What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved]Safe Mode. Problems Sdfix

29 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1 last edited
Spybot removes win32.delf.uc but reappears. To fix this problem I installed SDFix. This progy only works in safe mode. Problem. F8 does not work and each time after 7 or more tries DEL puts me onto the boot page giving the option to boot in safe mode with the Normal, Highlighted. The arrow keys freeze and do not work while the countdown continues hits 0 and then the system boots normally. I posted this problem in another part of the forum and was advised by Doug–Staff to Run sfc /scannow. I tried, a dos window tries to open for a millisecond and then nothing. On his suggestion I post below the log from Highjack This. Please HELP!


Scan saved at 3:27:26 AM, on 8/22/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\Google\Gmail Notifier\gnotify.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\system32\svdhost.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\CyberLink\Shared files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
D:\UT1.6.1.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Config\lsass.exe
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\program files\mcafee\virusscan\scriptcl.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [Microsoft Updates] svdhost.exe
O4 - HKLM\..\RunServices: [Microsoft Updates] svdhost.exe
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O20 - Winlogon Notify: TrkWks - C:\WINDOWS\System32\Systen.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe
O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe

I will be most gratefull for an early reply.
Post #2
Hello and Welcome to the forum.

I suggest you do this:

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Clear "Hide file extensions for known file types."
Under the "Hidden files" folder, select "Show hidden files and folders."
Clear "Hide protected operating system files."
Click Apply, and then click OK.


Please do not delete anything unless instructed to.

Close all windows and browsers.
Open HijackThis

Click on Open Misc Tools
Click on Delete a File On Reboot
Click once on the files below to select it:

C:\WINDOWS\system32\svdhost.exe
C:\WINDOWS\Config\lsass.exe
C:\WINDOWS\System32\Systen.dll

Click on the Back button to exit Process Manager

Next:

Run hijackthis. Hit None of the above, Click Do a System Scan Only. Put a Check in the box on the left side on these:

F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Config\lsass.exe
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O4 - HKLM\..\Run: [Microsoft Updates] svdhost.exe
O4 - HKLM\..\RunServices: [Microsoft Updates] svdhost.exe
O20 - Winlogon Notify: TrkWks - C:\WINDOWS\System32\Systen.dll

Close ALL windows and browsers except HijackThis and click "Fix checked"


Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

(If you use FireFox or the Opera browser
To keep saved passwords, click No at the prompt.)

It's normal after running ATF cleaner that the PC will be slower to boot the first time or two.


Reboot and "copy/paste" a new HijackThis log file into this thread.

Also please describe how your computer behaves at the moment.
Post #3 last edited
Thank you, but a new problem has cropped up; I carried out your instructions to the letter to show hidden files etc. Then I went to open Highjackthis; ALERT: Highjachthis did not create an icon on the desktop at instalation but parked itself in C;/Program Files/Highjackthis. It is from here that I had opened it and run the log posted above; I opened highjackthis, then misc tools and then on Delete Files on Reboot. This opened a windows window–look in highjacthis and below this in the square space were two folders 1. Highjackthis.exe. 2. The original log in note pad posted above. In desperation I clicked on the log thinking it will bring up the list, it did but in note pad-no good for clicking! At the same time windows informed me that the Log file will be deleted on reboot!!!!! What am I doing wrong? Thanks in advance for all the trouble you are taking. I am an old man retired and not so clever. So please bear with me.
Post #4
Let's try it this way.

Please do not delete anything unless instructed to.


Run hijackthis. Hit None of the above, Click Do a System Scan Only. Put a Check in the box on the left side on these:

F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Config\lsass.exe
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O4 - HKLM\..\Run: [Microsoft Updates] svdhost.exe
O4 - HKLM\..\RunServices: [Microsoft Updates] svdhost.exe
O20 - Winlogon Notify: TrkWks - C:\WINDOWS\System32\Systen.dll

Close ALL windows and browsers except HijackThis and click "Fix checked"

Delete these files if found.
C:\WINDOWS\system32\svdhost.exe
C:\WINDOWS\Config\lsass.exe <–Only from this location.
C:\WINDOWS\System32\Systen.dll

Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

(If you use FireFox or the Opera browser
To keep saved passwords, click No at the prompt.)

It's normal after running ATF cleaner that the PC will be slower to boot the first time or two.


Reboot and "copy/paste" a new HijackThis log file into this thread.

Also please describe how your computer behaves at the moment.
Post #5 last edited
I did as instructed.After clicking on Fix Checked the Hijackthis window went blank and the 3 C:\Windows\——— files mentioned by you were no where to be seen, so could not delete those. I then ran Atf cleaner which after about a second informed that so much space had been made available. Then I rebooted and ran spybot and found 2 entries of Win32.Delf.uc which I deleted and decided to reboot in safe mode to use SDFix and then report back to you. It took many tries but finally got to boot option page but the Arrow keys are still frozen and there is no way to log on in safe mode. Also after each normal reboot the 2 entries reappeared. I have again deleted those and ran hijackthis. The log is enclosed. I now await your advice.


Scan saved at 11:01:24 PM, on 8/22/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\CyberLink\Shared files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Google\Gmail Notifier\gnotify.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\program files\mcafee\virusscan\scriptcl.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O20 - Winlogon Notify: TrkWks - C:\WINDOWS\System32\Systen.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe
O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe


Thank you very much.
Post #6
They don't want to die :angry:

Download ComboFix from Here to your Desktop.
  • Double click combofix.exe and follow the prompts.
  • When finished, it shall produce a log for you, combofix.txt. Post that log and a HiJackthis log in your next reply
Note: Do not mouseclick while its running. That may cause it to stall
Post #7
I did exactly as you asked, nothing else. Below are the 2 reports,


Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.257 [GMT 2:00]
* Created a new restore point


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\WINDOWS\3354171.dll
C:\WINDOWS\system32\drivers\npf.sys
C:\WINDOWS\system32\packet.dll
C:\WINDOWS\system32\wpcap.dll


((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))


——-\NPF


((((((((((((((((((((((((( Files Created from 2007-07-22 to 2007-08-22 )))))))))))))))))))))))))))))))


2007-08-23 01:09 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-08-22 17:40 50,688 –a—— C:\ATF-Cleaner.exe
2007-08-22 03:24 5,149,152 –a—— C:\rminstall.exe
2007-08-22 03:22 251,392 –a—— C:\hijackthis_sfx.exe
2007-08-21 21:36 12,413,440 –a—— C:\avgas-setup-7.5.1.43.exe
2007-08-21 20:18 d——– C:\WINDOWS\network diagnostic
2007-08-21 20:12 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
2007-08-21 20:06 d–hs—- C:\DOCUME~1\khan\UserData
2007-08-21 09:18 d-a—— C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
2007-08-15 14:00 d——– C:\Program Files\MSXML 6.0
2007-08-15 02:00 552 –a—— C:\WINDOWS\system32\d3d8caps.dat
2007-08-14 23:01 159,232 –a—— C:\WINDOWS\system32\sf.exe
2007-08-14 23:01 149,504 –a—— C:\WINDOWS\system32\Systen.dll
2007-08-14 22:02 d——– C:\Program Files\Lavasoft
2007-08-14 22:02 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
2007-08-14 22:01 d——– C:\Program Files\Common Files\Wise Installation Wizard
2007-08-13 20:26 24,816 –a—— C:\WINDOWS\system32\mdimon.dll
2007-08-13 20:25 d——– C:\Program Files\Microsoft ActiveSync
2007-08-13 20:24 d——– C:\WINDOWS\SHELLNEW
2007-08-13 20:24 d——– C:\Program Files\Microsoft.NET
2007-08-12 01:24 d——– C:\DOCUME~1\khan\APPLIC~1\CyberLink
2007-08-12 01:16 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\CyberLink
2007-08-12 01:11 d——– C:\Program Files\CyberLink
2007-08-07 17:59 d–h—– C:\Program Files\Zero G Registry
2007-08-07 17:59 d——– C:\Program Files\Britannica 8.0
2007-08-07 17:56 d–h—– C:\DOCUME~1\khan\InstallAnywhere
2007-08-03 01:06 d——– C:\DOCUME~1\khan\APPLIC~1\Talkback
2007-08-02 21:50 d——– C:\DOCUME~1\khan\APPLIC~1\SiteAdvisor
2007-07-28 23:13 d——– C:\Program Files\Nero
2007-07-28 23:13 d——– C:\Program Files\Common Files\Ahead
2007-07-27 18:58 65,536 –a—— C:\WINDOWS\system32\WMErrNLD.dll


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-08-23 01:10 ——— d——– C:\DOCUME~1\khan\APPLIC~1\uTorrent
2007-08-12 01:14 ——— d–h—– C:\Program Files\InstallShield Installation Information
2007-08-12 01:11 505392 –a—— C:\WINDOWS\system32\msvcp71.dll
2007-07-27 18:59 5194 –a—— C:\WINDOWS\pchealth\helpctr\PackageStore\SkuStore.bin
2007-07-21 13:27 ——— d——– C:\Program Files\All Audio Converter
2007-07-21 13:27 ——— d——– C:\DOCUME~1\khan\APPLIC~1\Help
2007-07-20 02:11 ——— d——– C:\Program Files\Windows Media Connect 2
2007-07-13 19:48 ——— d——– C:\Program Files\McAfee
2007-07-13 19:44 ——— d——– C:\Program Files\Microsoft CAPICOM 2.1.0.2
2007-07-13 19:33 ——— d——– C:\Program Files\McAfee.com
2007-07-13 19:33 ——— d——– C:\Program Files\Common Files\McAfee
2007-07-13 19:27 ——— d——– C:\DOCUME~1\khan\APPLIC~1\Lavasoft
2007-07-07 22:45 ——— d——– C:\DOCUME~1\khan\APPLIC~1\vlc
2007-07-07 22:44 ——— d——– C:\Program Files\VideoLAN
2007-06-26 08:08 1104896 –a—— C:\WINDOWS\system32\msxml3.dll
2007-06-19 15:37 282112 –a—— C:\WINDOWS\system32\gdi32.dll
2007-06-13 12:23 937984 -r-hs—- C:\WINDOWS\system32\svdhost.exe
2007-06-13 12:23 1033216 –a—— C:\WINDOWS\explorer.exe


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="C:\Program Files\Google\Gmail Notifier\gnotify.exe" [2005-07-15 23:48]
"SoundMan"="SOUNDMAN.EXE" [2003-12-19 11:53 C:\WINDOWS\SOUNDMAN.EXE]
"DAEMON Tools-1033"="C:\Program Files\D-Tools\daemon.exe" [2004-08-22 18:05]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2003-07-28 14:19]
"nwiz"="nwiz.exe" [2003-07-28 14:19 C:\WINDOWS\system32\nwiz.exe]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 16:40]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2007-02-07 16:24]
"LanguageShortcut"="C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" [2007-02-07 16:21]
"RegistryMechanic"="" []
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvMediaCenter"="C:\WINDOWS\system32\NVMCTRAY.DLL,NvTaskbarInit" []
"NVIEW"="nview.dll,nViewLoadHook" []
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-06-01 13:32]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 03:56]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"nlsf"=cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll"
"tscuninstall"=%systemroot%\system32\tscupgrd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\TrkWks]
C:\WINDOWS\System32\Systen.dll 2007-08-14 23:01 149504 C:\WINDOWS\system32\Systen.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
"C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Norton Ghost 9.0]
C:\Program Files\Symantec\Norton Ghost\Agent\GhostTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
nwiz.exe /install

R0 viamraid;viamraid;C:\WINDOWS\system32\DRIVERS\viamraid.sys
R2 {95808DC4-FA4A-4c74-92FE-5B863F82066B};{95808DC4-FA4A-4c74-92FE-5B863F82066B};\??\C:\Program Files\CyberLink\PowerDVD\0.fcl
S2 nvtvSND;nVidia WDM TVAudio Crossbar;C:\WINDOWS\system32\DRIVERS\nvtvsnd.sys
S3 FETNDIS;VIA PCI 10/100Mb Fast Ethernet Adapter NT Driver;C:\WINDOWS\system32\DRIVERS\fetnd5.sys
S3 GMSIPCI;GMSIPCI;\??\I:\INSTALL\GMSIPCI.SYS


[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{254AB3C6-9303-C330-0500-020203040804}]
C:\WINDOWS\system32\Netstarter.exe

Contents of the 'Scheduled Tasks' folder
2007-07-13 17:33:19 C:\WINDOWS\Tasks\McDefragTask.job - C:\WINDOWS\system32\defrag.exe
2007-07-31 23:00:10 C:\WINDOWS\Tasks\McQcTask.job - c:\program files\mcafee\mqc\QcConsol.exe

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-23 01:15:15
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-08-23 1:16:37 - machine was rebooted
C:\ComboFix-quarantined-files.txt … 2007-08-23 01:16

— E O F —







Scan saved at 1:19:30 AM, on 8/23/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\CyberLink\Shared files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Google\Gmail Notifier\gnotify.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\wuauclt.exe
c:\program files\mcafee\msc\mcuimgr.exe
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\program files\mcafee\virusscan\scriptcl.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O20 - Winlogon Notify: TrkWks - C:\WINDOWS\System32\Systen.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe
O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe

I await further instructions. Thank you.
Post #8
Open notepad and copy/paste the text in the quotebox below into it:

File::
C:\WINDOWS\system32\svdhost.exe
C:\WINDOWS\system32\Systen.dll

Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\TrkWks]


Save this as Save this as "CFScript"


[external image: Posted Image]

Refering to the picture above, drag CFScript.txt into ComboFix.exe

Then post the results log
Post #9
Here is the log.

ComboFix 07-08-17.2 - "khan" 2007-08-23 2:57:23.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.250 [GMT 2:00]
Command switches used :: C:\Documents and Settings\khan\Desktop\CFScript.txt
* Created a new restore point


((((((((((((((((((((((((( Files Created from 2007-07-23 to 2007-08-23 )))))))))))))))))))))))))))))))


2007-08-23 01:09 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-08-22 17:40 50,688 –a—— C:\ATF-Cleaner.exe
2007-08-22 03:22 251,392 –a—— C:\hijackthis_sfx.exe
2007-08-21 21:36 12,413,440 –a—— C:\avgas-setup-7.5.1.43.exe
2007-08-21 20:18 d——– C:\WINDOWS\network diagnostic
2007-08-21 20:12 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
2007-08-21 20:06 d–hs—- C:\DOCUME~1\khan\UserData
2007-08-21 09:18 d-a—— C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
2007-08-15 14:00 d——– C:\Program Files\MSXML 6.0
2007-08-15 02:00 552 –a—— C:\WINDOWS\system32\d3d8caps.dat
2007-08-14 23:01 159,232 –a—— C:\WINDOWS\system32\sf.exe
2007-08-14 23:01 149,504 –a—— C:\WINDOWS\system32\Systen.dll
2007-08-14 22:02 d——– C:\Program Files\Lavasoft
2007-08-14 22:02 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
2007-08-14 22:01 d——– C:\Program Files\Common Files\Wise Installation Wizard
2007-08-13 20:26 24,816 –a—— C:\WINDOWS\system32\mdimon.dll
2007-08-13 20:25 d——– C:\Program Files\Microsoft ActiveSync
2007-08-13 20:24 d——– C:\WINDOWS\SHELLNEW
2007-08-13 20:24 d——– C:\Program Files\Microsoft.NET
2007-08-12 01:24 d——– C:\DOCUME~1\khan\APPLIC~1\CyberLink
2007-08-12 01:16 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\CyberLink
2007-08-12 01:11 d——– C:\Program Files\CyberLink
2007-08-07 17:59 d–h—– C:\Program Files\Zero G Registry
2007-08-07 17:59 d——– C:\Program Files\Britannica 8.0
2007-08-07 17:56 d–h—– C:\DOCUME~1\khan\InstallAnywhere
2007-08-03 01:06 d——– C:\DOCUME~1\khan\APPLIC~1\Talkback
2007-08-02 21:50 d——– C:\DOCUME~1\khan\APPLIC~1\SiteAdvisor
2007-07-28 23:13 d——– C:\Program Files\Nero
2007-07-28 23:13 d——– C:\Program Files\Common Files\Ahead
2007-07-27 18:58 65,536 –a—— C:\WINDOWS\system32\WMErrNLD.dll


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-08-23 02:56 ——— d——– C:\DOCUME~1\khan\APPLIC~1\uTorrent
2007-08-12 01:14 ——— d–h—– C:\Program Files\InstallShield Installation Information
2007-08-12 01:11 505392 –a—— C:\WINDOWS\system32\msvcp71.dll
2007-07-27 18:59 5194 –a—— C:\WINDOWS\pchealth\helpctr\PackageStore\SkuStore.bin
2007-07-21 13:27 ——— d——– C:\Program Files\All Audio Converter
2007-07-21 13:27 ——— d——– C:\DOCUME~1\khan\APPLIC~1\Help
2007-07-20 02:11 ——— d——– C:\Program Files\Windows Media Connect 2
2007-07-13 19:48 ——— d——– C:\Program Files\McAfee
2007-07-13 19:44 ——— d——– C:\Program Files\Microsoft CAPICOM 2.1.0.2
2007-07-13 19:33 ——— d——– C:\Program Files\McAfee.com
2007-07-13 19:33 ——— d——– C:\Program Files\Common Files\McAfee
2007-07-13 19:27 ——— d——– C:\DOCUME~1\khan\APPLIC~1\Lavasoft
2007-07-07 22:45 ——— d——– C:\DOCUME~1\khan\APPLIC~1\vlc
2007-07-07 22:44 ——— d——– C:\Program Files\VideoLAN
2007-06-26 08:08 1104896 –a—— C:\WINDOWS\system32\msxml3.dll
2007-06-19 15:37 282112 –a—— C:\WINDOWS\system32\gdi32.dll
2007-06-13 12:23 937984 -r-hs—- C:\WINDOWS\system32\svdhost.exe
2007-06-13 12:23 1033216 –a—— C:\WINDOWS\explorer.exe


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="C:\Program Files\Google\Gmail Notifier\gnotify.exe" [2005-07-15 23:48]
"SoundMan"="SOUNDMAN.EXE" [2003-12-19 11:53 C:\WINDOWS\SOUNDMAN.EXE]
"DAEMON Tools-1033"="C:\Program Files\D-Tools\daemon.exe" [2004-08-22 18:05]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2003-07-28 14:19]
"nwiz"="nwiz.exe" [2003-07-28 14:19 C:\WINDOWS\system32\nwiz.exe]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 16:40]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2007-02-07 16:24]
"LanguageShortcut"="C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" [2007-02-07 16:21]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvMediaCenter"="C:\WINDOWS\system32\NVMCTRAY.DLL,NvTaskbarInit" []
"NVIEW"="nview.dll,nViewLoadHook" []
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-06-01 13:32]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 03:56]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"nlsf"=cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll"
"tscuninstall"=%systemroot%\system32\tscupgrd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\TrkWks]
C:\WINDOWS\System32\Systen.dll 2007-08-14 23:01 149504 C:\WINDOWS\system32\Systen.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
"C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Norton Ghost 9.0]
C:\Program Files\Symantec\Norton Ghost\Agent\GhostTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
nwiz.exe /install

R0 viamraid;viamraid;C:\WINDOWS\system32\DRIVERS\viamraid.sys
R2 {95808DC4-FA4A-4c74-92FE-5B863F82066B};{95808DC4-FA4A-4c74-92FE-5B863F82066B};\??\C:\Program Files\CyberLink\PowerDVD\0.fcl
S2 nvtvSND;nVidia WDM TVAudio Crossbar;C:\WINDOWS\system32\DRIVERS\nvtvsnd.sys
S3 FETNDIS;VIA PCI 10/100Mb Fast Ethernet Adapter NT Driver;C:\WINDOWS\system32\DRIVERS\fetnd5.sys
S3 GMSIPCI;GMSIPCI;\??\I:\INSTALL\GMSIPCI.SYS

*Newly Created Service* - CATCHME

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{254AB3C6-9303-C330-0500-020203040804}]
C:\WINDOWS\system32\Netstarter.exe

Contents of the 'Scheduled Tasks' folder
2007-07-13 17:33:19 C:\WINDOWS\Tasks\McDefragTask.job - C:\WINDOWS\system32\defrag.exe
2007-07-31 23:00:10 C:\WINDOWS\Tasks\McQcTask.job - c:\program files\mcafee\mqc\QcConsol.exe

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-23 02:58:48
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-08-23 2:59:19
C:\ComboFix-quarantined-files.txt … 2007-08-23 02:59
C:\ComboFix2.txt … 2007-08-23 01:16

— E O F —
Thank you.
Post #10 last edited
That didn't work. Do you have the red combofix.exe on the desktop? Did you post the old combofix.txt file instead of the new one?
Post #11 last edited
Yes I do have the red combo.exe file on the desktop.

No Isent you the new one.

There are 3 combo files in C: One is the quarentined files, the other 2 are logs. For the sake of clarity I post below both of them.

ComboFix 07-08-17.2 - "khan" 2007-08-23 2:57:23.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.250 [GMT 2:00]
Command switches used :: C:\Documents and Settings\khan\Desktop\CFScript.txt
* Created a new restore point


((((((((((((((((((((((((( Files Created from 2007-07-23 to 2007-08-23 )))))))))))))))))))))))))))))))


2007-08-23 01:09 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-08-22 17:40 50,688 –a—— C:\ATF-Cleaner.exe
2007-08-22 03:22 251,392 –a—— C:\hijackthis_sfx.exe
2007-08-21 21:36 12,413,440 –a—— C:\avgas-setup-7.5.1.43.exe
2007-08-21 20:18 d——– C:\WINDOWS\network diagnostic
2007-08-21 20:12 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
2007-08-21 20:06 d–hs—- C:\DOCUME~1\khan\UserData
2007-08-21 09:18 d-a—— C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
2007-08-15 14:00 d——– C:\Program Files\MSXML 6.0
2007-08-15 02:00 552 –a—— C:\WINDOWS\system32\d3d8caps.dat
2007-08-14 23:01 159,232 –a—— C:\WINDOWS\system32\sf.exe
2007-08-14 23:01 149,504 –a—— C:\WINDOWS\system32\Systen.dll
2007-08-14 22:02 d——– C:\Program Files\Lavasoft
2007-08-14 22:02 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
2007-08-14 22:01 d——– C:\Program Files\Common Files\Wise Installation Wizard
2007-08-13 20:26 24,816 –a—— C:\WINDOWS\system32\mdimon.dll
2007-08-13 20:25 d——– C:\Program Files\Microsoft ActiveSync
2007-08-13 20:24 d——– C:\WINDOWS\SHELLNEW
2007-08-13 20:24 d——– C:\Program Files\Microsoft.NET
2007-08-12 01:24 d——– C:\DOCUME~1\khan\APPLIC~1\CyberLink
2007-08-12 01:16 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\CyberLink
2007-08-12 01:11 d——– C:\Program Files\CyberLink
2007-08-07 17:59 d–h—– C:\Program Files\Zero G Registry
2007-08-07 17:59 d——– C:\Program Files\Britannica 8.0
2007-08-07 17:56 d–h—– C:\DOCUME~1\khan\InstallAnywhere
2007-08-03 01:06 d——– C:\DOCUME~1\khan\APPLIC~1\Talkback
2007-08-02 21:50 d——– C:\DOCUME~1\khan\APPLIC~1\SiteAdvisor
2007-07-28 23:13 d——– C:\Program Files\Nero
2007-07-28 23:13 d——– C:\Program Files\Common Files\Ahead
2007-07-27 18:58 65,536 –a—— C:\WINDOWS\system32\WMErrNLD.dll


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-08-23 02:56 ——— d——– C:\DOCUME~1\khan\APPLIC~1\uTorrent
2007-08-12 01:14 ——— d–h—– C:\Program Files\InstallShield Installation Information
2007-08-12 01:11 505392 –a—— C:\WINDOWS\system32\msvcp71.dll
2007-07-27 18:59 5194 –a—— C:\WINDOWS\pchealth\helpctr\PackageStore\SkuStore.bin
2007-07-21 13:27 ——— d——– C:\Program Files\All Audio Converter
2007-07-21 13:27 ——— d——– C:\DOCUME~1\khan\APPLIC~1\Help
2007-07-20 02:11 ——— d——– C:\Program Files\Windows Media Connect 2
2007-07-13 19:48 ——— d——– C:\Program Files\McAfee
2007-07-13 19:44 ——— d——– C:\Program Files\Microsoft CAPICOM 2.1.0.2
2007-07-13 19:33 ——— d——– C:\Program Files\McAfee.com
2007-07-13 19:33 ——— d——– C:\Program Files\Common Files\McAfee
2007-07-13 19:27 ——— d——– C:\DOCUME~1\khan\APPLIC~1\Lavasoft
2007-07-07 22:45 ——— d——– C:\DOCUME~1\khan\APPLIC~1\vlc
2007-07-07 22:44 ——— d——– C:\Program Files\VideoLAN
2007-06-26 08:08 1104896 –a—— C:\WINDOWS\system32\msxml3.dll
2007-06-19 15:37 282112 –a—— C:\WINDOWS\system32\gdi32.dll
2007-06-13 12:23 937984 -r-hs—- C:\WINDOWS\system32\svdhost.exe
2007-06-13 12:23 1033216 –a—— C:\WINDOWS\explorer.exe


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="C:\Program Files\Google\Gmail Notifier\gnotify.exe" [2005-07-15 23:48]
"SoundMan"="SOUNDMAN.EXE" [2003-12-19 11:53 C:\WINDOWS\SOUNDMAN.EXE]
"DAEMON Tools-1033"="C:\Program Files\D-Tools\daemon.exe" [2004-08-22 18:05]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2003-07-28 14:19]
"nwiz"="nwiz.exe" [2003-07-28 14:19 C:\WINDOWS\system32\nwiz.exe]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 16:40]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2007-02-07 16:24]
"LanguageShortcut"="C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" [2007-02-07 16:21]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvMediaCenter"="C:\WINDOWS\system32\NVMCTRAY.DLL,NvTaskbarInit" []
"NVIEW"="nview.dll,nViewLoadHook" []
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-06-01 13:32]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 03:56]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"nlsf"=cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll"
"tscuninstall"=%systemroot%\system32\tscupgrd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\TrkWks]
C:\WINDOWS\System32\Systen.dll 2007-08-14 23:01 149504 C:\WINDOWS\system32\Systen.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
"C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Norton Ghost 9.0]
C:\Program Files\Symantec\Norton Ghost\Agent\GhostTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
nwiz.exe /install

R0 viamraid;viamraid;C:\WINDOWS\system32\DRIVERS\viamraid.sys
R2 {95808DC4-FA4A-4c74-92FE-5B863F82066B};{95808DC4-FA4A-4c74-92FE-5B863F82066B};\??\C:\Program Files\CyberLink\PowerDVD�0.fcl
S2 nvtvSND;nVidia WDM TVAudio Crossbar;C:\WINDOWS\system32\DRIVERS\nvtvsnd.sys
S3 FETNDIS;VIA PCI 10/100Mb Fast Ethernet Adapter NT Driver;C:\WINDOWS\system32\DRIVERS\fetnd5.sys
S3 GMSIPCI;GMSIPCI;\??\I:\INSTALL\GMSIPCI.SYS

*Newly Created Service* - CATCHME

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{254AB3C6-9303-C330-0500-020203040804}]
C:\WINDOWS\system32\Netstarter.exe

Contents of the 'Scheduled Tasks' folder
2007-07-13 17:33:19 C:\WINDOWS\Tasks\McDefragTask.job - C:\WINDOWS\system32\defrag.exe
2007-07-31 23:00:10 C:\WINDOWS\Tasks\McQcTask.job - c:\program files\mcafee\mqc\QcConsol.exe

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-23 02:58:48
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-08-23 2:59:19
C:\ComboFix-quarantined-files.txt … 2007-08-23 02:59
C:\ComboFix2.txt … 2007-08-23 01:16

— E O F —

ComboFix 07-08-17.2 - "khan" 2007-08-23 1:12:08.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.257 [GMT 2:00]
* Created a new restore point


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\WINDOWS\3354171.dll
C:\WINDOWS\system32\drivers\npf.sys
C:\WINDOWS\system32\packet.dll
C:\WINDOWS\system32\wpcap.dll


((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))


——-\NPF


((((((((((((((((((((((((( Files Created from 2007-07-22 to 2007-08-22 )))))))))))))))))))))))))))))))


2007-08-23 01:09 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-08-22 17:40 50,688 –a—— C:\ATF-Cleaner.exe
2007-08-22 03:24 5,149,152 –a—— C:\rminstall.exe
2007-08-22 03:22 251,392 –a—— C:\hijackthis_sfx.exe
2007-08-21 21:36 12,413,440 –a—— C:\avgas-setup-7.5.1.43.exe
2007-08-21 20:18 d——– C:\WINDOWS\network diagnostic
2007-08-21 20:12 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
2007-08-21 20:06 d–hs—- C:\DOCUME~1\khan\UserData
2007-08-21 09:18 d-a—— C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
2007-08-15 14:00 d——– C:\Program Files\MSXML 6.0
2007-08-15 02:00 552 –a—— C:\WINDOWS\system32\d3d8caps.dat
2007-08-14 23:01 159,232 –a—— C:\WINDOWS\system32\sf.exe
2007-08-14 23:01 149,504 –a—— C:\WINDOWS\system32\Systen.dll
2007-08-14 22:02 d——– C:\Program Files\Lavasoft
2007-08-14 22:02 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
2007-08-14 22:01 d——– C:\Program Files\Common Files\Wise Installation Wizard
2007-08-13 20:26 24,816 –a—— C:\WINDOWS\system32\mdimon.dll
2007-08-13 20:25 d——– C:\Program Files\Microsoft ActiveSync
2007-08-13 20:24 d——– C:\WINDOWS\SHELLNEW
2007-08-13 20:24 d——– C:\Program Files\Microsoft.NET
2007-08-12 01:24 d——– C:\DOCUME~1\khan\APPLIC~1\CyberLink
2007-08-12 01:16 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\CyberLink
2007-08-12 01:11 d——– C:\Program Files\CyberLink
2007-08-07 17:59 d–h—– C:\Program Files\Zero G Registry
2007-08-07 17:59 d——– C:\Program Files\Britannica 8.0
2007-08-07 17:56 d–h—– C:\DOCUME~1\khan\InstallAnywhere
2007-08-03 01:06 d——– C:\DOCUME~1\khan\APPLIC~1\Talkback
2007-08-02 21:50 d——– C:\DOCUME~1\khan\APPLIC~1\SiteAdvisor
2007-07-28 23:13 d——– C:\Program Files\Nero
2007-07-28 23:13 d——– C:\Program Files\Common Files\Ahead
2007-07-27 18:58 65,536 –a—— C:\WINDOWS\system32\WMErrNLD.dll


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-08-23 01:10 ——— d——– C:\DOCUME~1\khan\APPLIC~1\uTorrent
2007-08-12 01:14 ——— d–h—– C:\Program Files\InstallShield Installation Information
2007-08-12 01:11 505392 –a—— C:\WINDOWS\system32\msvcp71.dll
2007-07-27 18:59 5194 –a—— C:\WINDOWS\pchealth\helpctr\PackageStore\SkuStore.bin
2007-07-21 13:27 ——— d——– C:\Program Files\All Audio Converter
2007-07-21 13:27 ——— d——– C:\DOCUME~1\khan\APPLIC~1\Help
2007-07-20 02:11 ——— d——– C:\Program Files\Windows Media Connect 2
2007-07-13 19:48 ——— d——– C:\Program Files\McAfee
2007-07-13 19:44 ——— d——– C:\Program Files\Microsoft CAPICOM 2.1.0.2
2007-07-13 19:33 ——— d——– C:\Program Files\McAfee.com
2007-07-13 19:33 ——— d——– C:\Program Files\Common Files\McAfee
2007-07-13 19:27 ——— d——– C:\DOCUME~1\khan\APPLIC~1\Lavasoft
2007-07-07 22:45 ——— d——– C:\DOCUME~1\khan\APPLIC~1\vlc
2007-07-07 22:44 ——— d——– C:\Program Files\VideoLAN
2007-06-26 08:08 1104896 –a—— C:\WINDOWS\system32\msxml3.dll
2007-06-19 15:37 282112 –a—— C:\WINDOWS\system32\gdi32.dll
2007-06-13 12:23 937984 -r-hs—- C:\WINDOWS\system32\svdhost.exe
2007-06-13 12:23 1033216 –a—— C:\WINDOWS\explorer.exe


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="C:\Program Files\Google\Gmail Notifier\gnotify.exe" [2005-07-15 23:48]
"SoundMan"="SOUNDMAN.EXE" [2003-12-19 11:53 C:\WINDOWS\SOUNDMAN.EXE]
"DAEMON Tools-1033"="C:\Program Files\D-Tools\daemon.exe" [2004-08-22 18:05]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2003-07-28 14:19]
"nwiz"="nwiz.exe" [2003-07-28 14:19 C:\WINDOWS\system32\nwiz.exe]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 16:40]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2007-02-07 16:24]
"LanguageShortcut"="C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" [2007-02-07 16:21]
"RegistryMechanic"="" []
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvMediaCenter"="C:\WINDOWS\system32\NVMCTRAY.DLL,NvTaskbarInit" []
"NVIEW"="nview.dll,nViewLoadHook" []
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-06-01 13:32]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 03:56]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"nlsf"=cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll"
"tscuninstall"=%systemroot%\system32\tscupgrd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\TrkWks]
C:\WINDOWS\System32\Systen.dll 2007-08-14 23:01 149504 C:\WINDOWS\system32\Systen.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
"C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Norton Ghost 9.0]
C:\Program Files\Symantec\Norton Ghost\Agent\GhostTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
nwiz.exe /install

R0 viamraid;viamraid;C:\WINDOWS\system32\DRIVERS\viamraid.sys
R2 {95808DC4-FA4A-4c74-92FE-5B863F82066B};{95808DC4-FA4A-4c74-92FE-5B863F82066B};\??\C:\Program Files\CyberLink\PowerDVD�0.fcl
S2 nvtvSND;nVidia WDM TVAudio Crossbar;C:\WINDOWS\system32\DRIVERS\nvtvsnd.sys
S3 FETNDIS;VIA PCI 10/100Mb Fast Ethernet Adapter NT Driver;C:\WINDOWS\system32\DRIVERS\fetnd5.sys
S3 GMSIPCI;GMSIPCI;\??\I:\INSTALL\GMSIPCI.SYS


[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{254AB3C6-9303-C330-0500-020203040804}]
C:\WINDOWS\system32\Netstarter.exe

Contents of the 'Scheduled Tasks' folder
2007-07-13 17:33:19 C:\WINDOWS\Tasks\McDefragTask.job - C:\WINDOWS\system32\defrag.exe
2007-07-31 23:00:10 C:\WINDOWS\Tasks\McQcTask.job - c:\program files\mcafee\mqc\QcConsol.exe

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-23 01:15:15
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-08-23 1:16:37 - machine was rebooted
C:\ComboFix-quarantined-files.txt … 2007-08-23 01:16

— E O F —
ComboFix 07-08-17.2 - "khan" 2007-08-23 1:12:08.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.257 [GMT 2:00]
* Created a new restore point


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\WINDOWS\3354171.dll
C:\WINDOWS\system32\drivers\npf.sys
C:\WINDOWS\system32\packet.dll
C:\WINDOWS\system32\wpcap.dll


((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))


——-\NPF


((((((((((((((((((((((((( Files Created from 2007-07-22 to 2007-08-22 )))))))))))))))))))))))))))))))


2007-08-23 01:09 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-08-22 17:40 50,688 –a—— C:\ATF-Cleaner.exe
2007-08-22 03:24 5,149,152 –a—— C:\rminstall.exe
2007-08-22 03:22 251,392 –a—— C:\hijackthis_sfx.exe
2007-08-21 21:36 12,413,440 –a—— C:\avgas-setup-7.5.1.43.exe
2007-08-21 20:18 d——– C:\WINDOWS\network diagnostic
2007-08-21 20:12 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
2007-08-21 20:06 d–hs—- C:\DOCUME~1\khan\UserData
2007-08-21 09:18 d-a—— C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
2007-08-15 14:00 d——– C:\Program Files\MSXML 6.0
2007-08-15 02:00 552 –a—— C:\WINDOWS\system32\d3d8caps.dat
2007-08-14 23:01 159,232 –a—— C:\WINDOWS\system32\sf.exe
2007-08-14 23:01 149,504 –a—— C:\WINDOWS\system32\Systen.dll
2007-08-14 22:02 d——– C:\Program Files\Lavasoft
2007-08-14 22:02 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
2007-08-14 22:01 d——– C:\Program Files\Common Files\Wise Installation Wizard
2007-08-13 20:26 24,816 –a—— C:\WINDOWS\system32\mdimon.dll
2007-08-13 20:25 d——– C:\Program Files\Microsoft ActiveSync
2007-08-13 20:24 d——– C:\WINDOWS\SHELLNEW
2007-08-13 20:24 d——– C:\Program Files\Microsoft.NET
2007-08-12 01:24 d——– C:\DOCUME~1\khan\APPLIC~1\CyberLink
2007-08-12 01:16 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\CyberLink
2007-08-12 01:11 d——– C:\Program Files\CyberLink
2007-08-07 17:59 d–h—– C:\Program Files\Zero G Registry
2007-08-07 17:59 d——– C:\Program Files\Britannica 8.0
2007-08-07 17:56 d–h—– C:\DOCUME~1\khan\InstallAnywhere
2007-08-03 01:06 d——– C:\DOCUME~1\khan\APPLIC~1\Talkback
2007-08-02 21:50 d——– C:\DOCUME~1\khan\APPLIC~1\SiteAdvisor
2007-07-28 23:13 d——– C:\Program Files\Nero
2007-07-28 23:13 d——– C:\Program Files\Common Files\Ahead
2007-07-27 18:58 65,536 –a—— C:\WINDOWS\system32\WMErrNLD.dll


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-08-23 01:10 ——— d——– C:\DOCUME~1\khan\APPLIC~1\uTorrent
2007-08-12 01:14 ——— d–h—– C:\Program Files\InstallShield Installation Information
2007-08-12 01:11 505392 –a—— C:\WINDOWS\system32\msvcp71.dll
2007-07-27 18:59 5194 –a—— C:\WINDOWS\pchealth\helpctr\PackageStore\SkuStore.bin
2007-07-21 13:27 ——— d——– C:\Program Files\All Audio Converter
2007-07-21 13:27 ——— d——– C:\DOCUME~1\khan\APPLIC~1\Help
2007-07-20 02:11 ——— d——– C:\Program Files\Windows Media Connect 2
2007-07-13 19:48 ——— d——– C:\Program Files\McAfee
2007-07-13 19:44 ——— d——– C:\Program Files\Microsoft CAPICOM 2.1.0.2
2007-07-13 19:33 ——— d——– C:\Program Files\McAfee.com
2007-07-13 19:33 ——— d——– C:\Program Files\Common Files\McAfee
2007-07-13 19:27 ——— d——– C:\DOCUME~1\khan\APPLIC~1\Lavasoft
2007-07-07 22:45 ——— d——– C:\DOCUME~1\khan\APPLIC~1\vlc
2007-07-07 22:44 ——— d——– C:\Program Files\VideoLAN
2007-06-26 08:08 1104896 –a—— C:\WINDOWS\system32\msxml3.dll
2007-06-19 15:37 282112 –a—— C:\WINDOWS\system32\gdi32.dll
2007-06-13 12:23 937984 -r-hs—- C:\WINDOWS\system32\svdhost.exe
2007-06-13 12:23 1033216 –a—— C:\WINDOWS\explorer.exe


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="C:\Program Files\Google\Gmail Notifier\gnotify.exe" [2005-07-15 23:48]
"SoundMan"="SOUNDMAN.EXE" [2003-12-19 11:53 C:\WINDOWS\SOUNDMAN.EXE]
"DAEMON Tools-1033"="C:\Program Files\D-Tools\daemon.exe" [2004-08-22 18:05]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2003-07-28 14:19]
"nwiz"="nwiz.exe" [2003-07-28 14:19 C:\WINDOWS\system32\nwiz.exe]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 16:40]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2007-02-07 16:24]
"LanguageShortcut"="C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" [2007-02-07 16:21]
"RegistryMechanic"="" []
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvMediaCenter"="C:\WINDOWS\system32\NVMCTRAY.DLL,NvTaskbarInit" []
"NVIEW"="nview.dll,nViewLoadHook" []
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-06-01 13:32]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 03:56]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"nlsf"=cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll"
"tscuninstall"=%systemroot%\system32\tscupgrd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\TrkWks]
C:\WINDOWS\System32\Systen.dll 2007-08-14 23:01 149504 C:\WINDOWS\system32\Systen.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
"C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Norton Ghost 9.0]
C:\Program Files\Symantec\Norton Ghost\Agent\GhostTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
nwiz.exe /install

R0 viamraid;viamraid;C:\WINDOWS\system32\DRIVERS\viamraid.sys
R2 {95808DC4-FA4A-4c74-92FE-5B863F82066B};{95808DC4-FA4A-4c74-92FE-5B863F82066B};\??\C:\Program Files\CyberLink\PowerDVD�0.fcl
S2 nvtvSND;nVidia WDM TVAudio Crossbar;C:\WINDOWS\system32\DRIVERS\nvtvsnd.sys
S3 FETNDIS;VIA PCI 10/100Mb Fast Ethernet Adapter NT Driver;C:\WINDOWS\system32\DRIVERS\fetnd5.sys
S3 GMSIPCI;GMSIPCI;\??\I:\INSTALL\GMSIPCI.SYS


[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{254AB3C6-9303-C330-0500-020203040804}]
C:\WINDOWS\system32\Netstarter.exe

Contents of the 'Scheduled Tasks' folder
2007-07-13 17:33:19 C:\WINDOWS\Tasks\McDefragTask.job - C:\WINDOWS\system32\defrag.exe
2007-07-31 23:00:10 C:\WINDOWS\Tasks\McQcTask.job - c:\program files\mcafee\mqc\QcConsol.exe

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-23 01:15:15
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-08-23 1:16:37 - machine was rebooted
C:\ComboFix-quarantined-files.txt … 2007-08-23 01:16

— E O F —
ComboFix 07-08-17.2 - "khan" 2007-08-23 2:57:23.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.250 [GMT 2:00]
Command switches used :: C:\Documents and Settings\khan\Desktop\CFScript.txt
* Created a new restore point


((((((((((((((((((((((((( Files Created from 2007-07-23 to 2007-08-23 )))))))))))))))))))))))))))))))


2007-08-23 01:09 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-08-22 17:40 50,688 –a—— C:\ATF-Cleaner.exe
2007-08-22 03:22 251,392 –a—— C:\hijackthis_sfx.exe
2007-08-21 21:36 12,413,440 –a—— C:\avgas-setup-7.5.1.43.exe
2007-08-21 20:18 d——– C:\WINDOWS\network diagnostic
2007-08-21 20:12 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
2007-08-21 20:06 d–hs—- C:\DOCUME~1\khan\UserData
2007-08-21 09:18 d-a—— C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
2007-08-15 14:00 d——– C:\Program Files\MSXML 6.0
2007-08-15 02:00 552 –a—— C:\WINDOWS\system32\d3d8caps.dat
2007-08-14 23:01 159,232 –a—— C:\WINDOWS\system32\sf.exe
2007-08-14 23:01 149,504 –a—— C:\WINDOWS\system32\Systen.dll
2007-08-14 22:02 d——– C:\Program Files\Lavasoft
2007-08-14 22:02 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
2007-08-14 22:01 d——– C:\Program Files\Common Files\Wise Installation Wizard
2007-08-13 20:26 24,816 –a—— C:\WINDOWS\system32\mdimon.dll
2007-08-13 20:25 d——– C:\Program Files\Microsoft ActiveSync
2007-08-13 20:24 d——– C:\WINDOWS\SHELLNEW
2007-08-13 20:24 d——– C:\Program Files\Microsoft.NET
2007-08-12 01:24 d——– C:\DOCUME~1\khan\APPLIC~1\CyberLink
2007-08-12 01:16 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\CyberLink
2007-08-12 01:11 d——– C:\Program Files\CyberLink
2007-08-07 17:59 d–h—– C:\Program Files\Zero G Registry
2007-08-07 17:59 d——– C:\Program Files\Britannica 8.0
2007-08-07 17:56 d–h—– C:\DOCUME~1\khan\InstallAnywhere
2007-08-03 01:06 d——– C:\DOCUME~1\khan\APPLIC~1\Talkback
2007-08-02 21:50 d——– C:\DOCUME~1\khan\APPLIC~1\SiteAdvisor
2007-07-28 23:13 d——– C:\Program Files\Nero
2007-07-28 23:13 d——– C:\Program Files\Common Files\Ahead
2007-07-27 18:58 65,536 –a—— C:\WINDOWS\system32\WMErrNLD.dll


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-08-23 02:56 ——— d——– C:\DOCUME~1\khan\APPLIC~1\uTorrent
2007-08-12 01:14 ——— d–h—– C:\Program Files\InstallShield Installation Information
2007-08-12 01:11 505392 –a—— C:\WINDOWS\system32\msvcp71.dll
2007-07-27 18:59 5194 –a—— C:\WINDOWS\pchealth\helpctr\PackageStore\SkuStore.bin
2007-07-21 13:27 ——— d——– C:\Program Files\All Audio Converter
2007-07-21 13:27 ——— d——– C:\DOCUME~1\khan\APPLIC~1\Help
2007-07-20 02:11 ——— d——– C:\Program Files\Windows Media Connect 2
2007-07-13 19:48 ——— d——– C:\Program Files\McAfee
2007-07-13 19:44 ——— d——– C:\Program Files\Microsoft CAPICOM 2.1.0.2
2007-07-13 19:33 ——— d——– C:\Program Files\McAfee.com
2007-07-13 19:33 ——— d——– C:\Program Files\Common Files\McAfee
2007-07-13 19:27 ——— d——– C:\DOCUME~1\khan\APPLIC~1\Lavasoft
2007-07-07 22:45 ——— d——– C:\DOCUME~1\khan\APPLIC~1\vlc
2007-07-07 22:44 ——— d——– C:\Program Files\VideoLAN
2007-06-26 08:08 1104896 –a—— C:\WINDOWS\system32\msxml3.dll
2007-06-19 15:37 282112 –a—— C:\WINDOWS\system32\gdi32.dll
2007-06-13 12:23 937984 -r-hs—- C:\WINDOWS\system32\svdhost.exe
2007-06-13 12:23 1033216 –a—— C:\WINDOWS\explorer.exe


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="C:\Program Files\Google\Gmail Notifier\gnotify.exe" [2005-07-15 23:48]
"SoundMan"="SOUNDMAN.EXE" [2003-12-19 11:53 C:\WINDOWS\SOUNDMAN.EXE]
"DAEMON Tools-1033"="C:\Program Files\D-Tools\daemon.exe" [2004-08-22 18:05]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2003-07-28 14:19]
"nwiz"="nwiz.exe" [2003-07-28 14:19 C:\WINDOWS\system32\nwiz.exe]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 16:40]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2007-02-07 16:24]
"LanguageShortcut"="C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" [2007-02-07 16:21]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvMediaCenter"="C:\WINDOWS\system32\NVMCTRAY.DLL,NvTaskbarInit" []
"NVIEW"="nview.dll,nViewLoadHook" []
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-06-01 13:32]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 03:56]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"nlsf"=cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll"
"tscuninstall"=%systemroot%\system32\tscupgrd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\TrkWks]
C:\WINDOWS\System32\Systen.dll 2007-08-14 23:01 149504 C:\WINDOWS\system32\Systen.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
"C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Norton Ghost 9.0]
C:\Program Files\Symantec\Norton Ghost\Agent\GhostTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
nwiz.exe /install

R0 viamraid;viamraid;C:\WINDOWS\system32\DRIVERS\viamraid.sys
R2 {95808DC4-FA4A-4c74-92FE-5B863F82066B};{95808DC4-FA4A-4c74-92FE-5B863F82066B};\??\C:\Program Files\CyberLink\PowerDVD�0.fcl
S2 nvtvSND;nVidia WDM TVAudio Crossbar;C:\WINDOWS\system32\DRIVERS\nvtvsnd.sys
S3 FETNDIS;VIA PCI 10/100Mb Fast Ethernet Adapter NT Driver;C:\WINDOWS\system32\DRIVERS\fetnd5.sys
S3 GMSIPCI;GMSIPCI;\??\I:\INSTALL\GMSIPCI.SYS

*Newly Created Service* - CATCHME

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{254AB3C6-9303-C330-0500-020203040804}]
C:\WINDOWS\system32\Netstarter.exe

Contents of the 'Scheduled Tasks' folder
2007-07-13 17:33:19 C:\WINDOWS\Tasks\McDefragTask.job - C:\WINDOWS\system32\defrag.exe
2007-07-31 23:00:10 C:\WINDOWS\Tasks\McQcTask.job - c:\program files\mcafee\mqc\QcConsol.exe

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-23 02:58:48
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-08-23 2:59:19
C:\ComboFix-quarantined-files.txt … 2007-08-23 02:59
C:\ComboFix2.txt … 2007-08-23 01:16

— E O F —Sorry I think I posted one of the logs twice. One was completed at 2:59 and the other at 1:16. So they are different.I do not know how to delete the duplicate post so I am leaving everything as is.
Post #12
Delete the CFScript.txt file you have now.


Open notepad and copy/paste the text in the quotebox below into it:

File::
C:\WINDOWS\system32\Systen.dll
C:\WINDOWS\system32\sf.exe
C:\WINDOWS\system32\svdhost.exe

Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\TrkWks]


Save this as Save this as "CFScript"


[external image: Posted Image]

Refering to the picture above, drag CFScript.txt into ComboFix.exe

Then post the results log
Post #13
ComboFix 07-08-17.2 - "khan" 2007-08-23 4:23:19.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.208 [GMT 2:00]
Command switches used :: C:\Documents and Settings\khan\Desktop\CFScript.txt
* Created a new restore point


((((((((((((((((((((((((( Files Created from 2007-07-23 to 2007-08-23 )))))))))))))))))))))))))))))))


2007-08-23 01:09 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-08-22 17:40 50,688 –a—— C:\ATF-Cleaner.exe
2007-08-22 03:22 251,392 –a—— C:\hijackthis_sfx.exe
2007-08-21 21:36 12,413,440 –a—— C:\avgas-setup-7.5.1.43.exe
2007-08-21 20:18 d——– C:\WINDOWS\network diagnostic
2007-08-21 20:12 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
2007-08-21 20:06 d–hs—- C:\DOCUME~1\khan\UserData
2007-08-21 09:18 d-a—— C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
2007-08-15 14:00 d——– C:\Program Files\MSXML 6.0
2007-08-15 02:00 552 –a—— C:\WINDOWS\system32\d3d8caps.dat
2007-08-14 23:01 159,232 –a—— C:\WINDOWS\system32\sf.exe
2007-08-14 23:01 149,504 –a—— C:\WINDOWS\system32\Systen.dll
2007-08-14 22:02 d——– C:\Program Files\Lavasoft
2007-08-14 22:02 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
2007-08-14 22:01 d——– C:\Program Files\Common Files\Wise Installation Wizard
2007-08-13 20:26 24,816 –a—— C:\WINDOWS\system32\mdimon.dll
2007-08-13 20:25 d——– C:\Program Files\Microsoft ActiveSync
2007-08-13 20:24 d——– C:\WINDOWS\SHELLNEW
2007-08-13 20:24 d——– C:\Program Files\Microsoft.NET
2007-08-12 01:24 d——– C:\DOCUME~1\khan\APPLIC~1\CyberLink
2007-08-12 01:16 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\CyberLink
2007-08-12 01:11 d——– C:\Program Files\CyberLink
2007-08-07 17:59 d–h—– C:\Program Files\Zero G Registry
2007-08-07 17:59 d——– C:\Program Files\Britannica 8.0
2007-08-07 17:56 d–h—– C:\DOCUME~1\khan\InstallAnywhere
2007-08-03 01:06 d——– C:\DOCUME~1\khan\APPLIC~1\Talkback
2007-08-02 21:50 d——– C:\DOCUME~1\khan\APPLIC~1\SiteAdvisor
2007-07-28 23:13 d——– C:\Program Files\Nero
2007-07-28 23:13 d——– C:\Program Files\Common Files\Ahead
2007-07-27 18:58 65,536 –a—— C:\WINDOWS\system32\WMErrNLD.dll


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-08-23 04:22 ——— d——– C:\DOCUME~1\khan\APPLIC~1\uTorrent
2007-08-12 01:14 ——— d–h—– C:\Program Files\InstallShield Installation Information
2007-08-12 01:11 505392 –a—— C:\WINDOWS\system32\msvcp71.dll
2007-07-27 18:59 5194 –a—— C:\WINDOWS\pchealth\helpctr\PackageStore\SkuStore.bin
2007-07-21 13:27 ——— d——– C:\Program Files\All Audio Converter
2007-07-21 13:27 ——— d——– C:\DOCUME~1\khan\APPLIC~1\Help
2007-07-20 02:11 ——— d——– C:\Program Files\Windows Media Connect 2
2007-07-13 19:48 ——— d——– C:\Program Files\McAfee
2007-07-13 19:44 ——— d——– C:\Program Files\Microsoft CAPICOM 2.1.0.2
2007-07-13 19:33 ——— d——– C:\Program Files\McAfee.com
2007-07-13 19:33 ——— d——– C:\Program Files\Common Files\McAfee
2007-07-13 19:27 ——— d——– C:\DOCUME~1\khan\APPLIC~1\Lavasoft
2007-07-07 22:45 ——— d——– C:\DOCUME~1\khan\APPLIC~1\vlc
2007-07-07 22:44 ——— d——– C:\Program Files\VideoLAN
2007-06-26 08:08 1104896 –a—— C:\WINDOWS\system32\msxml3.dll
2007-06-19 15:37 282112 –a—— C:\WINDOWS\system32\gdi32.dll
2007-06-13 12:23 937984 -r-hs—- C:\WINDOWS\system32\svdhost.exe
2007-06-13 12:23 1033216 –a—— C:\WINDOWS\explorer.exe


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="C:\Program Files\Google\Gmail Notifier\gnotify.exe" [2005-07-15 23:48]
"SoundMan"="SOUNDMAN.EXE" [2003-12-19 11:53 C:\WINDOWS\SOUNDMAN.EXE]
"DAEMON Tools-1033"="C:\Program Files\D-Tools\daemon.exe" [2004-08-22 18:05]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2003-07-28 14:19]
"nwiz"="nwiz.exe" [2003-07-28 14:19 C:\WINDOWS\system32\nwiz.exe]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 16:40]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2007-02-07 16:24]
"LanguageShortcut"="C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" [2007-02-07 16:21]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvMediaCenter"="C:\WINDOWS\system32\NVMCTRAY.DLL,NvTaskbarInit" []
"NVIEW"="nview.dll,nViewLoadHook" []
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-06-01 13:32]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 03:56]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"nlsf"=cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll"
"tscuninstall"=%systemroot%\system32\tscupgrd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\TrkWks]
C:\WINDOWS\System32\Systen.dll 2007-08-14 23:01 149504 C:\WINDOWS\system32\Systen.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
"C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Norton Ghost 9.0]
C:\Program Files\Symantec\Norton Ghost\Agent\GhostTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
nwiz.exe /install

R0 viamraid;viamraid;C:\WINDOWS\system32\DRIVERS\viamraid.sys
R2 {95808DC4-FA4A-4c74-92FE-5B863F82066B};{95808DC4-FA4A-4c74-92FE-5B863F82066B};\??\C:\Program Files\CyberLink\PowerDVD\0.fcl
S2 nvtvSND;nVidia WDM TVAudio Crossbar;C:\WINDOWS\system32\DRIVERS\nvtvsnd.sys
S3 FETNDIS;VIA PCI 10/100Mb Fast Ethernet Adapter NT Driver;C:\WINDOWS\system32\DRIVERS\fetnd5.sys
S3 GMSIPCI;GMSIPCI;\??\I:\INSTALL\GMSIPCI.SYS

*Newly Created Service* - CATCHME

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{254AB3C6-9303-C330-0500-020203040804}]
C:\WINDOWS\system32\Netstarter.exe

Contents of the 'Scheduled Tasks' folder
2007-07-13 17:33:19 C:\WINDOWS\Tasks\McDefragTask.job - C:\WINDOWS\system32\defrag.exe
2007-07-31 23:00:10 C:\WINDOWS\Tasks\McQcTask.job - c:\program files\mcafee\mqc\QcConsol.exe

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-23 04:24:40
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-08-23 4:25:11
C:\ComboFix-quarantined-files.txt … 2007-08-23 04:25
C:\ComboFix2.txt … 2007-08-23 02:59
C:\ComboFix3.txt … 2007-08-23 01:16

— E O F —

Here it is. Just before preparing the log combofix in the sreen window says Search String Too Long I wonder if this has any bearing on the matter in hand.
Post #14
Reboot if you haven't already after the fix and "copy/paste" a new HijackThis log file into this thread.

Also please describe how your computer behaves at the moment.
Post #15
Heara is the log. Pc Behaviour at the end.


Scan saved at 11:17:33 PM, on 8/23/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\Program Files\Google\Gmail Notifier\gnotify.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\D-Tools\daemon.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\CyberLink\Shared files\RichVideo.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
D:\UT1.6.1.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\program files\mcafee\virusscan\scriptcl.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O20 - Winlogon Notify: TrkWks - C:\WINDOWS\System32\Systen.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe
O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe

I could not login in safe mode at all. Also today for about 2 hours pc was slugish and most of the progys would not start others took for ever. Tried McAfee and it behaved oddly the 1st time. Spybot again found win32 delf.uc and deleted. Later McAfee worked and found a cookie in my documents and deleted it. After that the pc suddenly started working normally, just a little slow. But F8 and Del keys dont work and I cant get to boot option page at all. Thanks.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI