What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Please Help

5 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I downloaded an online RPG game Deicide from what I thought was a reputable site and was infected here is the Hijackthis log and the Vunfdo Fix as I was infected with at least this. My computer on boot also tries to open a file mpm.exe that it can not find the right program to open.

Logfile of HijackThis v1.99.1
Scan saved at 7:28:37 AM, on 8/31/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\ibmpmsvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\CheckPoint\SSL Network Extender\slimsvc.exe
c:\program files\gates\salestraksync\GateshashSyncSvs.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\Program Files\McAfee\Common Framework\FrameworkService.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe
C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE
C:\Program Files\McAfee\Common Framework\UdaterUI.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe
C:\Program Files\McAfee\Common Framework\McTray.exe
C:\Program Files\DELL\Dell Laser MFP 1600n\NetworkScan\DNSCST.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\mHotkey.exe
C:\WINDOWS\CNYHKey.exe
C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Logitech\QuickCam\Quickcam.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Microsoft ActiveSync\Wcescomm.exe
C:\Program Files\Microsoft Location Finder\LocationFinder.exe
C:\PROGRA~1\MICROS~3\rapimgr.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Silicon Prairie Software\MemTurbo\memturbo.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Documents and Settings\mm9969\Desktop\hijackthis\Spyware.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.castanet.net/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 10.93.4.87:8081
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan Enterprise\Scriptcl.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {D7575692-B023-4350-B88D-E571EE5E1103} - C:\WINDOWS\system32\khfgf.dll (file missing)
O2 - BHO: (no name) - {F2C31720-0EA0-4A9E-998C-0A43A0DD623C} - C:\WINDOWS\system32\tuvsp.dll (file missing)
O4 - HKLM\..\Run: [TVT Scheduler Proxy] C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe
O4 - HKLM\..\Run: [EZEJMNAP] C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
O4 - HKLM\..\Run: [TP4EX] tp4ex.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\McAfee\Common Framework\UdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [DellNSCST] "C:\Program Files\DELL\Dell Laser MFP 1600n\NetworkScan\DNSCST.exe" /HIDEUI
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
O4 - HKLM\..\Run: [ledpointer] CNYHKey.exe
O4 - HKLM\..\Run: [Showwnd] showwnd.exe
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
O4 - HKLM\..\Run: [AAWTray] C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\Wcescomm.exe"
O4 - HKCU\..\Run: [Microsoft Location Finder] "C:\Program Files\Microsoft Location Finder\LocationFinder.exe"
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: MemTurbo.lnk = C:\Program Files\Silicon Prairie Software\MemTurbo\memturbo.exe
O4 - Global Startup: myPrintMileage.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/…lscbase8300.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1184784051549
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1185221985965
O16 - DPF: {74FFE28D-2378-11D5-990C-006094235084} (IBM Access Support) - http://www-307.ibm.com/pc/support/IbmEgath.cab
O16 - DPF: {B4CB50E4-0309-4906-86EA-10B6641C8392} (SlimClient Class) - https://199.243.247.116:10443/extender.cab
O16 - DPF: {BD8667B7-38D8-4C77-B580-18C3E146372C} (Creative Toolbox Plug-in) - http://caebmm.imgag.com/imgag/cp/install/crusher-cae.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = na.corp
O17 - HKLM\Software\..\Telephony: DomainName = na.corp
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = na.corp
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = na.corp
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = na.corp
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: khfgf - C:\WINDOWS\system32\khfgf.dll (file missing)
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Check Point SSL Network Extender (cpextender) - Check Point Software Technologies - C:\Program Files\CheckPoint\SSL Network Extender\slimsvc.exe
O23 - Service: GatesHashSyncSvs - Unknown owner - c:\program files\gates\salestraksync\GateshashSyncSvs.exe
O23 - Service: ThinkPad PM Service (IBMPMSVC) - Lenovo - C:\WINDOWS\system32\ibmpmsvc.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Unknown owner - C:\Program Files\McAfee\Common Framework\FrameworkService.exe" /ServiceStart (file missing)
O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
O23 - Service: SQL Server (MSSQLSERVER) (MSSQLSERVER) - Unknown owner - C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe" -sMSSQLSERVER (file missing)
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Start BT in service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\StartSkysolSvc.exe
O23 - Service: System Update (SUService) - Lenovo Group Limited - c:\program files\lenovo\system update\suservice.exe
O23 - Service: TVT Scheduler - Lenovo Group Limited - C:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe


VundoFix V6.5.7

Checking Java version…

Sun Java not detected
Scan started at 6:00:09 AM 8/31/2007

Listing files found while scanning….

C:\windows\system32\fgfhk.bak1
C:\WINDOWS\system32\fgfhk.ini
C:\WINDOWS\system32\khfgf.dll
C:\WINDOWS\system32\urqqrrs.dll

Beginning removal…

Attempting to delete C:\windows\system32\fgfhk.bak1
C:\windows\system32\fgfhk.bak1 Has been deleted!

Attempting to delete C:\WINDOWS\system32\fgfhk.ini
C:\WINDOWS\system32\fgfhk.ini Has been deleted!

Attempting to delete C:\WINDOWS\system32\khfgf.dll
C:\WINDOWS\system32\khfgf.dll Could not be deleted.

Attempting to delete C:\WINDOWS\system32\urqqrrs.dll
C:\WINDOWS\system32\urqqrrs.dll Could not be deleted.

Performing Repairs to the registry.
Done!

VundoFix V6.5.7

Checking Java version…

Sun Java not detected
Scan started at 7:14:15 AM 8/31/2007

Listing files found while scanning….

C:\WINDOWS\system32\fgfhk.ini
C:\WINDOWS\system32\khfgf.dll
C:\windows\system32\psvut.bak1
C:\windows\system32\psvut.ini
C:\WINDOWS\system32\tuvsp.dll
C:\WINDOWS\system32\urqqrrs.dll

Beginning removal…

Attempting to delete C:\WINDOWS\system32\fgfhk.ini
C:\WINDOWS\system32\fgfhk.ini Has been deleted!

Attempting to delete C:\windows\system32\psvut.bak1
C:\windows\system32\psvut.bak1 Has been deleted!

Attempting to delete C:\windows\system32\psvut.ini
C:\windows\system32\psvut.ini Has been deleted!

Attempting to delete C:\WINDOWS\system32\tuvsp.dll
C:\WINDOWS\system32\tuvsp.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\urqqrrs.dll
C:\WINDOWS\system32\urqqrrs.dll Has been deleted!

Performing Repairs to the registry.
Done!
Post #2
Hello and welcome to the forums

Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»

Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.


(If you use FireFox or the Opera browser
To keep saved passwords, click No at the prompt.)

It's normal after running ATF cleaner that the PC will be slower to boot the first time.

Next:

Download ComboFix from Here to your Desktop.
  • Double click combofix.exe and follow the prompts.
  • When finished, it shall produce a log for you, combofix.txt. Post that log and a HiJackthis log in your next reply
Note: Do not mouseclick while its running. That may cause it to stall
Post #3
Ok here they are.

ComboFix 07-08-30.3 - "mm9969" 2007-09-01 16:55:54.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.465 [GMT -7:00]
* Created a new restore point


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\DOCUME~1\mm9969\Desktop\internet explorer.lnk
C:\Temp\1cb
C:\Temp\1cb\syscheck.log
C:\Temp\fse
C:\Temp\fse\tmpZTF.log
C:\WINDOWS\system32\ewdgub.dat
C:\WINDOWS\system32\ewdgub.exe
C:\WINDOWS\system32\ewdgub_nav.dat
C:\WINDOWS\system32\ewdgub_navps.dat
C:\WINDOWS\system32\f03WtR
C:\WINDOWS\system32\nvs2.inf
C:\WINDOWS\system32\Z11


((((((((((((((((((((((((( Files Created from 2007-08-01 to 2007-09-01 )))))))))))))))))))))))))))))))


2007-09-01 16:55 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-09-01 16:46 9,343 ——— C:\WINDOWS\system32\drivers\TDSMAPI.SYS
2007-09-01 16:46 14,848 ——— C:\WINDOWS\system32\drivers\SMAPINT.SYS
2007-09-01 16:44 32,768 –a—— C:\WINDOWS\system32\TpKmpSvc.exe
2007-09-01 16:43 7,168 –a—— C:\WINDOWS\system32\drivers\TSMAPIP.SYS
2007-09-01 16:41 77,824 –a—— C:\WINDOWS\system32\SynTPCoI.dll
2007-09-01 16:41 d——– C:\WINDOWS\LastGood
2007-09-01 16:40 204,800 –a—— C:\WINDOWS\system32\IVIresizeW7.dll
2007-09-01 16:40 200,704 –a—— C:\WINDOWS\system32\IVIresizeA6.dll
2007-09-01 16:40 20,480 –a—— C:\WINDOWS\system32\IVIresize.dll
2007-09-01 16:40 192,512 –a—— C:\WINDOWS\system32\IVIresizeP6.dll
2007-09-01 16:40 192,512 –a—— C:\WINDOWS\system32\IVIresizeM6.dll
2007-09-01 16:40 188,416 –a—— C:\WINDOWS\system32\IVIresizePX.dll
2007-09-01 16:38 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\PC-Doctor
2007-09-01 16:36 d——– C:\Program Files\PCDR5
2007-09-01 12:21 d——– C:\DOCUME~1\mm9969\APPLIC~1\Sony Corporation
2007-09-01 12:07 2,560 –a—— C:\WINDOWS\system32\drivers\cdralw2k.sys
2007-09-01 12:07 2,432 –a—— C:\WINDOWS\system32\drivers\cdr4_xp.sys
2007-09-01 12:07 118,520 –a—— C:\WINDOWS\system32\PxInsI64.exe
2007-09-01 12:07 115,960 –a—— C:\WINDOWS\system32\PxCpyI64.exe
2007-09-01 12:04 d——– C:\Program Files\Sony
2007-09-01 12:00 38,016 –a–c— C:\WINDOWS\system32\dllcache\bthmodem.sys
2007-09-01 12:00 38,016 –a—— C:\WINDOWS\system32\drivers\bthmodem.sys
2007-09-01 11:04 1,513 –a—— C:\WINDOWS\bthservsdp.dat
2007-08-31 06:00 d——– C:\VundoFix Backups
2007-08-31 05:48 10,872 –a—— C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-08-31 03:24 153 –a—— C:\WINDOWS\system32\delFSF.bat
2007-08-30 22:01 d——– C:\Program Files\Lavasoft
2007-08-30 22:01 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
2007-08-30 21:58 d——– C:\Program Files\Common Files\Wise Installation Wizard
2007-08-30 21:57 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
2007-08-30 21:39 d——– C:\Program Files\Windows Live Safety Center
2007-08-30 21:26 304,161 ——— C:\WINDOWS\system32\viimimhb.exe
2007-08-30 21:13 d——– C:\QUARANTINE
2007-08-30 20:19 94,208 –a—— C:\WINDOWS\system32\MailSpectre.exe
2007-08-30 20:19 18,176 –a—— C:\WINDOWS\system32\drivers\smtpdrv.sys
2007-08-30 20:17 d——– C:\WINDOWS\system32\drivdll1
2007-08-30 20:17 d——– C:\WINDOWS\system32\confg23
2007-08-30 20:17 d——– C:\Temp
2007-08-25 18:08 d——– C:\Program Files\Logitech
2007-08-20 22:59 d——– C:\Program Files\XP Codec Pack
2007-08-16 15:29 d——– C:\Program Files\USB Wireless Keyboard Driver
2007-08-12 16:04 d——– C:\Program Files\iTunes
2007-08-12 16:04 d——– C:\Program Files\iPod
2007-08-12 16:03 d——– C:\Program Files\Common Files\Apple
2007-08-12 16:03 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple
2007-08-12 15:55 d——– C:\Program Files\QuickTime
2007-08-09 18:07 9,600 –a–c— C:\WINDOWS\system32\dllcache\hidusb.sys
2007-08-09 18:07 9,600 –a—— C:\WINDOWS\system32\drivers\hidusb.sys
2007-08-09 18:07 21,504 –a–c— C:\WINDOWS\system32\dllcache\hidserv.dll
2007-08-09 18:07 21,504 –a—— C:\WINDOWS\system32\hidserv.dll
2007-08-09 18:07 14,848 –a–c— C:\WINDOWS\system32\dllcache\kbdhid.sys
2007-08-09 18:07 14,848 –a—— C:\WINDOWS\system32\drivers\kbdhid.sys
2007-08-09 18:07 12,160 –a–c— C:\WINDOWS\system32\dllcache\mouhid.sys
2007-08-09 18:07 12,160 –a—— C:\WINDOWS\system32\drivers\mouhid.sys
2007-08-07 13:58 8,320 –a—— C:\WINDOWS\system32\drivers\AWRTRD.sys
2007-08-07 13:56 9,344 –a—— C:\WINDOWS\system32\drivers\NSDriver.sys
2007-08-07 06:59 d——– C:\Program Files\Common Files\Skype
2007-08-02 20:51 208,896 –a—— C:\WINDOWS\system32\FFRafShellEx.dll
2007-08-02 20:51 d——– C:\DOCUME~1\mm9969\APPLIC~1\InstallShield
2007-08-02 19:10 d——– C:\DOCUME~1\mm9969\APPLIC~1\TempOrders
2007-08-02 16:26 43,264 -ra—— C:\WINDOWS\system32\drivers\ser2pl.sys
2007-08-02 16:23 8,096 ——— C:\WINDOWS\system32\drivers\MASPINT.SYS
2007-08-02 16:23 4,030 ——— C:\WINDOWS\system\WINASPI.DLL
2007-08-02 16:23 30,208 ——— C:\WINDOWS\system32\WNASPI32.DLL
2007-08-02 16:23 2,486 ——— C:\WINDOWS\system\AS16POST.BIN
2007-08-02 16:23 d——– C:\MWASPI
2007-08-02 16:21 d——– C:\Program Files\PIXELA
2007-08-02 16:20 401,408 –a—— C:\WINDOWS\system32\FE05F3D6.dll
2007-08-02 16:20 401,408 –a—— C:\WINDOWS\system32\FE05EFED.dll
2007-08-02 16:20 380,928 –a—— C:\WINDOWS\system32\FE05F3D7.dll
2007-08-02 16:20 299,008 –a—— C:\WINDOWS\system32\FE05F3D5.dll
2007-08-02 16:20 299,008 –a—— C:\WINDOWS\system32\FE05F051.dll
2007-08-02 16:20 299,008 –a—— C:\WINDOWS\system32\FE05DA0D.dll
2007-08-02 16:20 106,496 –a—— C:\WINDOWS\system32\FPXS2Pro.dll
2007-08-02 16:19 81,924 ——— C:\WINDOWS\system32\drivers\VC4CB104.SYS
2007-08-02 16:19 274,432 –a—— C:\WINDOWS\system32\FFTIFF16.dll
2007-08-02 16:19 155,648 –a—— C:\WINDOWS\system32\FFRAFLIB.DLL
2007-08-02 16:19 d——– C:\Program Files\FinePixViewer
2007-08-02 16:18 d——– C:\Program Files\REGSHAVE
2007-08-01 21:40 d——– C:\DOCUME~1\mm9969\APPLIC~1\Apple Computer
2007-08-01 14:51 d——– C:\DOCUME~1\mm9969\(null)


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-09-01 16:46 ——— d–h—– C:\Program Files\InstallShield Installation Information
2007-09-01 16:45 ——— d——– C:\Program Files\ThinkPad
2007-09-01 16:40 ——— d——– C:\Program Files\InterVideo
2007-09-01 11:37 ——— d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Bluetooth
2007-08-25 18:08 ——— d——– C:\Program Files\Common Files\LogiShrd
2007-08-25 18:08 ——— d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\LogiShrd
2007-08-22 09:43 ——— d——– C:\DOCUME~1\mm9969\APPLIC~1\Skype
2007-08-19 19:59 ——— d——– C:\Program Files\PKR
2007-08-17 09:32 ——— d——– C:\Program Files\napalabels
2007-08-12 16:04 ——— d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
2007-08-12 15:49 ——— d——– C:\Program Files\Apple Software Update
2007-08-08 14:16 ——— d——– C:\Program Files\Skype
2007-08-07 06:59 ——— d——– C:\Program Files\Microsoft ActiveSync
2007-08-02 21:31 ——— d——– C:\DOCUME~1\mm9969\APPLIC~1\FUJIFILM
2007-08-02 19:06 ——— d——– C:\DOCUME~1\mm9969\APPLIC~1\PartsTrak
2007-07-31 22:13 ——— d——– C:\DOCUME~1\LOCALS~1\APPLIC~1\Help
2007-07-31 22:10 ——— d——– C:\Program Files\Hewlett-Packard
2007-07-31 21:53 ——— d——– C:\Program Files\DesignPro
2007-07-30 19:19 92504 –a—— C:\WINDOWS\system32\cdm.dll
2007-07-30 19:19 549720 –a—— C:\WINDOWS\system32\wuapi.dll
2007-07-30 19:19 53080 –a—— C:\WINDOWS\system32\wuauclt.exe
2007-07-30 19:19 43352 –a—— C:\WINDOWS\system32\wups2.dll
2007-07-30 19:19 325976 –a—— C:\WINDOWS\system32\wucltui.dll
2007-07-30 19:19 271224 –a—— C:\WINDOWS\system32\mucltui.dll
2007-07-30 19:19 207736 –a—— C:\WINDOWS\system32\muweb.dll
2007-07-30 19:19 203096 –a—— C:\WINDOWS\system32\wuweb.dll
2007-07-30 19:19 1712984 –a—— C:\WINDOWS\system32\wuaueng.dll
2007-07-30 19:18 33624 –a—— C:\WINDOWS\system32\wups.dll
2007-07-30 07:52 ——— d——– C:\Program Files\VisualTaskTips
2007-07-30 07:03 ——— d——– C:\Program Files\Common Files\Business Objects
2007-07-28 11:09 ——— d——– C:\Program Files\Silicon Prairie Software
2007-07-28 10:41 ——— d——– C:\DOCUME~1\mm9969\APPLIC~1\Help
2007-07-26 12:45 ——— d——– C:\Program Files\TELUS
2007-07-26 12:00 ——— d——– C:\DOCUME~1\mm9969\APPLIC~1\IBMERS
2007-07-26 12:00 ——— d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\IBMERS
2007-07-26 11:58 ——— d——– C:\Program Files\TELUS eCare
2007-07-25 09:39 ——— d——– C:\Program Files\Yahoo!
2007-07-25 09:39 ——— d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo!
2007-07-25 09:37 ——— d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Skype
2007-07-25 08:44 ——— d——– C:\Program Files\MSXML 4.0
2007-07-25 08:44 ——— d——– C:\Program Files\Microsoft CAPICOM 2.1.0.2
2007-07-24 17:51 0 –a—— C:\WINDOWS\system32\drivers\lvuvc.hs
2007-07-24 17:46 ——— d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Logitech
2007-07-23 21:15 ——— d——– C:\DOCUME~1\mm9969\APPLIC~1\WinRAR
2007-07-23 14:24 ——— d——– C:\Program Files\Windows Media Connect 2
2007-07-23 14:16 ——— d——– C:\Program Files\MSXML 6.0
2007-07-23 14:16 ——— d——– C:\Program Files\Microsoft SQL Server
2007-07-23 13:30 ——— d——– C:\Program Files\Microsoft Location Finder
2007-07-23 13:29 ——— d——– C:\Program Files\Microsoft Streets & Trips
2007-07-23 13:22 ——— d——– C:\Program Files\MSN Messenger
2007-07-23 12:49 ——— d——– C:\Program Files\DELL
2007-07-23 11:02 ——— d——– C:\DOCUME~1\mm9969\APPLIC~1\Motive
2007-07-23 11:01 ——— d——– C:\Program Files\Common Files\Motive
2007-07-23 10:50 ——— d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Motive
2007-07-20 00:39 2142488 –a—— C:\WINDOWS\system32\drivers\LVMVdrv.sys
2007-07-20 00:37 2109592 –a—— C:\WINDOWS\system32\drivers\Lvckap.sys
2007-07-19 10:39 ——— d——– C:\DOCUME~1\mm9969\APPLIC~1\Leadertech
2007-07-19 10:39 ——— d——– C:\DOCUME~1\mm9969\APPLIC~1\InterVideo
2007-07-19 10:37 0 -rah—– C:\WINDOWS\system32\drivers\IBM_1836_QPU_TP.MRK
2007-07-19 10:37 ——— d——– C:\DOCUME~1\mm9969\APPLIC~1\Sonic
2007-07-19 10:25 ——— d——– C:\Program Files\Common Files\Sonic
2007-07-19 10:24 ——— d——– C:\Program Files\Sonic
2007-07-19 10:24 ——— d——– C:\Program Files\Common Files\SureThing Shared
2007-07-19 10:04 ——— d——– C:\DOCUME~1\mm9969\APPLIC~1\Check Point
2007-07-19 10:03 ——— d——– C:\Program Files\CheckPoint
2007-07-19 09:29 ——— d——– C:\Program Files\gates
2007-07-19 07:31 ——— d——– C:\Program Files\Microsoft Visual Studio .NET 2003
2007-07-19 07:29 40 –a—— C:\MSDERun.bat
2007-07-19 07:10 ——— d——– C:\Program Files\Scope
2007-07-19 07:07 ——— d——– C:\Program Files\Microsoft.NET
2007-07-18 17:42 25624 –a—— C:\WINDOWS\system32\drivers\LVPr2Mon.sys
2007-07-18 13:06 ——— d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\McAfee
2007-07-18 13:05 ——— d——– C:\Program Files\McAfee
2007-07-18 13:05 ——— d——– C:\Program Files\Common Files\McAfee
2007-07-18 13:05 ——— d——– C:\Program Files\Common Files\Cisco Systems
2007-07-18 12:04 ——— d——– C:\Program Files\Synaptics
2007-07-18 11:12 ——— d——– C:\Program Files\Analog Devices
2007-07-18 11:11 ——— d——– C:\Program Files\Common Files\InstallShield
2007-07-18 10:22 ——— d——– C:\Program Files\ATI Technologies
2007-07-18 06:51 ——— d——– C:\Program Files\Intel
2007-07-18 06:50 ——— d——– C:\Program Files\NetWaiting
2007-07-18 06:50 ——— d——– C:\Program Files\Digital Line Detect
2007-07-18 06:50 ——— d——– C:\Program Files\CONEXANT
2007-07-18 06:05 ——— d——– C:\Program Files\Lenovo
2007-07-18 06:05 ——— d——– C:\Program Files\Common Files\Lenovo
2007-07-18 04:31 ——— d——– C:\Program Files\microsoft frontpage
2007-07-11 14:37 6272 –a—— C:\WINDOWS\system32\drivers\AWRTPD.sys
2007-07-05 19:04 73728 –a—— C:\WINDOWS\system32\SynCOM.dll
2007-07-05 19:04 110592 –a—— C:\WINDOWS\system32\SynCtrl.dll
2007-07-05 19:02 177664 –a—— C:\WINDOWS\system32\drivers\SynTP.sys
2007-06-25 23:08 1104896 –a—— C:\WINDOWS\system32\msxml3.dll
2007-06-19 06:31 282112 –a—— C:\WINDOWS\system32\gdi32.dll
2007-06-14 03:37 499712 –a—— C:\WINDOWS\system32\msvcp71.dll
2007-06-14 03:37 348160 –a—— C:\WINDOWS\system32\msvcr71.dll
2007-06-14 03:37 1047552 –a—— C:\WINDOWS\system32\MFC71u.dll
2007-06-13 03:23 1033216 –a—— C:\WINDOWS\explorer.exe
2007-06-07 12:10 20480 –a—— C:\WINDOWS\system32\ac3config.exe


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D7575692-B023-4350-B88D-E571EE5E1103}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F2C31720-0EA0-4A9E-998C-0A43A0DD623C}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TVT Scheduler Proxy"="C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe" [2006-12-10 16:36]
"EZEJMNAP"="C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe" [2007-04-26 23:33]
"TP4EX"="tp4ex.exe" [2005-10-16 22:11 C:\WINDOWS\system32\TP4EX.exe]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2006-11-16 18:00]
"SoundMAXPnP"="C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-10-14 09:11]
"SoundMAX"="C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" [2004-09-23 12:41]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2003-06-24 11:34]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2003-06-24 11:33]
"ShStatEXE"="C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.exe" [2006-11-30 05:50]
"McAfeeUpdaterUI"="C:\Program Files\McAfee\Common Framework\UdaterUI.exe" [2006-11-17 10:39]
"dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2004-08-12 22:05]
"UpdateManager"="C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" [2004-01-06 22:01]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06]
"DellNSCST"="C:\Program Files\DELL\Dell Laser MFP 1600n\NetworkScan\DNSCST.exe" [2005-05-17 19:00]
"REGSHAVE"="C:\Program Files\REGSHAVE\REGSHAVE.exe" [2002-02-04 22:32]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 06:24]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-07-31 18:44]
"CHotkey"="mHotkey.exe" [2004-12-08 17:57 C:\WINDOWS\mHotkey.exe]
"ledpointer"="CNYHKey.exe" [2005-09-30 14:57 C:\WINDOWS\CNYHKey.exe]
"Showwnd"="showwnd.exe" [2003-09-18 20:09 C:\WINDOWS\ShowWnd.exe]
"LogitechCommunicationsManager"="C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2007-07-25 16:02]
"LogitechQuickCamRibbon"="C:\Program Files\Logitech\QuickCam\Quickcam.exe" [2007-07-25 16:06]
"AAWTray"="C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe" [2007-08-08 15:53]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 02:25]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-04 05:00 C:\WINDOWS\system32\bthprops.cpl]
"TPKMAPHELPER"="C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe" [2007-01-09 16:28]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\Wcescomm.exe" [2006-11-13 13:39]
"Microsoft Location Finder"="C:\Program Files\Microsoft Location Finder\LocationFinder.exe" [2005-08-24 18:25]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\runonce]
"configmsi"=cmd /c "rmdir /q C:\config.msi"
"supportdir"=cmd /c "rmdir /q /s "C:\DOCUME~1\mm9969\LOCALS~1\Temp\{F151F2B3-0C32-44D3-90E2-E639B8024622}""

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoSetActiveDesktop"=1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSetActiveDesktop"=1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\khfgf]

R1 mfetdik;McAfee Inc.;C:\WINDOWS\system32\drivers\mfetdik.sys
R2 cpextender;Check Point SSL Network Extender;C:\Program Files\CheckPoint\SSL Network Extender\slimsvc.exe
R2 SQLWriter;SQL Server VSS Writer;"C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe"
R3 mfeapfk;McAfee Inc.;C:\WINDOWS\system32\drivers\mfeapfk.sys
R3 VNA;Check Point Virtual Network Adapter;C:\WINDOWS\system32\DRIVERS\vna.sys
S2 GatesHashSyncSvs;GatesHashSyncSvs;c:\program files\gates\salestraksync\GateshashSyncSvs.exe noinstall
S4 SMDRV;SMDRV;C:\WINDOWS\system32\drivers\SMDRV.SYS
S4 SWI32;SWI32;\??\C:\Program Files\Lenovo\System Update\session\7ksa10ww\SWI32.sys

*Newly Created Service* - CATCHME
*Newly Created Service* - SMAPINT
*Newly Created Service* - SMDRV
*Newly Created Service* - SWI32
*Newly Created Service* - TDSMAPI
*Newly Created Service* - TSMAPIP

Contents of the 'Scheduled Tasks' folder
2007-08-26 22:48:04 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-09-01 16:59:03
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-09-01 17:00:44
C:\ComboFix-quarantined-files.txt … 2007-09-01 17:00

— E O F —


Logfile of HijackThis v1.99.1
Scan saved at 17:02, on 2007-09-01
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\ibmpmsvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe
C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE
C:\Program Files\McAfee\Common Framework\UdaterUI.exe
C:\Program Files\CheckPoint\SSL Network Extender\slimsvc.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\Program Files\McAfee\Common Framework\McTray.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\McAfee\Common Framework\FrameworkService.exe
C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
C:\Program Files\DELL\Dell Laser MFP 1600n\NetworkScan\DNSCST.exe
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\mHotkey.exe
C:\WINDOWS\CNYHKey.exe
C:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe
C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Logitech\QuickCam\Quickcam.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Microsoft ActiveSync\Wcescomm.exe
C:\Program Files\Microsoft Location Finder\LocationFinder.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\PROGRA~1\MICROS~3\rapimgr.exe
C:\Program Files\Silicon Prairie Software\MemTurbo\memturbo.exe
c:\program files\lenovo\system update\suservice.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Documents and Settings\mm9969\Desktop\hijackthis\Spyware.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.castanet.net/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 10.93.4.87:8081
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan Enterprise\Scriptcl.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {D7575692-B023-4350-B88D-E571EE5E1103} - (no file)
O2 - BHO: (no name) - {F2C31720-0EA0-4A9E-998C-0A43A0DD623C} - (no file)
O4 - HKLM\..\Run: [TVT Scheduler Proxy] C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe
O4 - HKLM\..\Run: [EZEJMNAP] C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
O4 - HKLM\..\Run: [TP4EX] tp4ex.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] C:\Program Files\Analog Devices\SoundMAX\Smax4.exe /tray
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\McAfee\Common Framework\UdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [DellNSCST] "C:\Program Files\DELL\Dell Laser MFP 1600n\NetworkScan\DNSCST.exe" /HIDEUI
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
O4 - HKLM\..\Run: [ledpointer] CNYHKey.exe
O4 - HKLM\..\Run: [Showwnd] showwnd.exe
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
O4 - HKLM\..\Run: [AAWTray] C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [TPKMAPHELPER] C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe -helper
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\Wcescomm.exe"
O4 - HKCU\..\Run: [Microsoft Location Finder] "C:\Program Files\Microsoft Location Finder\LocationFinder.exe"
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: MemTurbo.lnk = C:\Program Files\Silicon Prairie Software\MemTurbo\memturbo.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {2DAD3559-2923-4935-AD49-B673D2539944} (IASRunner Class) - http://www-307.ibm.com/pc/support/acpir.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/…lscbase8300.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1184784051549
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1185221985965
O16 - DPF: {74FFE28D-2378-11D5-990C-006094235084} (IBM Access Support) - http://www-307.ibm.com/pc/support/IbmEgath.cab
O16 - DPF: {B4CB50E4-0309-4906-86EA-10B6641C8392} (SlimClient Class) - https://199.243.247.116:10443/extender.cab
O16 - DPF: {BD8667B7-38D8-4C77-B580-18C3E146372C} (Creative Toolbox Plug-in) - http://caebmm.imgag.com/imgag/cp/install/crusher-cae.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = na.corp
O17 - HKLM\Software\..\Telephony: DomainName = na.corp
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = na.corp
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = na.corp
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = na.corp
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: khfgf - C:\WINDOWS\
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Check Point SSL Network Extender (cpextender) - Check Point Software Technologies - C:\Program Files\CheckPoint\SSL Network Extender\slimsvc.exe
O23 - Service: GatesHashSyncSvs - Unknown owner - c:\program files\gates\salestraksync\GateshashSyncSvs.exe
O23 - Service: ThinkPad PM Service (IBMPMSVC) - Lenovo - C:\WINDOWS\system32\ibmpmsvc.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Unknown owner - C:\Program Files\McAfee\Common Framework\FrameworkService.exe" /ServiceStart (file missing)
O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
O23 - Service: SQL Server (MSSQLSERVER) (MSSQLSERVER) - Unknown owner - C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe" -sMSSQLSERVER (file missing)
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: System Update (SUService) - Lenovo Group Limited - c:\program files\lenovo\system update\suservice.exe
O23 - Service: IBM KCU Service (TpKmpSVC) - Unknown owner - C:\WINDOWS\system32\TpKmpSVC.exe
O23 - Service: TVT Scheduler - Lenovo Group Limited - C:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe
Post #4
Open notepad and copy/paste the text in the quotebox below into it:

File::
C:\WINDOWS\system32\delFSF.bat
C:\WINDOWS\system32\viimimhb.exe

Folder::
C:\VundoFix Backups
C:\QUARANTINE

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D7575692-B023-4350-B88D-E571EE5E1103}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F2C31720-0EA0-4A9E-998C-0A43A0DD623C}]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\khfgf]


Save this as Save this as "CFScript"


[external image: Posted Image]

Refering to the picture above, drag CFScript.txt into ComboFix.exe

Then post the results log
Post #5
ComboFix 07-08-30.3 - "mm9969" 2007-09-01 17:37:25.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.524 [GMT -7:00]
Command switches used :: C:\Documents and Settings\mm9969\Desktop\CFScript.txt
* Created a new restore point

FILE::
C:\WINDOWS\system32\delFSF.bat
C:\WINDOWS\system32\viimimhb.exe


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\QUARANTINE
C:\VundoFix Backups
C:\WINDOWS\system32\delFSF.bat
C:\WINDOWS\system32\viimimhb.exe


((((((((((((((((((((((((( Files Created from 2007-08-02 to 2007-09-02 )))))))))))))))))))))))))))))))


2007-09-01 16:55 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-09-01 16:46 9,343 ——— C:\WINDOWS\system32\drivers\TDSMAPI.SYS
2007-09-01 16:46 14,848 ——— C:\WINDOWS\system32\drivers\SMAPINT.SYS
2007-09-01 16:44 32,768 –a—— C:\WINDOWS\system32\TpKmpSvc.exe
2007-09-01 16:43 7,168 –a—— C:\WINDOWS\system32\drivers\TSMAPIP.SYS
2007-09-01 16:41 77,824 –a—— C:\WINDOWS\system32\SynTPCoI.dll
2007-09-01 16:40 204,800 –a—— C:\WINDOWS\system32\IVIresizeW7.dll
2007-09-01 16:40 200,704 –a—— C:\WINDOWS\system32\IVIresizeA6.dll
2007-09-01 16:40 20,480 –a—— C:\WINDOWS\system32\IVIresize.dll
2007-09-01 16:40 192,512 –a—— C:\WINDOWS\system32\IVIresizeP6.dll
2007-09-01 16:40 192,512 –a—— C:\WINDOWS\system32\IVIresizeM6.dll
2007-09-01 16:40 188,416 –a—— C:\WINDOWS\system32\IVIresizePX.dll
2007-09-01 16:38 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\PC-Doctor
2007-09-01 16:36 d——– C:\Program Files\PCDR5
2007-09-01 12:21 d——– C:\DOCUME~1\mm9969\APPLIC~1\Sony Corporation
2007-09-01 12:07 2,560 –a—— C:\WINDOWS\system32\drivers\cdralw2k.sys
2007-09-01 12:07 2,432 –a—— C:\WINDOWS\system32\drivers\cdr4_xp.sys
2007-09-01 12:07 118,520 –a—— C:\WINDOWS\system32\PxInsI64.exe
2007-09-01 12:07 115,960 –a—— C:\WINDOWS\system32\PxCpyI64.exe
2007-09-01 12:04 d——– C:\Program Files\Sony
2007-09-01 12:00 38,016 –a–c— C:\WINDOWS\system32\dllcache\bthmodem.sys
2007-09-01 12:00 38,016 –a—— C:\WINDOWS\system32\drivers\bthmodem.sys
2007-09-01 11:04 1,513 –a—— C:\WINDOWS\bthservsdp.dat
2007-08-31 05:48 10,872 –a—— C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-08-30 22:01 d——– C:\Program Files\Lavasoft
2007-08-30 22:01 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
2007-08-30 21:58 d——– C:\Program Files\Common Files\Wise Installation Wizard
2007-08-30 21:57 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
2007-08-30 21:39 d——– C:\Program Files\Windows Live Safety Center
2007-08-30 20:19 94,208 –a—— C:\WINDOWS\system32\MailSpectre.exe
2007-08-30 20:19 18,176 –a—— C:\WINDOWS\system32\drivers\smtpdrv.sys
2007-08-30 20:17 d——– C:\WINDOWS\system32\drivdll1
2007-08-30 20:17 d——– C:\WINDOWS\system32\confg23
2007-08-30 20:17 d——– C:\Temp
2007-08-25 18:08 d——– C:\Program Files\Logitech
2007-08-20 22:59 d——– C:\Program Files\XP Codec Pack
2007-08-16 15:29 d——– C:\Program Files\USB Wireless Keyboard Driver
2007-08-12 16:04 d——– C:\Program Files\iTunes
2007-08-12 16:04 d——– C:\Program Files\iPod
2007-08-12 16:03 d——– C:\Program Files\Common Files\Apple
2007-08-12 16:03 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple
2007-08-12 15:55 d——– C:\Program Files\QuickTime
2007-08-09 18:07 9,600 –a–c— C:\WINDOWS\system32\dllcache\hidusb.sys
2007-08-09 18:07 9,600 –a—— C:\WINDOWS\system32\drivers\hidusb.sys
2007-08-09 18:07 21,504 –a–c— C:\WINDOWS\system32\dllcache\hidserv.dll
2007-08-09 18:07 21,504 –a—— C:\WINDOWS\system32\hidserv.dll
2007-08-09 18:07 14,848 –a–c— C:\WINDOWS\system32\dllcache\kbdhid.sys
2007-08-09 18:07 14,848 –a—— C:\WINDOWS\system32\drivers\kbdhid.sys
2007-08-09 18:07 12,160 –a–c— C:\WINDOWS\system32\dllcache\mouhid.sys
2007-08-09 18:07 12,160 –a—— C:\WINDOWS\system32\drivers\mouhid.sys
2007-08-07 13:58 8,320 –a—— C:\WINDOWS\system32\drivers\AWRTRD.sys
2007-08-07 13:56 9,344 –a—— C:\WINDOWS\system32\drivers\NSDriver.sys
2007-08-07 06:59 d——– C:\Program Files\Common Files\Skype
2007-08-02 20:51 208,896 –a—— C:\WINDOWS\system32\FFRafShellEx.dll
2007-08-02 20:51 d——– C:\DOCUME~1\mm9969\APPLIC~1\InstallShield
2007-08-02 19:10 d——– C:\DOCUME~1\mm9969\APPLIC~1\TempOrders
2007-08-02 16:26 43,264 -ra—— C:\WINDOWS\system32\drivers\ser2pl.sys
2007-08-02 16:23 8,096 ——— C:\WINDOWS\system32\drivers\MASPINT.SYS
2007-08-02 16:23 4,030 ——— C:\WINDOWS\system\WINASPI.DLL
2007-08-02 16:23 30,208 ——— C:\WINDOWS\system32\WNASPI32.DLL
2007-08-02 16:23 2,486 ——— C:\WINDOWS\system\AS16POST.BIN
2007-08-02 16:23 d——– C:\MWASPI
2007-08-02 16:21 d——– C:\Program Files\PIXELA
2007-08-02 16:20 401,408 –a—— C:\WINDOWS\system32\FE05F3D6.dll
2007-08-02 16:20 401,408 –a—— C:\WINDOWS\system32\FE05EFED.dll
2007-08-02 16:20 380,928 –a—— C:\WINDOWS\system32\FE05F3D7.dll
2007-08-02 16:20 299,008 –a—— C:\WINDOWS\system32\FE05F3D5.dll
2007-08-02 16:20 299,008 –a—— C:\WINDOWS\system32\FE05F051.dll
2007-08-02 16:20 299,008 –a—— C:\WINDOWS\system32\FE05DA0D.dll
2007-08-02 16:20 106,496 –a—— C:\WINDOWS\system32\FPXS2Pro.dll
2007-08-02 16:19 81,924 ——— C:\WINDOWS\system32\drivers\VC4CB104.SYS
2007-08-02 16:19 274,432 –a—— C:\WINDOWS\system32\FFTIFF16.dll
2007-08-02 16:19 155,648 –a—— C:\WINDOWS\system32\FFRAFLIB.DLL
2007-08-02 16:19 d——– C:\Program Files\FinePixViewer
2007-08-02 16:18 d——– C:\Program Files\REGSHAVE
2007-08-01 21:40 d——– C:\DOCUME~1\mm9969\APPLIC~1\Apple Computer
2007-08-01 14:51 d——– C:\DOCUME~1\mm9969\(null)


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-09-01 16:46 ——— d–h—– C:\Program Files\InstallShield Installation Information
2007-09-01 16:45 ——— d——– C:\Program Files\ThinkPad
2007-09-01 16:40 ——— d——– C:\Program Files\InterVideo
2007-09-01 11:37 ——— d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Bluetooth
2007-08-25 18:08 ——— d——– C:\Program Files\Common Files\LogiShrd
2007-08-25 18:08 ——— d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\LogiShrd
2007-08-22 09:43 ——— d——– C:\DOCUME~1\mm9969\APPLIC~1\Skype
2007-08-19 19:59 ——— d——– C:\Program Files\PKR
2007-08-17 09:32 ——— d——– C:\Program Files\napalabels
2007-08-12 16:04 ——— d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
2007-08-12 15:49 ——— d——– C:\Program Files\Apple Software Update
2007-08-08 14:16 ——— d——– C:\Program Files\Skype
2007-08-07 06:59 ——— d——– C:\Program Files\Microsoft ActiveSync
2007-08-02 21:31 ——— d——– C:\DOCUME~1\mm9969\APPLIC~1\FUJIFILM
2007-08-02 19:06 ——— d——– C:\DOCUME~1\mm9969\APPLIC~1\PartsTrak
2007-07-31 22:13 ——— d——– C:\DOCUME~1\LOCALS~1\APPLIC~1\Help
2007-07-31 22:10 ——— d——– C:\Program Files\Hewlett-Packard
2007-07-31 21:53 ——— d——– C:\Program Files\DesignPro
2007-07-30 19:19 92504 –a—— C:\WINDOWS\system32\cdm.dll
2007-07-30 19:19 549720 –a—— C:\WINDOWS\system32\wuapi.dll
2007-07-30 19:19 53080 –a—— C:\WINDOWS\system32\wuauclt.exe
2007-07-30 19:19 43352 –a—— C:\WINDOWS\system32\wups2.dll
2007-07-30 19:19 325976 –a—— C:\WINDOWS\system32\wucltui.dll
2007-07-30 19:19 271224 –a—— C:\WINDOWS\system32\mucltui.dll
2007-07-30 19:19 207736 –a—— C:\WINDOWS\system32\muweb.dll
2007-07-30 19:19 203096 –a—— C:\WINDOWS\system32\wuweb.dll
2007-07-30 19:19 1712984 –a—— C:\WINDOWS\system32\wuaueng.dll
2007-07-30 19:18 33624 –a—— C:\WINDOWS\system32\wups.dll
2007-07-30 07:52 ——— d——– C:\Program Files\VisualTaskTips
2007-07-30 07:03 ——— d——– C:\Program Files\Common Files\Business Objects
2007-07-28 11:09 ——— d——– C:\Program Files\Silicon Prairie Software
2007-07-28 10:41 ——— d——– C:\DOCUME~1\mm9969\APPLIC~1\Help
2007-07-26 12:45 ——— d——– C:\Program Files\TELUS
2007-07-26 12:00 ——— d——– C:\DOCUME~1\mm9969\APPLIC~1\IBMERS
2007-07-26 12:00 ——— d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\IBMERS
2007-07-26 11:58 ——— d——– C:\Program Files\TELUS eCare
2007-07-25 09:39 ——— d——– C:\Program Files\Yahoo!
2007-07-25 09:39 ——— d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo!
2007-07-25 09:37 ——— d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Skype
2007-07-25 08:44 ——— d——– C:\Program Files\MSXML 4.0
2007-07-25 08:44 ——— d——– C:\Program Files\Microsoft CAPICOM 2.1.0.2
2007-07-24 17:51 0 –a—— C:\WINDOWS\system32\drivers\lvuvc.hs
2007-07-24 17:46 ——— d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Logitech
2007-07-23 21:15 ——— d——– C:\DOCUME~1\mm9969\APPLIC~1\WinRAR
2007-07-23 14:24 ——— d——– C:\Program Files\Windows Media Connect 2
2007-07-23 14:16 ——— d——– C:\Program Files\MSXML 6.0
2007-07-23 14:16 ——— d——– C:\Program Files\Microsoft SQL Server
2007-07-23 13:30 ——— d——– C:\Program Files\Microsoft Location Finder
2007-07-23 13:29 ——— d——– C:\Program Files\Microsoft Streets & Trips
2007-07-23 13:22 ——— d——– C:\Program Files\MSN Messenger
2007-07-23 12:49 ——— d——– C:\Program Files\DELL
2007-07-23 11:02 ——— d——– C:\DOCUME~1\mm9969\APPLIC~1\Motive
2007-07-23 11:01 ——— d——– C:\Program Files\Common Files\Motive
2007-07-23 10:50 ——— d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Motive
2007-07-20 00:39 2142488 –a—— C:\WINDOWS\system32\drivers\LVMVdrv.sys
2007-07-20 00:37 2109592 –a—— C:\WINDOWS\system32\drivers\Lvckap.sys
2007-07-19 10:39 ——— d——– C:\DOCUME~1\mm9969\APPLIC~1\Leadertech
2007-07-19 10:39 ——— d——– C:\DOCUME~1\mm9969\APPLIC~1\InterVideo
2007-07-19 10:37 0 -rah—– C:\WINDOWS\system32\drivers\IBM_1836_QPU_TP.MRK
2007-07-19 10:37 ——— d——– C:\DOCUME~1\mm9969\APPLIC~1\Sonic
2007-07-19 10:25 ——— d——– C:\Program Files\Common Files\Sonic
2007-07-19 10:24 ——— d——– C:\Program Files\Sonic
2007-07-19 10:24 ——— d——– C:\Program Files\Common Files\SureThing Shared
2007-07-19 10:04 ——— d——– C:\DOCUME~1\mm9969\APPLIC~1\Check Point
2007-07-19 10:03 ——— d——– C:\Program Files\CheckPoint
2007-07-19 09:29 ——— d——– C:\Program Files\gates
2007-07-19 07:31 ——— d——– C:\Program Files\Microsoft Visual Studio .NET 2003
2007-07-19 07:29 40 –a—— C:\MSDERun.bat
2007-07-19 07:10 ——— d——– C:\Program Files\Scope
2007-07-19 07:07 ——— d——– C:\Program Files\Microsoft.NET
2007-07-18 17:42 25624 –a—— C:\WINDOWS\system32\drivers\LVPr2Mon.sys
2007-07-18 13:06 ——— d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\McAfee
2007-07-18 13:05 ——— d——– C:\Program Files\McAfee
2007-07-18 13:05 ——— d——– C:\Program Files\Common Files\McAfee
2007-07-18 13:05 ——— d——– C:\Program Files\Common Files\Cisco Systems
2007-07-18 12:04 ——— d——– C:\Program Files\Synaptics
2007-07-18 11:12 ——— d——– C:\Program Files\Analog Devices
2007-07-18 11:11 ——— d——– C:\Program Files\Common Files\InstallShield
2007-07-18 10:22 ——— d——– C:\Program Files\ATI Technologies
2007-07-18 06:51 ——— d——– C:\Program Files\Intel
2007-07-18 06:50 ——— d——– C:\Program Files\NetWaiting
2007-07-18 06:50 ——— d——– C:\Program Files\Digital Line Detect
2007-07-18 06:50 ——— d——– C:\Program Files\CONEXANT
2007-07-18 06:05 ——— d——– C:\Program Files\Lenovo
2007-07-18 06:05 ——— d——– C:\Program Files\Common Files\Lenovo
2007-07-18 04:31 ——— d——– C:\Program Files\microsoft frontpage
2007-07-11 14:37 6272 –a—— C:\WINDOWS\system32\drivers\AWRTPD.sys
2007-07-05 19:07 65536 –a—— C:\WINDOWS\system32\SynTPFcs.dll
2007-07-05 19:04 73728 –a—— C:\WINDOWS\system32\SynCOM.dll
2007-07-05 19:04 110592 –a—— C:\WINDOWS\system32\SynCtrl.dll
2007-07-05 19:03 94208 –a—— C:\WINDOWS\system32\SynTPAPI.dll
2007-07-05 19:02 177664 –a—— C:\WINDOWS\system32\drivers\SynTP.sys
2007-06-25 23:08 1104896 –a—— C:\WINDOWS\system32\msxml3.dll
2007-06-19 06:31 282112 –a—— C:\WINDOWS\system32\gdi32.dll
2007-06-14 03:37 499712 –a—— C:\WINDOWS\system32\msvcp71.dll
2007-06-14 03:37 348160 –a—— C:\WINDOWS\system32\msvcr71.dll
2007-06-14 03:37 1047552 –a—— C:\WINDOWS\system32\MFC71u.dll
2007-06-13 03:23 1033216 –a—— C:\WINDOWS\explorer.exe
2007-06-07 12:10 20480 –a—— C:\WINDOWS\system32\ac3config.exe


((((((((((((((((((((((((((((( snapshot_2007-09-01_165934.78 )))))))))))))))))))))))))))))))))))))))))

—-atw 16,384 2007-09-02 00:06:44 C:\WINDOWS\Temp\Perflib_Perfdata_2d0.dat


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TVT Scheduler Proxy"="C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe" [2006-12-10 16:36]
"EZEJMNAP"="C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe" [2007-04-26 23:33]
"TP4EX"="tp4ex.exe" [2005-10-16 22:11 C:\WINDOWS\system32\TP4EX.exe]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2006-11-16 18:00]
"SoundMAXPnP"="C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-10-14 09:11]
"SoundMAX"="C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" [2004-09-23 12:41]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2007-07-05 19:07]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2007-07-05 19:07]
"ShStatEXE"="C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.exe" [2006-11-30 05:50]
"McAfeeUpdaterUI"="C:\Program Files\McAfee\Common Framework\UdaterUI.exe" [2006-11-17 10:39]
"dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2004-08-12 22:05]
"UpdateManager"="C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" [2004-01-06 22:01]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06]
"DellNSCST"="C:\Program Files\DELL\Dell Laser MFP 1600n\NetworkScan\DNSCST.exe" [2005-05-17 19:00]
"REGSHAVE"="C:\Program Files\REGSHAVE\REGSHAVE.exe" [2002-02-04 22:32]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 06:24]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-07-31 18:44]
"CHotkey"="mHotkey.exe" [2004-12-08 17:57 C:\WINDOWS\mHotkey.exe]
"ledpointer"="CNYHKey.exe" [2005-09-30 14:57 C:\WINDOWS\CNYHKey.exe]
"Showwnd"="showwnd.exe" [2003-09-18 20:09 C:\WINDOWS\ShowWnd.exe]
"LogitechCommunicationsManager"="C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2007-07-25 16:02]
"LogitechQuickCamRibbon"="C:\Program Files\Logitech\QuickCam\Quickcam.exe" [2007-07-25 16:06]
"AAWTray"="C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe" [2007-08-08 15:53]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 02:25]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-04 05:00 C:\WINDOWS\system32\bthprops.cpl]
"TPKMAPHELPER"="C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe" [2007-01-09 16:28]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\Wcescomm.exe" [2006-11-13 13:39]
"Microsoft Location Finder"="C:\Program Files\Microsoft Location Finder\LocationFinder.exe" [2005-08-24 18:25]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoSetActiveDesktop"=1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSetActiveDesktop"=1 (0x1)

R1 mfetdik;McAfee Inc.;C:\WINDOWS\system32\drivers\mfetdik.sys
R2 cpextender;Check Point SSL Network Extender;C:\Program Files\CheckPoint\SSL Network Extender\slimsvc.exe
R2 GatesHashSyncSvs;GatesHashSyncSvs;c:\program files\gates\salestraksync\GateshashSyncSvs.exe noinstall
R2 SQLWriter;SQL Server VSS Writer;"C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe"
R3 mfeapfk;McAfee Inc.;C:\WINDOWS\system32\drivers\mfeapfk.sys
R3 VNA;Check Point Virtual Network Adapter;C:\WINDOWS\system32\DRIVERS\vna.sys

*Newly Created Service* - TPKMPSVC

Contents of the 'Scheduled Tasks' folder
2007-08-26 22:48:04 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-09-01 17:40:01
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-09-01 17:41:36
C:\ComboFix-quarantined-files.txt … 2007-09-01 17:41
C:\ComboFix2.txt … 2007-09-01 17:00

— E O F —
Post #7
Logfile of HijackThis v1.99.1
Scan saved at 17:59, on 2007-09-01
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\ibmpmsvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\CheckPoint\SSL Network Extender\slimsvc.exe
c:\program files\gates\salestraksync\GateshashSyncSvs.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe
C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\McAfee\Common Framework\FrameworkService.exe
C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe
c:\program files\lenovo\system update\suservice.exe
C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE
C:\Program Files\McAfee\Common Framework\UdaterUI.exe
C:\Program Files\McAfee\Common Framework\McTray.exe
C:\WINDOWS\system32\TpKmpSVC.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe
C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe
C:\Program Files\DELL\Dell Laser MFP 1600n\NetworkScan\DNSCST.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\mHotkey.exe
C:\WINDOWS\CNYHKey.exe
C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Logitech\QuickCam\Quickcam.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
C:\Program Files\Microsoft ActiveSync\Wcescomm.exe
C:\Program Files\Microsoft Location Finder\LocationFinder.exe
C:\PROGRA~1\MICROS~3\rapimgr.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Silicon Prairie Software\MemTurbo\memturbo.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\mm9969\Desktop\hijackthis\Spyware.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.castanet.net/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 10.93.4.87:8081
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan Enterprise\Scriptcl.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [TVT Scheduler Proxy] C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe
O4 - HKLM\..\Run: [EZEJMNAP] C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
O4 - HKLM\..\Run: [TP4EX] tp4ex.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] C:\Program Files\Analog Devices\SoundMAX\Smax4.exe /tray
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\McAfee\Common Framework\UdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [DellNSCST] "C:\Program Files\DELL\Dell Laser MFP 1600n\NetworkScan\DNSCST.exe" /HIDEUI
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
O4 - HKLM\..\Run: [ledpointer] CNYHKey.exe
O4 - HKLM\..\Run: [Showwnd] showwnd.exe
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
O4 - HKLM\..\Run: [AAWTray] C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [TPKMAPHELPER] C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe -helper
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\Wcescomm.exe"
O4 - HKCU\..\Run: [Microsoft Location Finder] "C:\Program Files\Microsoft Location Finder\LocationFinder.exe"
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: MemTurbo.lnk = C:\Program Files\Silicon Prairie Software\MemTurbo\memturbo.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {2DAD3559-2923-4935-AD49-B673D2539944} (IASRunner Class) - http://www-307.ibm.com/pc/support/acpir.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/…lscbase8300.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1184784051549
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1185221985965
O16 - DPF: {74FFE28D-2378-11D5-990C-006094235084} (IBM Access Support) - http://www-307.ibm.com/pc/support/IbmEgath.cab
O16 - DPF: {B4CB50E4-0309-4906-86EA-10B6641C8392} (SlimClient Class) - https://199.243.247.116:10443/extender.cab
O16 - DPF: {BD8667B7-38D8-4C77-B580-18C3E146372C} (Creative Toolbox Plug-in) - http://caebmm.imgag.com/imgag/cp/install/crusher-cae.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = na.corp
O17 - HKLM\Software\..\Telephony: DomainName = na.corp
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = na.corp
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = na.corp
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = na.corp
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Check Point SSL Network Extender (cpextender) - Check Point Software Technologies - C:\Program Files\CheckPoint\SSL Network Extender\slimsvc.exe
O23 - Service: GatesHashSyncSvs - Unknown owner - c:\program files\gates\salestraksync\GateshashSyncSvs.exe
O23 - Service: ThinkPad PM Service (IBMPMSVC) - Lenovo - C:\WINDOWS\system32\ibmpmsvc.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Unknown owner - C:\Program Files\McAfee\Common Framework\FrameworkService.exe" /ServiceStart (file missing)
O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
O23 - Service: SQL Server (MSSQLSERVER) (MSSQLSERVER) - Unknown owner - C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe" -sMSSQLSERVER (file missing)
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: System Update (SUService) - Lenovo Group Limited - c:\program files\lenovo\system update\suservice.exe
O23 - Service: IBM KCU Service (TpKmpSVC) - Unknown owner - C:\WINDOWS\system32\TpKmpSVC.exe
O23 - Service: TVT Scheduler - Lenovo Group Limited - C:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe
Post #8
You can remove any programs / Tools I had you install. Use Add/Remove Programs to remove if listed there otherwise just delete them and empty recycle bin.

Log looks good :D


You need to create a new Clean restore point.

Note: This will remove all previous Restore Points

Turn off System Restore:

On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.

Restart your computer, turn it back on.

On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Remove the Check Turn off System Restore.
Click Apply, and then click OK.

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Check "Hide file extensions for known file types."
Under the "Hidden files" folder, Uncheck "Show hidden files and folders."
Check "Hide protected operating system files."
Click Apply, and then click OK.
  • Make your Internet Explorer more secure - This can be done by following these simple instructions:
    • From within Internet Explorer click on the Tools menu and then click on Options.
    • Click once on the Security tab
    • Click once on the Internet icon so it becomes highlighted.
    • Click once on the Custom Level button.
      • Change the Download signed ActiveX controls to Prompt
      • Change the Download unsigned ActiveX controls to Disable
      • Change the Initialize and script ActiveX controls not marked as safe to Disable
      • Change the Installation of desktop items to Prompt
      • Change the Launching programs and files in an IFRAME to Prompt
      • Change the Navigate sub-frames across different domains to Prompt
      • When all these settings have been made, click on the OK button.
      • If it prompts you as to whether or not you want to save the settings, press the Yes button.
    • Next press the Apply button and then the OK to exit the Internet Properties page.
  • Update your AntiVirus Software - It is imperative that you update your Antivirus software at least once a week
    (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.

  • Use a Firewall - I can not stress how important it is that you use a Firewall on your computer.
    Without a firewall your computer is succeptible to being hacked and taken over.
    I am very serious about this and see it happen almost every day with my clients.
    Simply using a Firewall in its default configuration can lower your risk greatly.

    For a tutorial on Firewalls and a listing of some available ones see the link below:

    Understanding and Using Firewalls

  • Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly.
    This will ensure your computer has always the latest security updates available installed on your computer.
    If there are new updates to install, install them immediately, reboot your computer, and revisit the site
    until there are no more critical updates.

  • Install Spybot - Search and Destroy - Install and download Spybot - Search and Destroy with its TeaTimer option.
    This will provide realtime spyware & hijacker protection on your computer alongside your virus protection.
    You should also scan your computer with this program on a regular basis just as you would an antivirus software.

    A tutorial on installing & using this product can be found here:

    Using Spybot - Search & Destroy to remove Spyware , Malware, and Hijackers

  • Install Ad-Aware - Download and install Ad-Aware.
    You should also scan your computer with this program on a regular basis
    just as you would an antivirus software in conjunction with Spybot.

    A tutorial on installing & using this product can be found here:

    Using Ad-aware to remove Spyware, Malware, & Hijackers from Your Computer

  • Install SpywareBlaster - SpywareBlaster will add a large list of programs and sites into your Internet Explorer
    settings that will protect you from running and downloading known malicious programs.

    A tutorial on installing & using this product can be found here:

    Using SpywareBlaster to protect your computer from Spyware and Malware

  • IE-SPYAD puts over 5000 sites in your restricted zone so you'll be protected when you visit innocent-looking sites that aren't actually innocent at all.

    Using IE-SPYAD to help block unwanted sites and activities

  • Update all these programs regularly - Make sure you update all the programs I have listed regularly.
    Without regular updates you WILL NOT be protected when new malicious programs are released.
Only run one Anti-Virus and Firewall program.

I would also suggest you read this:
So how did I get infected in the first place?
by Tony Klein
Post #9
Thanks LDTate, I appreciate the help. I downloaded a program form downloads.com and got infected from it. Tell all the volunteers to keep up all the good work!!!!!!!!
Post #11
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI