Spyware / Malware / Virus Removal

Help Requested For Slow Computer

4 min read

Looking for the outcome? Ask AI

aeroguy Topic Starter

Post #1August 12, 2007, 2:35 AM UTC

Mother in law has a VERY slow computer. I removed what I could via the add/remove programs menu and disabled a lot of startup items via msconfig, but was wondering if I missed anything. Specs are Dell Dimension 4500, Windows XP Home SP2, Pentium IV 2.26GHz, 256MB RAM. I suspect the lack of RAM has something to do with it, but am wondering if there's anything else I can do.

Thanks in advance!

Logfile of HijackThis v1.99.1
Scan saved at 9:03:12 PM, on 8/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\system32\devldr32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ltmsg.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Dell\Support\Alert\bin\DAMon.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,hwjsmul.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {53D02247-A69B-E533-FFDE-C0274239DCAF} - C:\WINDOWS\system32\vmisnhe.dll (file missing)
O2 - BHO: SelasI Class - {59F4F380-01A0-4083-9FA4-E3B827319F7E} - C:\WINDOWS\system32\vcbhpkjp.dll
O2 - BHO: RieMon Class - {70F6A776-579A-4C95-BA88-134253907752} - C:\WINDOWS\system32\irsmuavs.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Yvakt Class - {98B9F201-C701-41F1-B338-7E5E0E6D768F} - C:\WINDOWS\system32\ejrwx8drl.dll (file missing)
O2 - BHO: (no name) - {A031CC58-1184-5272-E5E2-76ACAAF472A4} - C:\WINDOWS\system32\wipif.dll (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: (no name) - {E7CD6C54-A5B7-AF39-9E08-DAC81E8D2CCE} - C:\WINDOWS\system32\mvgg.dll (file missing)
O2 - BHO: (no name) - {F98405BC-9550-9B8B-7550-EA5B55296499} - C:\WINDOWS\system32\mkb.dll (file missing)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [LTWinModem1] ltmsg.exe 9
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [Dell|Alert] C:\Program Files\Dell\Support\Alert\bin\DAMon.exe
O4 - HKLM\..\Run: [LXBSCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXBStime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [MemoryCardManager] C:\Program Files\Lexmark\Lexmark Precision Photo\MemCard.exe -startup
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/games/clients/y/pote_x.cab
O16 - DPF: {00000000-0000-0000-1234-012398761234} - http://www.riversoftware.net/x0ff.cab
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {0246ECA8-996F-11D1-BE2F-00A0C9037DFE} (TDServer Control) - http://www.mid-tn.com/utilities/tdserver.cab
O16 - DPF: {270C6B04-AE7D-5BB3-5A47-7D814CB9D025} - http://85.255.114.166/1/rdgUS2516.exe
O16 - DPF: {2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} (MiniBugTransporterX Class) - http://wdownload.weatherbug.com/minibug/tr…Transporter.cab?
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200207…meInstaller.exe
O16 - DPF: {596B3A9B-0F39-2827-372C-0060387B1168} - http://85.255.114.166/1/rdgUS2516.exe
O16 - DPF: {6F5DA794-FF9F-6A76-1132-1FC6237EEF73} - http://85.255.114.166/1/rdgUS2516.exe
O16 - DPF: {749CF50B-AF3F-27D4-4A0A-340A735798CF} - http://85.255.114.166/1/rdgUS2516.exe
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab
O16 - DPF: {B64F4A7C-97C9-11DA-8BDE-F66BAD1E3F3A} - http://download.cdn.winsoftware.com/files/…FreeInstall.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O18 - Filter: text/html - {0FA7FD6B-47C3-425B-AE30-36383F1C4503} - C:\WINDOWS\system32\ejrwx8drl.dll
O20 - AppInit_DLLs: winspool.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\Logitech\SrvLnch\SrvLnch.exe
O23 - Service: lxbs_device - Lexmark International, Inc. - C:\WINDOWS\system32\lxbscoms.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

Mr_JAk3

Post #2August 14, 2007, 7:38 PM UTC

Hello aeroguy and welcome to the Forums

The computer has a collection of infections…

1. Download this file - combofix.exe
2. Double click combofix.exe & follow the prompts.
3. When finished, it shall produce a log for you. Post that log in your next reply

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

aeroguy

Post #3August 14, 2007, 11:06 PM UTC

Here's the log. Thanks so much for your help.

ComboFix 07-08-14.4 - "Everybody Else" 2007-08-14 16:23:59.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.88 [GMT -5:00]
* Created a new restore point

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

C:\Program Files\Common Files\crosof~1.net
C:\Program Files\Common Files\dobe~1
C:\Program Files\Common Files\mcroso~1
C:\Program Files\Common Files\pppatc~1
C:\Program Files\Common Files\sks~1
C:\Program Files\Common Files\ymbols~1
C:\Program Files\crosof~1
C:\Program Files\dialers
C:\Program Files\dialers\free.exe
C:\Program Files\dobe~1
C:\Program Files\fnts~1
C:\Program Files\mbols~1
C:\Program Files\racle~1
C:\Program Files\scurit~1
C:\Program Files\ssembl~1
C:\Program Files\sstem3~1
C:\WINDOWS\crosof~1
C:\WINDOWS\DOWNLO~1\UWAS6_0001_N91M1508NetInstaller.exe
C:\WINDOWS\ecurit~1
C:\WINDOWS\NDNuninstall6_98.exe
C:\WINDOWS\NDNuninstall7_14.exe
C:\WINDOWS\ppatch~1
C:\WINDOWS\pppatc~1
C:\WINDOWS\system32\appatc~1
C:\WINDOWS\system32\asembl~1
C:\WINDOWS\system32\asks~1
C:\WINDOWS\system32\bang-006.ico
C:\WINDOWS\system32\dobe~1
C:\WINDOWS\system32\icroso~1
C:\WINDOWS\system32\ppatch~1
C:\WINDOWS\system32\sembly~1
C:\WINDOWS\system32\sks~1
C:\WINDOWS\system32\vcbhpkjp.dll
C:\WINDOWS\system32\winpfz32.sys
C:\WINDOWS\system32\ystem3~1
C:\WINDOWS\yoinsi.exe

((((((((((((((((((((((((( Files Created from 2007-07-14 to 2007-08-14 )))))))))))))))))))))))))))))))

2007-08-14 16:22 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-08-14 13:31 d——– C:\WINDOWS\LastGood.Tmp
2007-08-13 21:25 d——– C:\DOCUME~1\EVERYB~1\APPLIC~1\Logitech
2007-08-13 21:21 90,112 –a—— C:\WINDOWS\SYSTEM32\KemUtil.dll
2007-08-13 21:21 89,088 –a—— C:\WINDOWS\SYSTEM32\atl71.dll
2007-08-13 21:21 86,016 –a—— C:\WINDOWS\SYSTEM32\KemWnd.dll
2007-08-13 21:21 65,536 –a—— C:\WINDOWS\SYSTEM32\KemXML.dll
2007-08-13 21:21 258,352 –a—— C:\WINDOWS\SYSTEM32\unicows.dll
2007-08-13 21:21 143,360 –a—— C:\WINDOWS\SYSTEM32\kemutb.dll
2007-08-13 21:21 13,440 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\L8042Kbd.SYS
2007-08-13 21:20 69,376 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\LMouKE.Sys
2007-08-13 21:20 55,552 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\L8042mou.Sys
2007-08-13 21:20 28,160 –a—— C:\WINDOWS\KHALMNPR.Exe
2007-08-13 21:20 d——– C:\Program Files\Logitech Mouse
2007-08-12 07:45 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Logishrd
2007-08-12 07:33 d——– C:\Program Files\Common Files\logishrd
2007-08-12 07:31 d——– C:\Program Files\MSXML 6.0
2007-08-12 07:28 d——– C:\Program Files\MSBuild
2007-08-12 07:22 d——– C:\WINDOWS\SYSTEM32\XPSViewer
2007-08-12 07:21 d——– C:\Program Files\Reference Assemblies
2007-08-12 07:19 14,048 ——— C:\WINDOWS\SYSTEM32\spmsg2.dll
2007-08-12 06:19 d——– C:\Program Files\MSXML 4.0
2007-08-11 19:36 59,264 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\USBAUDIO.sys
2007-08-11 19:36 59,264 –a—— C:\WINDOWS\SYSTEM32\DLLCACHE\usbaudio.sys
2007-08-11 19:36 14,112 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\lv302af.sys
2007-08-11 19:35 720,176 -ra—— C:\WINDOWS\SYSTEM32\DRIVERS\LV302AV.SYS
2007-08-11 19:35 490,272 –a—— C:\WINDOWS\SYSTEM32\LVUI2.dll
2007-08-11 19:35 465,696 –a—— C:\WINDOWS\SYSTEM32\LVUI2RC.dll
2007-08-11 19:35 416,544 –a—— C:\WINDOWS\SYSTEM32\lvcodec2.dll
2007-08-11 19:35 41,888 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\LVUSBSta.sys
2007-08-11 19:35 348,160 -ra—— C:\WINDOWS\SYSTEM\msvcr71.dll
2007-08-11 19:35 31,616 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\usbccgp.sys
2007-08-11 19:35 31,616 –a—— C:\WINDOWS\SYSTEM32\DLLCACHE\usbccgp.sys
2007-08-11 19:35 15,558 –a—— C:\WINDOWS\SYSTEM32\Repository.reg
2007-08-11 19:35 116,272 -ra—— C:\WINDOWS\SYSTEM32\lvcoinst.dll
2007-08-11 19:24 d——– C:\Program Files\Common Files\Logitech
2007-08-11 19:23 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Logitech
2007-08-11 19:22 d——– C:\Program Files\Logitech QuickCam10
2007-07-20 00:39 2,142,488 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\LVMVdrv.sys
2007-07-20 00:37 2,109,592 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\Lvckap.sys
2007-07-18 17:42 25,624 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\LVPr2Mon.sys

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-08-14 09:54 ——— d——– C:\Program Files\Lx_cats
2007-08-13 21:20 ——— d–h—– C:\Program Files\InstallShield Installation Information
2007-08-13 15:25 ——— d——– C:\DOCUME~1\EVERYB~1\APPLIC~1\AdobeUM
2007-08-11 20:59 ——— d——– C:\Program Files\Common Files\Symantec Shared
2007-08-11 20:25 ——— d——– C:\Program Files\Ares Lite Edition
2007-08-11 20:18 ——— d——– C:\Program Files\Microsoft Works
2007-05-16 10:12 86528 ——— C:\WINDOWS\system32\dllcache\directdb.dll
2007-05-16 10:12 85504 ——— C:\WINDOWS\system32\dllcache\wabimp.dll
2007-05-16 10:12 683520 –a—— C:\WINDOWS\system32\inetcomm.dll
2007-05-16 10:12 683520 ——— C:\WINDOWS\system32\dllcache\inetcomm.dll
2007-05-16 10:12 510976 ——— C:\WINDOWS\system32\dllcache\wab32.dll
2007-05-16 10:12 1314816 ——— C:\WINDOWS\system32\dllcache\msoe.dll
2006-12-11 13:40:20 190,976 –sh–r C:\WINDOWS\SYSTEM32\n?tepad.exe

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{53D02247-A69B-E533-FFDE-C0274239DCAF}]
C:\WINDOWS\system32\vmisnhe.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{70F6A776-579A-4C95-BA88-134253907752}]
2007-03-06 19:59 405504 –a—— C:\WINDOWS\system32\irsmuavs.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{98B9F201-C701-41F1-B338-7E5E0E6D768F}]
C:\WINDOWS\system32\ejrwx8drl.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A031CC58-1184-5272-E5E2-76ACAAF472A4}]
C:\WINDOWS\system32\wipif.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E7CD6C54-A5B7-AF39-9E08-DAC81E8D2CCE}]
C:\WINDOWS\system32\mvgg.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F98405BC-9550-9B8B-7550-EA5B55296499}]
C:\WINDOWS\system32\mkb.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LTWinModem1"="ltmsg.exe" [2001-04-03 10:38 C:\WINDOWS\SYSTEM32\ltmsg.exe]
"AdaptecDirectCD"="C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe" [2002-04-10 16:44]
"Dell|Alert"="C:\Program Files\Dell\Support\Alert\bin\DAMon.exe" [2002-07-11 15:15]
"LXBSCATS"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXBStime.dll" [2004-03-17 11:26]
"MemoryCardManager"="C:\Program Files\Lexmark\Lexmark Precision Photo\MemCard.exe" [2004-02-02 14:58]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2006-02-23 15:45]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" [2007-04-21 08:52]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2006-01-20 17:46 C:\WINDOWS\KHALMNPR.Exe]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2003-10-06 14:16]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvMediaCenter"="C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit" []
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:56]

C:\Documents and Settings\Everybody Else\Start Menu\Programs\Startup\
DESKTOP.INI [2001-11-15 07:31:16]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
DESKTOP.INI [2001-11-15 07:31:16]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
@=

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=winspool.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech SetPoint.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Logitech SetPoint.lnk
backup=C:\WINDOWS\pss\Logitech SetPoint.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Works Calendar Reminders.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Works Calendar Reminders.lnk
backup=C:\WINDOWS\pss\Microsoft Works Calendar Reminders.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AHQInit]
C:\Program Files\Creative\SBLive\Program\AHQInit.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ControlPanel]
C:\WINDOWS\system32\perzum.exe internat.dll,LoadKeyboardProfile

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ExploreUpdSched]
C:\WINDOWS\system32\tkdevted.exe FI002

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\fy]
C:\documents and settings\ryan\local settings\temp\fy.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Homeland Network]
"C:\Program Files\HomelandNetwork\HomelandNetwork.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\I&F Viewer toolbar]
"C:\Program Files\Photo Toolkit\ivbar\phototoolkitmem.exe" -start

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\irssyncd]
C:\WINDOWS\system32\irssyncd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\izzpvn.dll]
C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\izzpvn.dll,mpehxr

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechCommunicationsManager]
"C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechQuickCamRibbon]
"C:\Program Files\Logitech QuickCam10\Quickcam.exe" /hide

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LVCOMSX]
"C:\Program Files\Common Files\Logitech\LComMgr\LVComSX.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LXSUPMON]
C:\WINDOWS\system32\LXSUPMON.EXE RUN

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Update Detection]
C:\Program Files\Microsoft Works\WkDetect.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MoneyAgent]
"C:\Program Files\Microsoft Money\System\Money Express.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"C:\Program Files\Messenger\msmsgs.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
nwiz.exe /install

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Peeramid]
\PService.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\WINDOWS\System32\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\r0txxG]
C:\documents and settings\ryan\local settings\temp\r0txxG.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RUDgtyk]
C:\documents and settings\ryan\local settings\temp\RUDgtyk.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg]
C:\WINDOWS\Updreg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
"C:\Program Files\Yahoo!\Messenger\ypager.exe" -quiet

R1 cdudf_xp;cdudf_xp;C:\WINDOWS\system32\drivers\cdudf_xp.sys
R1 pwd_2k;pwd_2k;C:\WINDOWS\system32\drivers\pwd_2k.sys
R1 UdfReadr_xp;UdfReadr_xp;C:\WINDOWS\system32\drivers\UdfReadr_xp.sys
R3 L8042mou;Logitech SetPoint PS/2 Mouse Filter Driver;C:\WINDOWS\system32\DRIVERS\L8042mou.Sys
R3 mmc_2K;mmc_2K;C:\WINDOWS\system32\drivers\mmc_2K.sys
S3 dvd_2K;dvd_2K;C:\WINDOWS\system32\drivers\dvd_2K.sys
S4 hpt3xx;hpt3xx;C:\WINDOWS\system32\DRIVERS\hpt3xx.sys

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-14 16:32:33
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-08-14 16:37:10 - machine was rebooted
C:\ComboFix-quarantined-files.txt … 2007-08-14 16:37

— E O F —

Mr_JAk3

Post #4August 15, 2007, 7:14 PM UTC

Hello

Looks better already.

Download and run this uninstaller:
http://www.outerinfo.com/OiUninstaller.exe

Tutorial for the uninstaller if needed

Run ComboFix again and post a fresh log to here along with a fresh HijackThis log.

aeroguy

Post #5August 17, 2007, 6:27 PM UTC

Here they are. I can't thank you enough!

Combofix Log:

ComboFix 07-08-14.4 - "Everybody Else" 2007-08-17 11:12:51.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.70 [GMT -5:00]

((((((((((((((((((((((((( Files Created from 2007-07-17 to 2007-08-17 )))))))))))))))))))))))))))))))

2007-08-14 16:22 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-08-13 21:25 d——– C:\DOCUME~1\EVERYB~1\APPLIC~1\Logitech
2007-08-13 21:21 90,112 –a—— C:\WINDOWS\SYSTEM32\KemUtil.dll
2007-08-13 21:21 89,088 –a—— C:\WINDOWS\SYSTEM32\atl71.dll
2007-08-13 21:21 86,016 –a—— C:\WINDOWS\SYSTEM32\KemWnd.dll
2007-08-13 21:21 65,536 –a—— C:\WINDOWS\SYSTEM32\KemXML.dll
2007-08-13 21:21 258,352 –a—— C:\WINDOWS\SYSTEM32\unicows.dll
2007-08-13 21:21 143,360 –a—— C:\WINDOWS\SYSTEM32\kemutb.dll
2007-08-13 21:21 13,440 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\L8042Kbd.SYS
2007-08-13 21:20 69,376 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\LMouKE.Sys
2007-08-13 21:20 55,552 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\L8042mou.Sys
2007-08-13 21:20 28,160 –a—— C:\WINDOWS\KHALMNPR.Exe
2007-08-13 21:20 d——– C:\Program Files\Logitech Mouse
2007-08-12 07:45 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Logishrd
2007-08-12 07:33 d——– C:\Program Files\Common Files\logishrd
2007-08-12 07:31 d——– C:\Program Files\MSXML 6.0
2007-08-12 07:28 d——– C:\Program Files\MSBuild
2007-08-12 07:22 d——– C:\WINDOWS\SYSTEM32\XPSViewer
2007-08-12 07:21 d——– C:\Program Files\Reference Assemblies
2007-08-12 07:19 14,048 ——— C:\WINDOWS\SYSTEM32\spmsg2.dll
2007-08-12 06:19 d——– C:\Program Files\MSXML 4.0
2007-08-11 19:36 59,264 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\USBAUDIO.sys
2007-08-11 19:36 59,264 –a—— C:\WINDOWS\SYSTEM32\DLLCACHE\usbaudio.sys
2007-08-11 19:36 14,112 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\lv302af.sys
2007-08-11 19:35 720,176 -ra—— C:\WINDOWS\SYSTEM32\DRIVERS\LV302AV.SYS
2007-08-11 19:35 490,272 –a—— C:\WINDOWS\SYSTEM32\LVUI2.dll
2007-08-11 19:35 465,696 –a—— C:\WINDOWS\SYSTEM32\LVUI2RC.dll
2007-08-11 19:35 416,544 –a—— C:\WINDOWS\SYSTEM32\lvcodec2.dll
2007-08-11 19:35 41,888 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\LVUSBSta.sys
2007-08-11 19:35 348,160 -ra—— C:\WINDOWS\SYSTEM\msvcr71.dll
2007-08-11 19:35 31,616 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\usbccgp.sys
2007-08-11 19:35 31,616 –a—— C:\WINDOWS\SYSTEM32\DLLCACHE\usbccgp.sys
2007-08-11 19:35 15,558 –a—— C:\WINDOWS\SYSTEM32\Repository.reg
2007-08-11 19:35 116,272 -ra—— C:\WINDOWS\SYSTEM32\lvcoinst.dll
2007-08-11 19:24 d——– C:\Program Files\Common Files\Logitech
2007-08-11 19:23 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Logitech
2007-08-11 19:22 d——– C:\Program Files\Logitech QuickCam10
2007-07-20 00:39 2,142,488 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\LVMVdrv.sys
2007-07-20 00:37 2,109,592 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\Lvckap.sys
2007-07-18 17:42 25,624 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\LVPr2Mon.sys

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-08-15 21:41 ——— d——– C:\Program Files\Lx_cats
2007-08-14 20:29 ——— d——– C:\DOCUME~1\EVERYB~1\APPLIC~1\AdobeUM
2007-08-13 21:20 ——— d–h—– C:\Program Files\InstallShield Installation Information
2007-08-11 20:59 ——— d——– C:\Program Files\Common Files\Symantec Shared
2007-08-11 20:25 ——— d——– C:\Program Files\Ares Lite Edition
2007-08-11 20:18 ——— d——– C:\Program Files\Microsoft Works
2007-07-19 01:59 3583488 –a—— C:\WINDOWS\system32\dllcache\mshtml.dll
2007-07-12 18:31 765952 –a—— C:\WINDOWS\system32\dllcache\vgx.dll
2007-06-27 09:34 823808 –a—— C:\WINDOWS\system32\dllcache\wininet.dll
2007-06-27 09:34 671232 –a—— C:\WINDOWS\system32\dllcache\mstime.dll
2007-06-27 09:34 6058496 ——— C:\WINDOWS\system32\dllcache\ieframe.dll
2007-06-27 09:34 52224 ——— C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2007-06-27 09:34 477696 –a—— C:\WINDOWS\system32\dllcache\mshtmled.dll
2007-06-27 09:34 459264 ——— C:\WINDOWS\system32\dllcache\msfeeds.dll
2007-06-27 09:34 44544 ——— C:\WINDOWS\system32\dllcache\iernonce.dll
2007-06-27 09:34 384512 ——— C:\WINDOWS\system32\dllcache\iedkcs32.dll
2007-06-27 09:34 383488 ——— C:\WINDOWS\system32\dllcache\ieapfltr.dll
2007-06-27 09:34 27648 –a—— C:\WINDOWS\system32\dllcache\jsproxy.dll
2007-06-27 09:34 267776 ——— C:\WINDOWS\system32\dllcache\iertutil.dll
2007-06-27 09:34 232960 ——— C:\WINDOWS\system32\dllcache\webcheck.dll
2007-06-27 09:34 230400 ——— C:\WINDOWS\system32\dllcache\ieaksie.dll
2007-06-27 09:34 193024 –a—— C:\WINDOWS\system32\dllcache\msrating.dll
2007-06-27 09:34 153088 ——— C:\WINDOWS\system32\dllcache\ieakeng.dll
2007-06-27 09:34 132608 –a—— C:\WINDOWS\system32\dllcache\extmgr.dll
2007-06-27 09:34 124928 ——— C:\WINDOWS\system32\dllcache\advpack.dll
2007-06-27 09:34 1152000 –a—— C:\WINDOWS\system32\dllcache\urlmon.dll
2007-06-27 09:34 105984 ——— C:\WINDOWS\system32\dllcache\url.dll
2007-06-27 09:34 102400 ——— C:\WINDOWS\system32\dllcache\occache.dll
2007-06-27 03:27 63488 ——— C:\WINDOWS\system32\dllcache\ie4uinit.exe
2007-06-27 03:27 625152 ——— C:\WINDOWS\system32\dllcache\iexplore.exe
2007-06-27 03:27 13824 ——— C:\WINDOWS\system32\dllcache\ieudinit.exe
2007-06-27 02:00 161792 ——— C:\WINDOWS\system32\dllcache\ieakui.dll
2007-06-26 01:08 1104896 –a—— C:\WINDOWS\system32\msxml3.dll
2007-06-26 01:08 1104896 ——— C:\WINDOWS\system32\dllcache\msxml3.dll
2007-06-19 08:31 282112 –a—— C:\WINDOWS\system32\gdi32.dll
2007-06-19 08:31 282112 ——— C:\WINDOWS\system32\dllcache\gdi32.dll
2007-06-13 05:23 1033216 –a—— C:\WINDOWS\explorer.exe
2007-06-13 05:23 1033216 ——— C:\WINDOWS\system32\dllcache\explorer.exe
2007-05-17 06:28 549376 –a—— C:\WINDOWS\system32\oleaut32.dll
2007-05-17 06:28 549376 ——— C:\WINDOWS\system32\dllcache\oleaut32.dll
2006-12-11 13:40:20 190,976 –sh–r C:\WINDOWS\SYSTEM32\n?tepad.exe

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{53D02247-A69B-E533-FFDE-C0274239DCAF}]
C:\WINDOWS\system32\vmisnhe.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{70F6A776-579A-4C95-BA88-134253907752}]
2007-03-06 19:59 405504 –a—— C:\WINDOWS\system32\irsmuavs.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{98B9F201-C701-41F1-B338-7E5E0E6D768F}]
C:\WINDOWS\system32\ejrwx8drl.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A031CC58-1184-5272-E5E2-76ACAAF472A4}]
C:\WINDOWS\system32\wipif.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E7CD6C54-A5B7-AF39-9E08-DAC81E8D2CCE}]
C:\WINDOWS\system32\mvgg.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F98405BC-9550-9B8B-7550-EA5B55296499}]
C:\WINDOWS\system32\mkb.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LTWinModem1"="ltmsg.exe" [2001-04-03 10:38 C:\WINDOWS\SYSTEM32\ltmsg.exe]
"AdaptecDirectCD"="C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe" [2002-04-10 16:44]
"Dell|Alert"="C:\Program Files\Dell\Support\Alert\bin\DAMon.exe" [2002-07-11 15:15]
"LXBSCATS"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXBStime.dll" [2004-03-17 11:26]
"MemoryCardManager"="C:\Program Files\Lexmark\Lexmark Precision Photo\MemCard.exe" [2004-02-02 14:58]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2006-02-23 15:45]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" [2007-08-16 08:50]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2006-01-20 17:46 C:\WINDOWS\KHALMNPR.Exe]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2003-10-06 14:16]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvMediaCenter"="C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit" []
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:56]

C:\Documents and Settings\Everybody Else\Start Menu\Programs\Startup\
DESKTOP.INI [2001-11-15 07:31:16]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
DESKTOP.INI [2001-11-15 07:31:16]
Logitech SetPoint.lnk - C:\Program Files\Logitech Mouse\SetPoint\SetPoint.exe [2007-08-13 21:21:08]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
@=

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=winspool.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Works Calendar Reminders.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Works Calendar Reminders.lnk
backup=C:\WINDOWS\pss\Microsoft Works Calendar Reminders.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AHQInit]
C:\Program Files\Creative\SBLive\Program\AHQInit.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ControlPanel]
C:\WINDOWS\system32\perzum.exe internat.dll,LoadKeyboardProfile

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ExploreUpdSched]
C:\WINDOWS\system32\tkdevted.exe FI002

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\fy]
C:\documents and settings\ryan\local settings\temp\fy.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Homeland Network]
"C:\Program Files\HomelandNetwork\HomelandNetwork.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\I&F Viewer toolbar]
"C:\Program Files\Photo Toolkit\ivbar\phototoolkitmem.exe" -start

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\irssyncd]
C:\WINDOWS\system32\irssyncd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\izzpvn.dll]
C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\izzpvn.dll,mpehxr

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechCommunicationsManager]
"C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechQuickCamRibbon]
"C:\Program Files\Logitech QuickCam10\Quickcam.exe" /hide

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LVCOMSX]
"C:\Program Files\Common Files\Logitech\LComMgr\LVComSX.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LXSUPMON]
C:\WINDOWS\system32\LXSUPMON.EXE RUN

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Update Detection]
C:\Program Files\Microsoft Works\WkDetect.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MoneyAgent]
"C:\Program Files\Microsoft Money\System\Money Express.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"C:\Program Files\Messenger\msmsgs.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
nwiz.exe /install

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Peeramid]
\PService.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\WINDOWS\System32\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\r0txxG]
C:\documents and settings\ryan\local settings\temp\r0txxG.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RUDgtyk]
C:\documents and settings\ryan\local settings\temp\RUDgtyk.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg]
C:\WINDOWS\Updreg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
"C:\Program Files\Yahoo!\Messenger\ypager.exe" -quiet

R1 cdudf_xp;cdudf_xp;C:\WINDOWS\system32\drivers\cdudf_xp.sys
R1 pwd_2k;pwd_2k;C:\WINDOWS\system32\drivers\pwd_2k.sys
R1 UdfReadr_xp;UdfReadr_xp;C:\WINDOWS\system32\drivers\UdfReadr_xp.sys
R3 L8042mou;Logitech SetPoint PS/2 Mouse Filter Driver;C:\WINDOWS\system32\DRIVERS\L8042mou.Sys
R3 mmc_2K;mmc_2K;C:\WINDOWS\system32\drivers\mmc_2K.sys
S3 dvd_2K;dvd_2K;C:\WINDOWS\system32\drivers\dvd_2K.sys
S4 hpt3xx;hpt3xx;C:\WINDOWS\system32\DRIVERS\hpt3xx.sys

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-17 11:17:21
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-08-17 11:19:37
C:\ComboFix-quarantined-files.txt … 2007-08-17 11:19
C:\ComboFix2.txt … 2007-08-14 16:37

— E O F —

Highjackthis Log:

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {53D02247-A69B-E533-FFDE-C0274239DCAF} - C:\WINDOWS\system32\vmisnhe.dll (file missing)
O2 - BHO: RieMon Class - {70F6A776-579A-4C95-BA88-134253907752} - C:\WINDOWS\system32\irsmuavs.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Yvakt Class - {98B9F201-C701-41F1-B338-7E5E0E6D768F} - C:\WINDOWS\system32\ejrwx8drl.dll (file missing)
O2 - BHO: (no name) - {A031CC58-1184-5272-E5E2-76ACAAF472A4} - C:\WINDOWS\system32\wipif.dll (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: (no name) - {E7CD6C54-A5B7-AF39-9E08-DAC81E8D2CCE} - C:\WINDOWS\system32\mvgg.dll (file missing)
O2 - BHO: (no name) - {F98405BC-9550-9B8B-7550-EA5B55296499} - C:\WINDOWS\system32\mkb.dll (file missing)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [LTWinModem1] ltmsg.exe 9
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [Dell|Alert] C:\Program Files\Dell\Support\Alert\bin\DAMon.exe
O4 - HKLM\..\Run: [LXBSCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXBStime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [MemoryCardManager] C:\Program Files\Lexmark\Lexmark Precision Photo\MemCard.exe -startup
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech Mouse\SetPoint\SetPoint.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/games/clients/y/pote_x.cab
O16 - DPF: {00000000-0000-0000-1234-012398761234} - http://www.riversoftware.net/x0ff.cab
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {0246ECA8-996F-11D1-BE2F-00A0C9037DFE} (TDServer Control) - http://www.mid-tn.com/utilities/tdserver.cab
O16 - DPF: {270C6B04-AE7D-5BB3-5A47-7D814CB9D025} - http://85.255.114.166/1/rdgUS2516.exe
O16 - DPF: {2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} (MiniBugTransporterX Class) - http://wdownload.weatherbug.com/minibug/tr…Transporter.cab?
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200207…meInstaller.exe
O16 - DPF: {596B3A9B-0F39-2827-372C-0060387B1168} - http://85.255.114.166/1/rdgUS2516.exe
O16 - DPF: {6F5DA794-FF9F-6A76-1132-1FC6237EEF73} - http://85.255.114.166/1/rdgUS2516.exe
O16 - DPF: {749CF50B-AF3F-27D4-4A0A-340A735798CF} - http://85.255.114.166/1/rdgUS2516.exe
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab
O16 - DPF: {B64F4A7C-97C9-11DA-8BDE-F66BAD1E3F3A} - http://download.cdn.winsoftware.com/files/…FreeInstall.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs: winspool.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: lxbs_device - Lexmark International, Inc. - C:\WINDOWS\system32\lxbscoms.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

Mr_JAk3

Post #6August 17, 2007, 7:58 PM UTC last edited August 17, 2007, 7:59 PM UTC

Hi again, we'll continue

You should print these instructions or save these to a text file. Follow these instructions carefully.

Download ATF Cleaner by Atribune to your desktop.
Do NOT run yet.

Download Dr.Web CureIt to the desktop -> ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe

Make your hidden files visible:

Go to My Computer
Select the Tools menu and click Folder Options
Click the View tab.
Checkmark the "Display the contents of system folders"
Under the Hidden files and folders select "Show hidden files and folders"
Uncheck "Hide protected operating system files"
Click Apply and then the OK and close My Computer.

==================

Backup your registry:

Start
Run
Type the following to the box and hit Ok: regedit
A window opens, click on File
Choose Export form the menu
Change the save location to C:\
Give the filename, RegBackUp
Make sure that the filetype is set to Registryfiles (*.reg)
Click on Save and Close the window

Open Notepad (NOT WORDPAD!) and copy the following lines from the quote box below into a new document, leaving a blank line at the end. (don't forget to copy and paste the word REGEDIT4) :

REGEDIT4

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ControlPanel]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ExploreUpdSched]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\fy]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\izzpvn.dll]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Peeramid]
\PService.exe

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\r0txxG]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RUDgtyk]

Make sure there are NO blank lines before REGEDIT4
Make sure there IS one blank line at the end of the file.

Save the document to your desktop as Fix.reg and filetype: All Files
Go to your desktop and double click on the file to run Fix.reg and when it asks you if you want to merge the contents to the registry, click yes/ok.

Run HijackThis, click Do a system scan only, and check the box next to each of these entries if still present. Close all other windows and press Fix checked. If something isn't there, please continue with the next entry in the list.

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/…rch/search.html
O2 - BHO: (no name) - {53D02247-A69B-E533-FFDE-C0274239DCAF} - C:\WINDOWS\system32\vmisnhe.dll (file missing)
O2 - BHO: RieMon Class - {70F6A776-579A-4C95-BA88-134253907752} - C:\WINDOWS\system32\irsmuavs.dll
O2 - BHO: Yvakt Class - {98B9F201-C701-41F1-B338-7E5E0E6D768F} - C:\WINDOWS\system32\ejrwx8drl.dll (file missing)
O2 - BHO: (no name) - {A031CC58-1184-5272-E5E2-76ACAAF472A4} - C:\WINDOWS\system32\wipif.dll (file missing)
O2 - BHO: (no name) - {E7CD6C54-A5B7-AF39-9E08-DAC81E8D2CCE} - C:\WINDOWS\system32\mvgg.dll (file missing)
O2 - BHO: (no name) - {F98405BC-9550-9B8B-7550-EA5B55296499} - C:\WINDOWS\system32\mkb.dll (file missing)
O16 - DPF: {270C6B04-AE7D-5BB3-5A47-7D814CB9D025} - http://85.255.114.166/1/rdgUS2516.exe
O16 - DPF: {2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} (MiniBugTransporterX Class) - http://wdownload.weatherbug.com/minibug/tr…Transporter.cab?
O16 - DPF: {596B3A9B-0F39-2827-372C-0060387B1168} - http://85.255.114.166/1/rdgUS2516.exe
O16 - DPF: {6F5DA794-FF9F-6A76-1132-1FC6237EEF73} - http://85.255.114.166/1/rdgUS2516.exe
O16 - DPF: {749CF50B-AF3F-27D4-4A0A-340A735798CF} - http://85.255.114.166/1/rdgUS2516.exe
O16 - DPF: {B64F4A7C-97C9-11DA-8BDE-F66BAD1E3F3A} - http://download.cdn.winsoftware.com/files/…FreeInstall.cab
O20 - AppInit_DLLs: winspool.dll

Restart your computer to the safe mode:

Restart your computer
Start tapping the F8 key when the computer restarts.
When the start menu opens, choose Safe mode
Press Enter. The computer then begins to start in Safe mode.

Open "My Computer" and delete the following files (if present):
C:\WINDOWS\system32\perzum.exe
C:\WINDOWS\system32\tkdevted.exe
C:\WINDOWS\system32\izzpvn.dll
C:\WINDOWS\SYSTEM32\n?tepad.exe the "?" is a random character. DO NOT delete the legitimate file named notepad.exe!

Use the Windows search

Start
Search
All files and folders
More advanced options

Checkmark these options:

"Search system folders"
"Search hidden files and folders"
"Search subfolders"
Search for this and delete if found: PService.exe
Search for this and delete if found: winspool.dll

Run ATF Cleaner Under Main choose: Select All
Click the Empty Selected button.
If you use Firefox browserClick Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browserClick Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.

Run a scan with Dr.Web CureIt

Doubleclick the drweb-cureit.exe file and Allow to run the express scan
This will scan the files currently running in memory and when something is found, click the yes button when it asks you if you want to cure it. This is only a short scan.
Once the short scan has finished, you should now mark the drives that you want to scan.
Select all drives. A red dot shows which drives have been chosen.
Click the green arrow at the right, and the scan will start.
Click 'Yes to all' if it asks if you want to cure/move the file.
When the scan has finished, look if you can click next icon next to the files found [external image: Posted Image]
If so, click it and then click the next icon right below and select Move incurable
After the scan, in the menu, click file and choose save report list
Save the report to your desktop. The report will be called DrWeb.csv
Close Dr.Web Cureit.
Reboot the computer in Normal Mode,
Post the Cure-it report and a fresh HijackThis log

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Help Requested For Slow Computer

✨ Ask AI

Ask AI