system32\libsapu16vc71.dll
2007-06-22 12:04 8495104 –a—— C:\WINDOWS\system32\icudt26l.dll
2007-06-22 12:04 8224768 –a—— C:\WINDOWS\system32\icudt20.dll
2007-06-22 12:04 606208 –a—— C:\WINDOWS\system32\icuin26.dll
2007-06-22 12:04 602112 –a—— C:\WINDOWS\system32\icuin20.dll
2007-06-22 12:04 5898240 –a—— C:\WINDOWS\system32\librfc32u.dll
2007-06-22 12:04 57431 –a—— C:\WINDOWS\system32\sapregsv.exe
2007-06-22 12:04 528384 –a—— C:\WINDOWS\system32\icuuc26.dll
2007-06-22 12:04 348160 –a—— C:\WINDOWS\system32\icuuc20.dll
2007-06-12 09:23 ——— d——– C:\Program Files\PTC
2007-06-11 15:45 ——— d——– C:\Program Files\Seagate
2007-05-16 10:12 86528 —–c— C:\WINDOWS\system32\dllcache\directdb.dll
2007-05-16 10:12 85504 —–c— C:\WINDOWS\system32\dllcache\wabimp.dll
2007-05-16 10:12 683520 –a—— C:\WINDOWS\system32\inetcomm.dll
2007-05-16 10:12 683520 —–c— C:\WINDOWS\system32\dllcache\inetcomm.dll
2007-05-16 10:12 510976 —–c— C:\WINDOWS\system32\dllcache\wab32.dll
2007-05-16 10:12 1314816 —–c— C:\WINDOWS\system32\dllcache\msoe.dll
2007-01-17 14:29 4591 –a—— C:\Program Files\INSTALL.LOG
2001-05-24 13:59 162304 –a—— C:\Program Files\UNWISE.EXE


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"McAfeeUpdaterUI"="C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" [2005-08-31 15:50]
"LANDeskAPMClient"="C:\LDClient\amclient.exe" [2004-12-08 10:52]
"LANDeskTaskCompletion"="C:\LDClient\amclient.exe" [2004-12-08 10:52]
"LANDeskInventory"="C:\LDClient\LDISCN32.exe" [2004-10-19 07:55]
"LANDeskVulscan"="C:\LDClient\ranwait.exe" [2003-04-10 19:50]
"Network Associates Error Reporting Service"="C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe" [2004-02-19 13:07]
"McAfeeFireTray"="C:\PROGRA~1\NETWOR~1\MCAFEE~1\Firetray.exe" [2006-01-13 10:08]
"ShStatEXE"="C:\Program Files\Network Associates\VirusScan\SHSTAT.exe" [2004-09-22 08:00]
"StxTrayMenu"="C:\Program Files\Seagate\SystemTray\StxMenuMgr.exe" [2007-01-18 13:20]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-04 02:56 C:\WINDOWS\system32\bthprops.cpl]
"NvCplDaemon"="C:\windows\system32\NvCpl.dll" [2006-05-01 16:46]
"YOP"="C:\PROGRA~1\Yahoo!\YOP\yop.exe" []
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-08-08 10:45]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 04:25]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-06-29 06:24]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-03-31 11:43]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:56]
"Communicator"="C:\Program Files\Microsoft Office Communicator\Communicator.exe" [2006-07-17 19:38]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2007-02-27 11:39]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"Communicator"="C:\Program Files\Microsoft Office Communicator\Communicator.exe"

D:\Profiles\All Users\Start Menu\Programs\Startup\
Engineering Systems Tools.lnk - C:\Program Files\Computing Edge\Download +Solution\DownSoln.exe [2007-01-17 14:29:07]
VPN Client.lnk - C:\WINDOWS\Installer\{D25122BC-A60E-4663-B602-B01718F12044}\Icon3E5562ED7.ico [2007-07-27 11:00:23]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"disablecad"=0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoMSAppLogo5ChannelNotify"=0 (0x0)
"NoToolbarCustomize"=0 (0x0)
"NoBandCustomize"=0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"Btn_Back"=0 (0x0)
"Btn_Forward"=0 (0x0)
"Btn_Stop"=0 (0x0)
"Btn_Refresh"=0 (0x0)
"Btn_Home"=0 (0x0)
"Btn_Search"=0 (0x0)
"Btn_History"=0 (0x0)
"Btn_Favorites"=0 (0x0)
"Btn_Media"=0 (0x0)
"Btn_Folders"=0 (0x0)
"Btn_Fullscreen"=0 (0x0)
"Btn_Tools"=0 (0x0)
"Btn_MailNews"=0 (0x0)
"Btn_Size"=0 (0x0)
"Btn_Print"=0 (0x0)
"Btn_Edit"=0 (0x0)
"Btn_Discussions"=0 (0x0)
"Btn_Cut"=0 (0x0)
"Btn_Copy"=0 (0x0)
"Btn_Paste"=0 (0x0)
"Btn_Encoding"=0 (0x0)
"Btn_PrintPreview"=0 (0x0)
"NoFavoritesMenu"=0 (0x0)
"NoSetActiveDesktop"=0 (0x0)
"NoChangeStartMenu"=0 (0x0)
"NoRecentDocsMenu"=0 (0x0)
"NoRecentDocsHistory"=0 (0x0)
"ClearRecentDocsOnExit"=0 (0x0)
"NoLogoff"=0 (0x0)
"NoClose"=0 (0x0)
"NoSetFolders"=0 (0x0)
"NoSetTaskbar"=0 (0x0)
"NoTrayContextMenu"=0 (0x0)
"NoFileMenu"=0 (0x0)
"NoViewContextMenu"=0 (0x0)
"EnforceShellExtensionSecurity"=0 (0x0)
"LinkResolveIgnoreLinkInfo"=0 (0x0)
"NoNetConnectDisconnect"=0 (0x0)
"NoDeletePrinter"=0 (0x0)
"NoAddPrinter"=0 (0x0)
"NoPrinterTabs"=0 (0x0)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 12:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-02-27 11:39 282624 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=secsolni.dll C:\PROGRA~1\Google\GO333C~1\GOEC62~1.DLL

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-2048354812-1799923345-800859446-224323\Scripts\Logon\]
"Script"=\\auto.contiwan.com\sysvol\auto.contiwan.com\scripts\DeerPark\kix32.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\D:^Profiles^All Users^Start Menu^Programs^Startup^Adobe Acrobat Speed Launcher.lnk]
path=D:\Profiles\All Users\Start Menu\Programs\Startup\Adobe Acrobat Speed Launcher.lnk
backup=C:\WINDOWS\pss\Adobe Acrobat Speed Launcher.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\D:^Profiles^All Users^Start Menu^Programs^Startup^Google Updater.lnk]
path=D:\Profiles\All Users\Start Menu\Programs\Startup\Google Updater.lnk
backup=C:\WINDOWS\pss\Google Updater.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\D:^Profiles^All Users^Start Menu^Programs^Startup^InterVideo WinCinema Manager.lnk]
path=D:\Profiles\All Users\Start Menu\Programs\Startup\InterVideo WinCinema Manager.lnk
backup=C:\WINDOWS\pss\InterVideo WinCinema Manager.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\D:^Profiles^All Users^Start Menu^Programs^Startup^MiniEYE-MiniREAD Launch.lnk]
path=D:\Profiles\All Users\Start Menu\Programs\Startup\MiniEYE-MiniREAD Launch.lnk
backup=C:\WINDOWS\pss\MiniEYE-MiniREAD Launch.lnkCommon Startup


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CLIENTUPDATE]
C:\Temp\migration.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
"C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iPassConnect]
"C:\Program Files\iPass\iPassConnect Continental RAS\iPassConnectGUI.exe" /S

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
%systemroot%\system32\dumprep 0 -k

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\messengerskinner]
C:\Program Files\MessengerSkinner\MessengerSkinner.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
"C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Uniblue RegistryBooster2]
C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe /S

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
C:\Program Files\Winamp\winampa.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"YPCService"=3 (0x3)
"FastUserSwitchingCompatibility"=3 (0x3)

R0 FirePM;McAfee Desktop Firewall Policy Manager Driver;C:\WINDOWS\system32\Drivers\FirePM.sys
R0 NIPALK;NIPALK;C:\WINDOWS\system32\drivers\nipalk.sys
R1 FireHook;McAfee Desktop Firewall;\??\C:\WINDOWS\system32\Drivers\Firehk5x.sys
R1 FireTDI;McAfee Desktop Firewall TDI Driver;\??\C:\WINDOWS\system32\Drivers\FireTDI.sys
R1 NaiAvTdi1;NaiAvTdi1;C:\WINDOWS\system32\drivers\mvstdi5x.sys
R1 WmiAcpi;Microsoft Windows Management Interface for ACPI;C:\WINDOWS\system32\DRIVERS\wmiacpi.sys
R2 CBA8;LANDesk® Management Agent;"C:\Program Files\LANDesk\Shared Files\residentagent.exe"
R2 cvintdrv;cvintdrv;C:\WINDOWS\system32\drivers\cvintdrv.sys
R2 CVPND;Cisco Systems, Inc. VPN Service;"C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe"
R2 CVPNDRVA;Cisco Systems Inc. IPSec Driver;\??\C:\WINDOWS\system32\Drivers\CVPNDRVA.sys
R2 HumDisplayServer;Hummingbird Exceed Display Management;c:\Program Files\Hummingbird\Connectivity\9.00\Exceed\HumDisplayServer.exe
R2 iPassP;iPass Protocol (IEEE 802.1x) v3.5.3.0;C:\WINDOWS\system32\DRIVERS\iPassP.sys
R2 iPassPeriodicUpdateService;iPassPeriodicUpdateService;"C:\Program Files\iPass\iPassConnect Continental RAS\iPassPeriodicUpdateService.exe"
R2 mxssvr;NI Configuration Manager;"C:\Program Files\National Instruments\MAX\nimxs.exe"
R2 nicanpk;nicanpk;C:\WINDOWS\system32\DRIVERS\nicanpk.dll
R2 PPCAN;PPCAN;C:\WINDOWS\system32\drivers\ppcan.sys
R2 Wuser32;Intel Remote Control Service;C:\LDClient\wuser32.exe
R3 BTHMODEM;Bluetooth Modem Communications Driver;C:\WINDOWS\system32\DRIVERS\bthmodem.sys
R3 ChdKey;%ChdKey.ServiceName%;C:\WINDOWS\system32\Drivers\CANChd.sys
R3 DNE;Deterministic Network Enhancer Miniport;C:\WINDOWS\system32\DRIVERS\dne2000.sys
R3 EntDrv51;EntDrv51;\??\C:\WINDOWS\system32\drivers\EntDrv51.sys
R3 firelm01;firelm01;\??\C:\WINDOWS\system32\drivers\firelm01.sys
R3 guardian2;guardian2;C:\WINDOWS\system32\Drivers\oz776.sys
R3 Intel Remote Control Helper;Intel Remote Control Helper;C:\WINDOWS\system32\drivers\rch.sys
R3 iPassPeriodicUpdateApp;iPassPeriodicUpdateApp;"C:\Program Files\iPass\iPassConnect Continental RAS\iPassPeriodicUpdateApp.exe"
R3 NuidFltr;NUID filter driver;C:\WINDOWS\system32\DRIVERS\NuidFltr.sys
R3 Point32;Microsoft IntelliPoint Filter Driver;C:\WINDOWS\system32\DRIVERS\point32.sys
R3 Wdf01000;Wdf01000;C:\WINDOWS\system32\DRIVERS\Wdf01000.sys
S0 szkg;szkg;C:\WINDOWS\system32\DRIVERS\szkg.sys
S3 cancardw;cancardw;C:\WINDOWS\system32\Drivers\cancardw.sys
S3 CVirtA;Cisco Systems VPN Adapter;C:\WINDOWS\system32\DRIVERS\CVirtA.sys
S3 EDIC2K;EDIC2K;C:\WINDOWS\system32\drivers\edic2k.sys
S3 IPFilter;Microsoft IntelliPoint Features driver;C:\WINDOWS\system32\DRIVERS\IPFilter.sys
S3 IPSECSHM;Nortel IPSECSHM Adapter;C:\WINDOWS\system32\DRIVERS\ipsecw2k.sys
S3 LPDSVC;TCP/IP Print Server;C:\WINDOWS\System32\tcpsvcs.exe
S3 PCX500;Cisco Wireless LAN Adapters Driver;C:\WINDOWS\system32\DRIVERS\pcx500.sys
S3 PCX500MP;Cisco 350 Series Lower Device Filter;C:\WINDOWS\system32\DRIVERS\pcx500mp.sys
S3 USBCCID;USB Smart Card reader;C:\WINDOWS\system32\DRIVERS\usbccid.sys
S4 a320raid;a320raid;C:\WINDOWS\system32\DRIVERS\a320raid.sys
S4 SNMP;SNMP Service;C:\WINDOWS\System32\snmp.exe
S4 SNMPTRAP;SNMP Trap Service;C:\WINDOWS\System32\snmptrap.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs BthServ


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9cfe5d40-ec51-11db-9469-001641a33ec7}]
AutoRun\command- F:\LaunchU3.exe -a

*Newly Created Service* - CATCHME
*Newly Created Service* - NIPALK
*Newly Created Service* - SASDIFSV
*Newly Created Service* - SASENUM
*Newly Created Service* - SASKUTIL

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{Z99999999-999-9999-9999-MOT-2K3}]
C:\WINDOWS\2k3_USR.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{Z99999999-999-9999-9999-MOT-APOLLO}]
C:\WINDOWS\Apolloproxy\Apolloproxy.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{0-0-0-0-MOT-IE6PRE}]
C:\WINDOWS\MotIESet6_pre.exe

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{0EEB34F6-991D-4a1b-8EEB-772DA0EADB22}]
"C:\Program Files\Microsoft Office Communicator\MotIM-manual.EXE" /s

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9D467580-AF3D-4e3c-8893-4F29CB100EB2}]
"C:\WINDOWS\SAVasetup.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{BAFC1927-A731-4c34-829B-47EE05ADD199}]
"C:\WINDOWS\regedit.exe" /s "C:\WINDOWS\mot-wmp9.reg"

Contents of the 'Scheduled Tasks' folder
2007-08-09 20:37:32 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
2007-08-10 13:18:00 C:\WINDOWS\Tasks\Uniblue SpyEraser Nag.job
2007-06-29 02:13:05 C:\WINDOWS\Tasks\Uniblue SpyEraser.job - C:\Program Files\Uniblue\SpyEraser\SpyEraser.exe
2007-08-09 22:00:00 C:\WINDOWS\Tasks\XoftSpySE 2.job - C:\Program Files\XoftSpySE\XoftSpy.exe
2007-08-09 12:52:00 C:\WINDOWS\Tasks\XoftSpySE.job - C:\Program Files\XoftSpySE\XoftSpy.exe

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-10 10:20:27
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden registry entries …

[HKEY_CURRENT_USER\Software]
@=""

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Applets\Regedit]
"LastKey"="My Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Applets\SysTray]
"Services"=dword:0000001f

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer]
"CleanShutdown"=dword:00000001
"Shutdown Setting"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"SuperHidden"=dword:00000000

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\EventHandlersDefaultSelection]
"ShowPicturesOnArrival"="MSOpenFolder"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\CabinetState]
"FullPath"=dword:00000000

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\DefaultIcon]
@=str(2):"scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-08-10 10:22:05
C:\ComboFix-quarantined-files.txt … 2007-08-10 10:21
C:\ComboFix2.txt … 2007-08-10 10:17

— E O F —
Post #6
Logfile of HijackThis v1.99.1
Scan saved at 10:26, on 2007-08-10
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\LANDesk\Shared Files\residentagent.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\Executive Software\Diskeeper\DkService.exe
C:\PROGRA~1\NETWOR~1\MCAFEE~1\FireSvc.exe
c:\WINDOWS\System32\Hummingbird\Connectivity\9.00\Inetd\inetd32.exe
c:\Program Files\Hummingbird\Connectivity\9.00\Exceed\HumDisplayServer.exe
C:\LDClient\LOCALSCH.EXE
C:\WINDOWS\system32\cba\pds.exe
C:\LDClient\QIPCLNT.EXE
C:\LDClient\tmcsvc.exe
C:\Program Files\iPass\iPassConnect Continental RAS\iPassPeriodicUpdateService.exe
C:\WINDOWS\system32\lkcitdl.exe
C:\WINDOWS\system32\lkads.exe
C:\WINDOWS\system32\lktsrv.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\Program Files\National Instruments\MAX\nimxs.exe
C:\Program Files\National Instruments\Shared\Security\nidmsrv.exe
C:\WINDOWS\system32\nisvcloc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\LDClient\wuser32.exe
C:\WINDOWS\system32\MsgSys.EXE
C:\Program Files\iPass\iPassConnect Continental RAS\iPassPeriodicUpdateApp.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe
C:\PROGRA~1\NETWOR~1\MCAFEE~1\Firetray.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Seagate\SystemTray\StxMenuMgr.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft Office Communicator\Communicator.exe
C:\Program Files\Computing Edge\Download +Solution\DownSoln.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\IBM\Sametime Connect 7.5\sametime.exe
C:\Program Files\IBM\Sametime Connect 7.5\jre\bin\sametime75.exe
C:\Program Files\Lotus\Notes6\NLNOTES.EXE
C:\Program Files\Lotus\Notes6\ntaskldr.EXE
C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn1\YTBSDK.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Grisoft\AVG7\avgcc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: JavaConnect - https://dpim001.auto.contiwan.com/sametime/…JavaConnect.cab
O16 - DPF: {1E40C477-ECA7-48DC-A9FC-D4F77A365442} (STURLConnection Control) - https://dpim001.auto.contiwan.com/sametime/…rlConLoader.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {3BFFE033-BF43-11D5-A271-00A024A51325} (iNotes6 Class) - https://dplc001.cig.mot.com/iNotes6W.cab
O16 - DPF: {53F92AF2-3C1E-4A63-B2EA-2E33DA6286B7} (STAutoAway Control) - https://dpim001.auto.contiwan.com/sametime/…oAwayLoader.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1169088575480
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://www.nick.com/common/groove/gx/GrooveAX27.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA} (Java Runtime Environment 1.5.0) - https://eetime3.adphc.com/a59estatic/plugin…dows-i586-p.exe
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = auto.contiwan.com
O17 - HKLM\Software\..\Telephony: DomainName = auto.contiwan.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{C4EBF198-3B6A-425A-968B-C1218D335796}: Domain = auto.contiwan.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = auto.contiwan.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = auto.contiwan.com,contiwan.com,cig.mot.com,corp.mot.com,ds.mot.com,sps.mot.com,m
t.com,adphc.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = auto.contiwan.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = auto.contiwan.com,contiwan.com,cig.mot.com,corp.mot.com,ds.mot.com,sps.mot.com,m
t.com,adphc.com
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = auto.contiwan.com
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: SearchList = auto.contiwan.com,contiwan.com,cig.mot.com,corp.mot.com,ds.mot.com,sps.mot.com,m
t.com,adphc.com
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = auto.contiwan.com,contiwan.com,cig.mot.com,corp.mot.com,ds.mot.com,sps.mot.com,m
t.com,adphc.com
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - AppInit_DLLs: secsolni.dll C:\PROGRA~1\Google\GO333C~1\GOEC62~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: LANDesk® Management Agent (CBA8) - LANDesk® Development, Ltd - C:\Program Files\LANDesk\Shared Files\residentagent.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\Diskeeper\DkService.exe
O23 - Service: McAfee Desktop Firewall Service (FireSvc) - McAfee, Inc. - C:\PROGRA~1\NETWOR~1\MCAFEE~1\FireSvc.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Hummingbird InetD (HCLInetd) - Hummingbird Ltd. - c:\WINDOWS\System32\Hummingbird\Connectivity\9.00\Inetd\inetd32.exe
O23 - Service: Hummingbird Exceed Display Management (HumDisplayServer) - Hummingbird Ltd. - c:\Program Files\Hummingbird\Connectivity\9.00\Exceed\HumDisplayServer.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Intel Local Scheduler Service - LANDesk Software Ltd. - C:\LDClient\LOCALSCH.EXE
O23 - Service: Intel PDS - Intel® Corporation - C:\WINDOWS\system32\cba\pds.exe
O23 - Service: Intel QIP Client Service - LANDesk Software Ltd. - C:\LDClient\QIPCLNT.EXE
O23 - Service: Intel Targeted Multicast - LANDesk Software Ltd. - C:\LDClient\tmcsvc.exe
O23 - Service: iPassConnectEngine - iPass, Inc. - C:\Program Files\iPass\iPassConnect Continental RAS\iPassConnectEngine.exe
O23 - Service: iPassPeriodicUpdateApp - iPass, Inc. - C:\Program Files\iPass\iPassConnect Continental RAS\iPassPeriodicUpdateApp.exe
O23 - Service: iPassPeriodicUpdateService - iPass, Inc. - C:\Program Files\iPass\iPassConnect Continental RAS\iPassPeriodicUpdateService.exe
O23 - Service: Lookout Citadel Server (LkCitadelServer) - National Instruments, Inc. - C:\WINDOWS\system32\lkcitdl.exe
O23 - Service: National Instruments PSP Server Locator (lkClassAds) - National Instruments, Inc. - C:\WINDOWS\system32\lkads.exe
O23 - Service: National Instruments Time Synchronization (lkTimeSync) - National Instruments, Inc. - C:\WINDOWS\system32\lktsrv.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Unknown owner - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe" /ServiceStart (file missing)
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: NI Configuration Manager (mxssvr) - National Instruments Corporation - C:\Program Files\National Instruments\MAX\nimxs.exe
O23 - Service: National Instruments Domain Service (NIDomainService) - National Instruments, Inc. - C:\Program Files\National Instruments\Shared\Security\nidmsrv.exe
O23 - Service: NI Service Locator (niSvcLoc) - National Instruments Corp. - C:\WINDOWS\system32\nisvcloc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe (file missing)
O23 - Service: Intel Remote Control Service (Wuser32) - LANDesk Software Ltd. - C:\LDClient\wuser32.exe
Post #9
Hi

In that case, You may have a nasty rootkit infection called Navipromo, which came with MessengerSkinner. If you are patient, careful, and persistent, we will remove it.

Download F-Secure Blacklight (fsbl.exe) to the desktop from here.

Open it and click Accept Agreement.
Click Scan.
After the scan is complete, click Next, then Exit.
It will create a log on the desktop named fsbl-xxxxxxx.log (the xxxxxxx will be the date and time of the scan)
Save the log to your desktop. Paste the log in your next reply.
Post #13
Hi strus

I think I have the answer.

Please download NTrights.zip by freeatlast.
HERE
If you can't access it, download NTrights.zip via HERE
Save it on your desktop.
Unzip/extract it.
Read here how to unzip/extract properly:
HERE
Open the NTrights-folder
Double click on the Debug.bat file to run it, follow any prompts it asks.
REBOOT
Doubleclick the Debug.bat again after reboot.
It will create a log.
If the log says:
"Granting SeDebugPrivilege to Administrators … successful", you must be ok and things restored well.
then try blacklight again
Post #14
Ok I was able to run FSB after a reboot. Safemode did not work but it took a long time to get in and out of it ~30min. F-Secure BlackLight did not find any hidden files and did not save a log file to my desk top.
Post #15
Hi
  • Download GMER by GMER from here
  • Unzip it to a folder on your desktop
  • Double click on gmer.exe to launch GMER
  • If asked, allow the gmer.sys driver load
  • If it warns you about rootkit activity and asks if you want to run scan, click OK
  • If you don't get a warning then
    • Click the rootkit tab
    • Click Scan
  • Once the scan has finished, click copy
  • Paste the log into notepad using Ctrl+V
  • Save it to your desktop as gmerrk.txt
  • Click on the >>> tab
  • This will open up the rest of the tabs for you
  • Click on the Autostart tab
  • Click on Scan
  • Once the scan has finished, click copy
  • Paste the log into notepad using Ctrl+V
  • Save it to your desktop as gmerautos.txt
  • Copy and paste the contents of gmerautos.txt and gmerrk.txt as a reply to this topic

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI