What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Help! I Have Bad Adware On My Comp!

12 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
A couple days ago an icon appeared on my desktop for WinAntiSpyWare 2007. Popups started appearing and I tried to remove it by going to Control Panel, then Add or Remove Programs, then going to the WinAntiSpyWare 2007 program and clicking remove. However, popups kept appearing, so I pressed Ctrl+Alt+Delete and went to processes and I see "WAS7Mon.exe". I need help to remove this adware/spyware! Thanks!
Post #2
Hi! Welcome to the WTT forums.
I would be glad to take a look at your log and help you with solving any malware problems. HijackThis logs can take a while to research.
Please be patient and I'd be grateful if you would note the following:
  • I will working be on your Malware issues, this may or may not, solve other issues you have with your machine.
  • The fixes are specific to your problem and should only be used for this issue on this machine.
  • Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
  • It's often worth reading through these instructions and printing them for ease of reference.
  • If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
  • Please reply to this thread. Do not start a new topic.

Click here to download HJTsetup.exe
  • Save HJTsetup.exe to your desktop.
  • Double click on the HJTsetup.exe icon on your desktop.
  • By default it will install to C:\Program Files\Hijack This.
  • Continue to click Next in the setup dialogue boxes until you get to the Select Additional Tasks dialogue.
  • Put a check by Create a desktop icon then click Next again.
  • Continue to follow the rest of the prompts from there.
  • At the final dialogue box click Finish and it will launch Hijack This.
  • Click on the Do a system scan and save a log file button. It will scan and then ask you to save the log.
  • Click Save to save the log file and then the log will open in notepad.
  • Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.
  • Come back here to this thread and Paste the log in your next reply.
  • DO NOT have Hijack This fix anything yet. Most of what it finds will be harmless or even required.

Please make a uninstall list using HijackThis
To access the Uninstall Manager you would do the following:

1. Start HijackThis
2. Click on the Config button
3. Click on the Misc Tools button
4. Click on the Open Uninstall Manager button.
5. Click on the Save list… button and specify where you would like to save this file. When you press Save button a notepad will open with the contents of that file. Simply copy and paste the contents of that notepad here in a reply.
Post #3 last edited
This is the HijackThis log file

Scan saved at 12:25:56 PM, on 9/8/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\WINDOWS\system32\ulhepasa.exe
C:\Program Files\Nikon\Wireless Camera Setup Utility\NkPtpEnum.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\System32\DSentry.exe
C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE
C:\WINDOWS\system32\CTHELPER.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\WinAntiSpyware 2

007\WAS7Mon.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\WINDOWS\system32\MANTEC~1\javaw.exe
C:\Documents and Settings\Schloss\My Documents\W?nSxS\userinit.exe
C:\Documents and Settings\Schloss\Application Data\WinTouch\WinTouch.exe
C:\Documents and Settings\Schloss\Application Data\Microsoft\Windows\akcnb.exe
C:\Program Files\Belkin\USB F5D7050\Wireless Utility\Belkinwcui.exe
C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Messenger\msmsgs.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://msn.com/
F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\Userinit.exe
N3 - Netscape 7: user_pref("browser.startup.homepage", "http://home.netscape.com/bookmark/7_1/home.html"); (C:\Documents and Settings\SCHLOSS\Application Data\Mozilla\Profiles\default\l78mjxlf.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\SCHLOSS\Application Data\Mozilla\Profiles\default\l78mjxlf.slt\prefs.js)
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar1.02.3000.1001\en-us\msntb.dll (file missing)
O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
O4 - HKLM\..\Run: [CTDVDDet] C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [AsioReg] REGSVR32.EXE /S CTASIO.DLL
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [ATIPTA] atiptaxx.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [{12-26-67-79-ZN}] C:\DOCUME~1\Schloss\LOCALS~1\Temp\thinksnet.exe CHD003
O4 - HKLM\..\Run: [Salestart] "C:\Program Files\Common Files\WinAntiSpyware 2007\WAS7Mon.exe"
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [Ncao] "C:\WINDOWS\system32\MANTEC~1\javaw.exe" -vt ndrv
O4 - HKCU\..\Run: [Rbudqdvl] "C:\Documents and Settings\Schloss\My Documents\W?nSxS\userinit.exe"
O4 - HKCU\..\Run: [WinTouch] C:\Documents and Settings\Schloss\Application Data\WinTouch\WinTouch.exe
O4 - HKCU\..\Run: [SfKg6w] C:\Documents and Settings\Schloss\Application Data\Microsoft\Windows\akcnb.exe
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Startup: TA_Start.lnk = C:\Documents and Settings\Schloss\Local Settings\Temp\thinksnet.exe
O4 - Global Startup: Belkin Wireless USB Utility.lnk = C:\Program Files\Belkin\USB F5D7050\Wireless Utility\Belkinwcui.exe
O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Maintain Block List… - C:\PROGRA~1\AdShield\AdShield\maintain.htm
O8 - Extra context menu item: Add to &Block List… - C:\PROGRA~1\AdShield\AdShield\suppress.htm
O8 - Extra context menu item: Add to &Exclude List… - C:\PROGRA~1\AdShield\AdShield\restrict.htm
O8 - Extra context menu item: AdShield Option &Settings… - C:\PROGRA~1\AdShield\AdShield\settings.htm
O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm
O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: AdShield - {4FB6C25E-7B37-4c93-B592-16ECD8D18361} - C:\WINDOWS\System32\shdocvw.dll (HKCU)
O16 - DPF: ppctlcab - http://www.pestscan.com/scanner/ppctlcab.cab
O16 - DPF: {421A63BA-4632-43E0-A942-3B4AB645BE51} - http://download-ak.systemsoap.com/ssoap/pp…stemsoappro.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/m…84/mcinsctl.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/shared/m…,21/mcgdmgr.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - http://www.symantec.com/techsupp/asa/ctrl/SymAData.cab
O16 - DPF: {E123BED4-B8C7-42BB-958F-F13CA77EF95D} (Anark Client ActiveX Control) - http://install.anark.com/client/version2/w…en/AMClient.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\SYSTEM32\ati2sgag.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: DomainService - - C:\WINDOWS\system32\ulhepasa.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: Groove Games Licensing Service - Groove Games - C:\Program Files\Common Files\Groove Games Shared\Service\ggameslicsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: NkPtpEnumP2 - Nikon Corporation - C:\Program Files\Nikon\Wireless Camera Setup Utility\NkPtpEnum.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

–
End of file - 11283 bytes
Post #4 last edited
When I try the Uninstall Manager and click "Save List…" the HijackThis window closes before I can specify where to save the uninstall list. I must open up HijackThis from scratch again and try the same thing, but Hijackthis exits again when I click "Save List". What do I do?
Post #5
hi

Dont worry about it for now.

Download and Run ComboFix
  • Download this file from below:

    Here
  • Disconnect from the Internet, than disable your anti-virus and any real-time anti-spyware monitors that are running.
  • Then double click combofix.exe & follow the prompts.
  • When finished, it shall produce a log for you. Post that log in your next reply with a new HijackThis log.
Note 1: Do not mouseclick combofix's window whilst it's running. That may cause it to stall
Note 2:Remember to re-enable your anti-virus and anti-spyware before reconnecting to the Internet.
Post #6
This is the ComboFix log

ComboFix 07-09-09.4 - "Schloss" 2007-09-08 14:45:00.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.124 [GMT -5:00]
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\DOCUME~1\ALLUSE~1\APPLIC~1.\salesmonitor
C:\DOCUME~1\Schloss\APPLIC~1\WinTouch\wintouch.cfg
C:\DOCUME~1\Schloss\APPLIC~1\WinTouch\WinTouch.exe
C:\DOCUME~1\Schloss\APPLIC~1\WinTouch\WTUninstaller.exe
C:\DOCUME~1\Schloss\Desktop\internet.lnk
C:\DOCUME~1\Schloss\err.log
C:\DOCUME~1\Schloss\MYDOCU~1\WNSXS~1
C:\DOCUME~1\Schloss\MYDOCU~1\WNSXS~1\userinit.exe
C:\DOCUME~1\Schloss\STARTM~1\Programs\Startup.\TA_Start.lnk
C:\DOCUME~1\Schloss\STARTM~1\Programs\Startup\ta_start.lnk
C:\Program Files\Common Files\winantispyware 2007
C:\Program Files\Common Files\WinAntiSpyware 2007\err.log
C:\Program Files\Common Files\winantispyware 2007\err.log
C:\Program Files\Common Files\WinAntiSpyware 2007\WAS7Mon.exe
C:\Program Files\Common Files\winantispyware 2007\WAS7Mon.exe
C:\Program Files\Common Files\Yazzle1122OinUninstaller.exe
C:\Program Files\inetget2
C:\Temp\1cb
C:\Temp\1cb\syscheck.log
C:\Temp\fse
C:\Temp\fse\tmpZTF.log
C:\WINDOWS\b104.exe
C:\WINDOWS\b138.exe
C:\WINDOWS\cookies.ini
C:\WINDOWS\DOWNLO~1\UWA7P_0001_N99M2908NetInstaller.exe
C:\WINDOWS\retadpu1000106.exe
C:\WINDOWS\system32\afecpbty.exe
C:\WINDOWS\system32\D2
C:\WINDOWS\system32\ddtqmlnw.dll
C:\WINDOWS\system32\drivers\ASC3550.SYS
C:\WINDOWS\system32\drivers\fopn.sys
C:\WINDOWS\system32\f02WtR
C:\WINDOWS\system32\f02WtR\f02WtR1065.exe
C:\WINDOWS\system32\fpnqmtlu.exe
C:\WINDOWS\system32\fxphsgyv.exe
C:\WINDOWS\SYSTEM32\ihhkj.bak1
C:\WINDOWS\SYSTEM32\ihhkj.bak2
C:\WINDOWS\SYSTEM32\ihhkj.ini
C:\WINDOWS\SYSTEM32\ihhkj.ini2
C:\WINDOWS\SYSTEM32\ihhkj.tmp
C:\WINDOWS\system32\jdixvrnj.dll
C:\WINDOWS\system32\jkhhi.dll
C:\WINDOWS\SYSTEM32\jnrvxidj.ini
C:\WINDOWS\system32\kdhqibhg.exe
C:\WINDOWS\system32\kpccdlby.dll
C:\WINDOWS\system32\mantec~1
C:\WINDOWS\system32\mantec~1\??mantec\
C:\WINDOWS\system32\mantec~1\javaw.exe
C:\WINDOWS\system32\mhvitwje.exe
C:\WINDOWS\system32\mkhqzk.dll
C:\WINDOWS\system32\mljjhgg.dll
C:\WINDOWS\system32\msnav32.ax
C:\WINDOWS\system32\oxfjrkqa.exe
C:\WINDOWS\system32\redirect5.exe
C:\WINDOWS\system32\rqrqnkj.dll
C:\WINDOWS\system32\rycfnavt.dll
C:\WINDOWS\system32\sovfakvr.exe
C:\WINDOWS\system32\tbbqgwwj.exe
C:\WINDOWS\SYSTEM32\tvanfcyr.ini
C:\WINDOWS\system32\ulhepasa.exe
C:\WINDOWS\system32\wcpsvtr32.exe
C:\WINDOWS\SYSTEM32\wnlmqtdd.ini
C:\WINDOWS\system32\wsdoxjnb.exe
C:\WINDOWS\system32\xyvrwagy.dll
C:\WINDOWS\SYSTEM32\ygawrvyx.ini
C:\WINDOWS\uninstall_nmon.vbs


((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))


——-\LEGACY_CMDSERVICE
——-\LEGACY_DOMAINSERVICE
——-\LEGACY_FOPN
——-\LEGACY_IPRIP
——-\LEGACY_NETWORK_MONITOR
——-\DomainService
——-\Iprip


((((((((((((((((((((((((( Files Created from 2007-08-09 to 2007-09-09 )))))))))))))))))))))))))))))))
.

2007-09-08 14:43 51,200 –a—— C:\WINDOWS\NirCmd.exe
2007-09-08 12:15 d——– C:\Program Files\Trend Micro
2007-09-06 15:39 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
2007-09-05 19:57 d——– C:\Program Files\SmartIsOn
2007-09-05 19:47 d——– C:\DOCUME~1\LOCALS~1\APPLIC~1\Talkback
2007-09-05 15:17 d–hs—- C:\WINDOWS\UmhvbmRhIEZhbGs
2007-09-05 15:17 d——– C:\WINDOWS\SYSTEM32\drvr2
2007-09-05 15:17 d——– C:\WINDOWS\SYSTEM32\cfig322
2007-09-05 15:17 d——– C:\WINDOWS\SYSTEM32\capcom
2007-09-05 15:17 d——– C:\Temp
2007-09-05 15:17 d——– C:\DOCUME~1\LOCALS~1\APPLIC~1\NetMon
2007-08-15 13:22 d——– C:\Program Files\MSXML 6.0

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-09-08 12:24 ——— d——– C:\Program Files\Common Files\Symantec Shared
2007-09-06 15:39 ——— d——– C:\Program Files\Lavasoft
2007-09-06 15:38 ——— d——– C:\Program Files\Common Files\Wise Installation Wizard
2007-08-09 12:59 22328 –a—— C:\WINDOWS\system32\drivers\PnkBstrK.sys
2007-08-07 13:58 8320 –a—— C:\WINDOWS\system32\drivers\AWRTRD.sys
2007-08-07 13:56 9344 –a—— C:\WINDOWS\system32\drivers\NSDriver.sys
2007-08-01 09:58 ——— d——– C:\Program Files\Windows Media Connect 2
2007-07-20 13:25 ——— d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\ATI MMC
2007-07-17 14:36 ——— d——– C:\Program Files\Common Files\PACE Anti-Piracy
2007-07-17 14:36 ——— d——– C:\DOCUME~1\Schloss\APPLIC~1\PACE Anti-Piracy
2007-07-17 14:36 ——— d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\PACE Anti-Piracy
2007-07-11 14:37 6272 –a—— C:\WINDOWS\system32\drivers\AWRTPD.sys
2007-06-13 05:23 1033216 –a—— C:\WINDOWS\explorer.exe
2005-07-29 21:24:26 472 –sha-r C:\WINDOWS\UmhvbmRhIEZhbGs\oA1SvAl1KHt1v3P.vbs
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E9147A0A-A866-4214-B47C-DA821891240F}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DVDSentry"="C:\WINDOWS\System32\DSentry.exe" [2002-08-14 18:22]
"CTSysVol"="C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe" [2002-10-29 09:18]
"CTDVDDet"="C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE" [2002-09-30 01:00]
"CTHelper"="CTHELPER.EXE" [2003-02-20 16:45 C:\WINDOWS\SYSTEM32\CTHELPER.EXE]
"AsioReg"="REGSVR32.exe" [2004-08-04 02:56 C:\WINDOWS\SYSTEM32\regsvr32.exe]
"UpdReg"="C:\WINDOWS\UpdReg.EXE" [2000-05-11 01:00]
"NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2003-04-24 16:58]
"ATIPTA"="atiptaxx.exe" [2005-05-12 21:05 C:\WINDOWS\SYSTEM32\atiptaxx.exe]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2005-07-14 21:16]
"Symantec NetDriver Monitor"="C:\PROGRA~1\SYMNET~1\SNDMon.exe" [2005-08-08 15:45]
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 17:41]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-04-03 17:12]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2006-06-21 09:32]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 09:41]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AIM"="C:\Program Files\AIM\aim.exe" [2005-08-05 14:08]
"DellSupport"="C:\Program Files\DellSupport\DSAgnt.exe" [2007-03-15 11:09]
"Ncao"="C:\WINDOWS\system32\MANTEC~1\javaw.exe" []
"Rbudqdvl"="C:\Documents and Settings\Schloss\My Documents\W?nSxS\userinit.exe" []

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"RunNarrator"=Narrator.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"NoDispBackgroundPage"=0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoViewOnDrive"=0 (0x0)
"NoSMMyDocs"=1 (0x1)
"NoSMMyPictures"=1 (0x1)
"NoStartMenuMyMusic"=1 (0x1)
"NoRecentDocsMenu"=1 (0x1)
"NoAddPrinter"=0 (0x0)
"NoChangeAnimation"=0 (0x0)
"NoDeletePrinter"=0 (0x0)

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"= msv1_0 C:\\WINDOWS\\system32\\jkhhi

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 8.0 Tray Icon.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\America Online 8.0 Tray Icon.lnk
backup=C:\WINDOWS\pss\America Online 8.0 Tray Icon.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk
backup=C:\WINDOWS\pss\Digital Line Detect.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WinZip Quick Pick.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\WinZip Quick Pick.lnk
backup=C:\WINDOWS\pss\WinZip Quick Pick.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Schloss^Start Menu^Programs^Startup^OpenOffice.org 1.1.4.lnk]
path=C:\Documents and Settings\Schloss\Start Menu\Programs\Startup\OpenOffice.org 1.1.4.lnk
backup=C:\WINDOWS\pss\OpenOffice.org 1.1.4.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AceGain LiveUpdate]
C:\Program Files\AceGain\LiveUpdate\LiveUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdaptecDirectCD]
"C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AIM]
C:\Program Files\AIM\aim.exe -cnetwait.odl

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATI Launchpad]
"C:\Program Files\ATI Multimedia\main\launchpd.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DealHelperBrwsr]
C:\WINDOWS\dhbrwsr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DealHelperUpdate]
C:\WINDOWS\DHUpdt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EA Core]
"C:\Program Files\Electronic Arts\EA Link\Core.exe" -silent

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\fyh]
C:\WINDOWS\fyh.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpfsched]
C:\WINDOWS\hpfsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Load]
??? ?

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCAgentExe]
c:\PROGRA~1\mcafee.com\agent\McAgent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCUpdateExe]
C:\PROGRA~1\mcafee.com\agent\mcupdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Update Detection]
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Mozilla Quick Launch]
"C:\Program Files\Netscape\Netscape\Netscp.exe" -turbo

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msbb]
c:\windows\system32\msbb.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msmc]
C:\WINDOWS\System32\msgked.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnappau]
"C:\Program Files\MSN Apps\Updater1.02.3000.1001\en-us\msnappau.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
"C:\Program Files\MSN Messenger\msnmsgr.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\New Value #1]


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
nwiz.exe /install

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Red Swoosh EDN Client]
C:\Program Files\RSNet\RSEDNClient.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Run]
??? ?

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpyKiller]
C:\Program Files\SpyKiller\spykiller.exe /startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
"c:\progra~1\steam\steam.exe" -silent

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\System Soap Pro]
C:\PROGRA~1\SYSTEM~1\soap.exe min

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SysUpd]
C:\WINDOWS\sysupd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TV Media]
C:\Program Files\TV Media\Tvm.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updatev01]
C:\WINDOWS\System32\updatev01.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ViewMgr]
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VirusScan Online]
c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Weather]
C:\Program Files\AWS\WeatherBug\Weather.EXE 1

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WildTangent CDA]
"C:\Program Files\WildTangent\Apps\CDA\GameDrvr.exe" /startup "C:\Program Files\WildTangent\Apps\CDA\cdaEngine0500.dll"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinTools]
C:\Program Files\Common files\WinTools\WToolsA.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\YSKEYS]
C:\WINDOWS\System32\YSKEYS.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\_AntiSpyware]
C:\Program Files\McAfee\McAfee AntiSpyware\MssCli.exe

R1 atitray;atitray;\??\C:\Program Files\Radeon Omega Drivers\v2.6.42\ATI Tray Tools\atitray.sys
R1 cdudf_xp;cdudf_xp;C:\WINDOWS\system32\drivers\cdudf_xp.sys
R1 pwd_2k;pwd_2k;C:\WINDOWS\system32\drivers\pwd_2k.sys
R1 UdfReadr_xp;UdfReadr_xp;C:\WINDOWS\system32\drivers\UdfReadr_xp.sys
R2 HPFECP06;HPFECP06;C:\WINDOWS\system32\drivers\HPFECP06.SYS
R2 NkPtpEnumP2;NkPtpEnumP2;"C:\Program Files\Nikon\Wireless Camera Setup Utility\NkPtpEnum.exe" -a -d="C:\Program Files\Nikon\Wireless Camera Setup Utility\NkPtpip.dll"
R2 SVKP;SVKP;\??\C:\WINDOWS\system32\SVKP.sys
R3 dvd_2K;dvd_2K;C:\WINDOWS\system32\drivers\dvd_2K.sys
R3 VBus;Virtual Bus;C:\WINDOWS\system32\DRIVERS\NkVBus.sys
S2 cis1284;cis1284;\??\C:\WINDOWS\System32\drivers\cis1284.sys
S3 mmc_2K;mmc_2K;C:\WINDOWS\system32\drivers\mmc_2K.sys
S3 o1394bul;o1394bul;\??\C:\DOCUME~1\Schloss\LOCALS~1\Temp\o1394bul.sys
S3 SilverLink;Texas Instruments SilverLink (USB GraphLink) Cable;C:\WINDOWS\system32\Drivers\SilvrLnk.sys
S3 TICalc;TICalc;C:\WINDOWS\system32\drivers\TICalc.sys


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
AutoRun\command- F:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{71860fc1-a5b0-11db-bd8f-b4406390e31c}]
AutoRun\command- F:\LaunchU3.exe -a

.
Contents of the 'Scheduled Tasks' folder
"2007-08-25 23:58:01 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2006-12-31 00:15:15 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
"2007-08-25 01:00:13 C:\WINDOWS\Tasks\Norton AntiVirus - Scan my computer - Schloss.job"
.
**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-09-09 15:00:07
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-09-09 15:02:23 - machine was rebooted
C:\ComboFix-quarantined-files.txt … 2007-09-09 15:02
.
— E O F —
Post #7
And here is the HijackThis after ComboFix

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:06:41 PM, on 9/9/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\Program Files\Nikon\Wireless Camera Setup Utility\NkPtpEnum.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\System32\DSentry.exe
C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE
C:\WINDOWS\system32\CTHELPER.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\Program Files\Belkin\USB F5D7050\Wireless Utility\Belkinwcui.exe
C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\notepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://msn.com/
N3 - Netscape 7: user_pref("browser.startup.homepage", "http://home.netscape.com/bookmark/7_1/home.html"); (C:\Documents and Settings\SCHLOSS\Application Data\Mozilla\Profiles\default\l78mjxlf.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\SCHLOSS\Application Data\Mozilla\Profiles\default\l78mjxlf.slt\prefs.js)
O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dll
O2 - BHO: (no name) - {7559B76E-0222-4d77-9499-CCE9EB4EDC2F} - (no file)
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST1.02.3000.1001\en-xu\stmain.dll (file missing)
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar1.02.3000.1001\en-us\msntb.dll (file missing)
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {E9147A0A-A866-4214-B47C-DA821891240F} - (no file)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar1.02.3000.1001\en-us\msntb.dll (file missing)
O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
O4 - HKLM\..\Run: [CTDVDDet] C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [AsioReg] REGSVR32.EXE /S CTASIO.DLL
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [ATIPTA] atiptaxx.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [Ncao] "C:\WINDOWS\system32\MANTEC~1\javaw.exe" -vt ndrv
O4 - HKCU\..\Run: [Rbudqdvl] "C:\Documents and Settings\Schloss\My Documents\W?nSxS\userinit.exe"
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Global Startup: Belkin Wireless USB Utility.lnk = C:\Program Files\Belkin\USB F5D7050\Wireless Utility\Belkinwcui.exe
O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Maintain Block List… - C:\PROGRA~1\AdShield\AdShield\maintain.htm
O8 - Extra context menu item: Add to &Block List… - C:\PROGRA~1\AdShield\AdShield\suppress.htm
O8 - Extra context menu item: Add to &Exclude List… - C:\PROGRA~1\AdShield\AdShield\restrict.htm
O8 - Extra context menu item: AdShield Option &Settings… - C:\PROGRA~1\AdShield\AdShield\settings.htm
O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm
O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: AdShield - {4FB6C25E-7B37-4c93-B592-16ECD8D18361} - C:\WINDOWS\System32\shdocvw.dll (HKCU)
O16 - DPF: ppctlcab - http://www.pestscan.com/scanner/ppctlcab.cab
O16 - DPF: {421A63BA-4632-43E0-A942-3B4AB645BE51} - http://download-ak.systemsoap.com/ssoap/pp…stemsoappro.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/m…84/mcinsctl.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/shared/m…,21/mcgdmgr.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - http://www.symantec.com/techsupp/asa/ctrl/SymAData.cab
O16 - DPF: {E123BED4-B8C7-42BB-958F-F13CA77EF95D} (Anark Client ActiveX Control) - http://install.anark.com/client/version2/w…en/AMClient.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\SYSTEM32\ati2sgag.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: Groove Games Licensing Service - Groove Games - C:\Program Files\Common Files\Groove Games Shared\Service\ggameslicsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: NkPtpEnumP2 - Nikon Corporation - C:\Program Files\Nikon\Wireless Camera Setup Utility\NkPtpEnum.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

–
End of file - 10928 bytes
Post #8
Hi

Open Notepad and Copy/Paste the text in the codebox below into it: 

File::
C:\\WINDOWS\\system32\\jkhhi
C:\WINDOWS\dhbrwsr.exe
C:\WINDOWS\DHUpdt.exe
C:\WINDOWS\fyh.exe
c:\windows\system32\msbb.exe
C:\WINDOWS\System32\msgked.exe
C:\WINDOWS\sysupd.exe
C:\WINDOWS\System32\YSKEYS.exe

Folder::
C:\WINDOWS\system32\MANTEC~1
C:\Documents and Settings\Schloss\My Documents\W?nSxS
C:\Program Files\TV Media
C:\Program Files\WildTangent
C:\Program Files\Common files\WinTools

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E9147A0A-A866-4214-B47C-DA821891240F}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Ncao"=-
"Rbudqdvl"=-
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"Authentication Packages"=hex(7):6d,73,76,31,5f,30,00,00
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DealHelperBrwsr]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DealHelperUpdate]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\fyh]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Load]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msbb]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msmc]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\New Value #1]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Run]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SysUpd]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TV Media]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WildTangent CDA]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinTools]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\YSKEYS]

Save this as "CFScript"

[external image: Posted Image]


Refering to the picture above, drag CFScript into ComboFix.exe
Then post the resultant log with a new HijackThis log.

Please do an online scan with Kaspersky Online Scanner. You will be prompted to install an ActiveX component from Kaspersky, Click Yes.
  • The program will launch and then start to download the latest definition files.
  • Once the scanner is installed and the definitions downloaded, click Next.
  • Now click on Scan Settings
  • In the scan settings make sure that the following are selected:
    • Scan using the following Anti-Virus database:

      + Extended(If available otherwise Standard)
    • Scan Options:

      + Scan Archives
      + Scan Mail Bases
  • Click OK
  • Now under select a target to scan select My Computer
  • The scan will take a while so be patient and let it run. Once the scan is complete it will display if your system has been infected.
  • Now click on the Save as Text button
  • Save the file to your desktop.
  • Copy and paste that information in your next post.
Post #9
Here is the ComboFix once I dragged the CFScript into it

ComboFix 07-09-09.4 - "Schloss" 2007-09-10 10:34:45.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.110 [GMT -5:00]
* Created a new restore point

FILE::
C:\\WINDOWS\\system32\\jkhhi
C:\WINDOWS\dhbrwsr.exe
C:\WINDOWS\DHUpdt.exe
C:\WINDOWS\fyh.exe
c:\windows\system32\msbb.exe
C:\WINDOWS\System32\msgked.exe
C:\WINDOWS\sysupd.exe
C:\WINDOWS\System32\YSKEYS.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\WildTangent
C:\Program Files\WildTangent\Apps\ActiveLauncher\ActiveLauncher.ini
C:\Program Files\WildTangent\Apps\ActiveLauncher\ActiveLauncher0200.dll
C:\Program Files\WildTangent\Apps\CDA\CDAEngine0400.dll
C:\Program Files\WildTangent\Apps\CDA\CDAEngine0500.dll
C:\Program Files\WildTangent\Apps\CDA\CDALogger0401.dll
C:\Program Files\WildTangent\Apps\CDA\CDAUninstall.exe
C:\Program Files\WildTangent\Apps\CDA\ControlPanel\CDA\about.html
C:\Program Files\WildTangent\Apps\CDA\ControlPanel\CDA\cache.html
C:\Program Files\WildTangent\Apps\CDA\ControlPanel\CDA\updates.html
C:\Program Files\WildTangent\Apps\CDA\ControlPanel\DMMP\index.html
C:\Program Files\WildTangent\Apps\CDA\ControlPanel\DRM\index.html
C:\Program Files\WildTangent\Apps\CDA\ControlPanel\index.html
C:\Program Files\WildTangent\Apps\CDA\ControlPanel\nav.html
C:\Program Files\WildTangent\Apps\CDA\ControlPanel\Webd\index.html
C:\Program Files\WildTangent\Apps\CDA\ControlPanel\wt.gif
C:\Program Files\WildTangent\Apps\CDA\GameDrvr.exe
C:\Program Files\WildTangent\Apps\CDA\OtherLicenses.txt
C:\Program Files\WildTangent\Apps\CDA\wt.ico
C:\Program Files\WildTangent\Apps\CDA\wtControlPanel.cpl
C:\Program Files\WildTangent\Apps\DRM0302.dll
C:\Program Files\WildTangent\Apps\DRM0302java.jar
C:\Program Files\WildTangent\Apps\rDRM0302.dll
C:\Program Files\WildTangent\Components\wtAppConfig0200.dll
C:\Program Files\WildTangent\Components\wtAppConfig0500.dll
C:\Program Files\WildTangent\Components\wtApplicationUpdateManager0500.dll
C:\Program Files\WildTangent\Components\wtCache0200.dll
C:\Program Files\WildTangent\Components\wtCache0300.dll
C:\Program Files\WildTangent\Components\wtCookie0200.dll
C:\Program Files\WildTangent\Components\wtCookie0500.dll
C:\Program Files\WildTangent\Components\wtDownloader0200.dll
C:\Program Files\WildTangent\Components\wtDownloader0300.dll
C:\Program Files\WildTangent\Components\wtGameData0200.dll
C:\Program Files\WildTangent\Components\wtGameData0500.dll
C:\Program Files\WildTangent\Components\wtGUI0200.dll
C:\Program Files\WildTangent\Components\wtGUI0500.dll
C:\Program Files\WildTangent\Components\wtIO0200.dll
C:\Program Files\WildTangent\Components\wtIO0300.dll
C:\Program Files\WildTangent\Components\wtKernel0200.dll
C:\Program Files\WildTangent\Components\wtKernel0300.dll
C:\Program Files\WildTangent\Components\wtLua0200.dll
C:\Program Files\WildTangent\Components\wtLua0300.dll
C:\Program Files\WildTangent\Components\wtNetworking0200.dll
C:\Program Files\WildTangent\Components\wtPropertyBag0200.dll
C:\Program Files\WildTangent\Components\wtPropertyBag0300.dll
C:\Program Files\WildTangent\Components\wtScript0200.dll
C:\Program Files\WildTangent\Components\wtScript0300.dll
C:\Program Files\WildTangent\Components\wtSerialization0200.dll
C:\Program Files\WildTangent\Components\wtSerialization0300.dll
C:\Program Files\WildTangent\Components\wtStreamProcessing0200.dll
C:\Program Files\WildTangent\Components\wtStreamProcessing0300.dll
C:\Program Files\WildTangent\Components\wtSystem0200.dll
C:\Program Files\WildTangent\Components\wtSystem0300.dll
C:\Program Files\WildTangent\Components\wtSystemConfig0200.dll
C:\Program Files\WildTangent\Components\wtSystemConfig0300.dll
C:\Program Files\WildTangent\Components\wtUserSupport0200.dll
C:\Program Files\WildTangent\Components\wtUserSupport0500.dll
C:\Program Files\WildTangent\Components\wtXml0200.dll
C:\Program Files\WildTangent\Components\wtXml0300.dll
C:\Program Files\WildTangent\LFS\24COUNTDOWN\Cache.dat
C:\Program Files\WildTangent\LFS\ActiveLauncher\Cache.dat
C:\Program Files\WildTangent\LFS\AppConfig\CDA.wtcfg
C:\Program Files\WildTangent\LFS\Cache\000001.Cache
C:\Program Files\WildTangent\LFS\Cache\Cache.dat
C:\Program Files\WildTangent\LFS\CDAData\Checkin\download.html
C:\Program Files\WildTangent\LFS\CDAData\Checkin\downloadTrayIconData.cdas
C:\Program Files\WildTangent\LFS\CDAData\Checkin\icon.ico
C:\Program Files\WildTangent\LFS\CDAData\Checkin\install.html
C:\Program Files\WildTangent\LFS\CDAData\Checkin\install_complete.html
C:\Program Files\WildTangent\LFS\CDAData\Checkin\install_nofiles.html
C:\Program Files\WildTangent\LFS\CDAData\Checkin\install_progress.html
C:\Program Files\WildTangent\LFS\CDAData\Checkin\installTrayIconData.cdas
C:\Program Files\WildTangent\LFS\CDAData\Checkin\inuse.html
C:\Program Files\WildTangent\LFS\CDAData\Checkin\inuseitems.html
C:\Program Files\WildTangent\LFS\CDAData\Checkin\items.html
C:\Program Files\WildTangent\LFS\CDAData\Checkin\style.css
C:\Program Files\WildTangent\LFS\CDAData\Checkin\wt.gif
C:\Program Files\WildTangent\LFS\CDAData\UninstallerUI\CDAOnlyScreen\style.css
C:\Program Files\WildTangent\LFS\CDAData\UninstallerUI\CDAOnlyScreen\uninstall_prompt.html
C:\Program Files\WildTangent\LFS\CDAData\UninstallerUI\CDAWithDependantsScreen\items.html
C:\Program Files\WildTangent\LFS\CDAData\UninstallerUI\CDAWithDependantsScreen\style.css
C:\Program Files\WildTangent\LFS\CDAData\UninstallerUI\CDAWithDependantsScreen\uninstall_promptdependant.html
C:\Program Files\WildTangent\LFS\CDAData\UninstallerUI\ErrorScreen\style.css
C:\Program Files\WildTangent\LFS\CDAData\UninstallerUI\ErrorScreen\uninstall_error.html
C:\Program Files\WildTangent\LFS\CDAData\UninstallerUI\FinishedScreen\style.css
C:\Program Files\WildTangent\LFS\CDAData\UninstallerUI\FinishedScreen\uninstall_complete.html
C:\Program Files\WildTangent\LFS\CDAData\UninstallerUI\FinishedScreen\uninstallpackage_complete.html
C:\Program Files\WildTangent\LFS\CDAData\UninstallerUI\Images\bc.gif
C:\Program Files\WildTangent\LFS\CDAData\UninstallerUI\Images\bl.gif
C:\Program Files\WildTangent\LFS\CDAData\UninstallerUI\Images\br.gif
C:\Program Files\WildTangent\LFS\CDAData\UninstallerUI\Images\btm.gif
C:\Program Files\WildTangent\LFS\CDAData\UninstallerUI\Images\cancel-over.gif
C:\Program Files\WildTangent\LFS\CDAData\UninstallerUI\Images\cancel.gif
C:\Program Files\WildTangent\LFS\CDAData\UninstallerUI\Images\finish-over.gif
C:\Program Files\WildTangent\LFS\CDAData\UninstallerUI\Images\finish.gif
C:\Program Files\WildTangent\LFS\CDAData\UninstallerUI\Images\header.jpg
C:\Program Files\WildTangent\LFS\CDAData\UninstallerUI\Images\le.gif
C:\Program Files\WildTangent\LFS\CDAData\UninstallerUI\Images\mb.gif
C:\Program Files\WildTangent\LFS\CDAData\UninstallerUI\Images\next-disabled.gif
C:\Program Files\WildTangent\LFS\CDAData\UninstallerUI\Images\next-over.gif
C:\Program Files\WildTangent\LFS\CDAData\UninstallerUI\Images\next.gif
C:\Program Files\WildTangent\LFS\CDAData\UninstallerUI\Images\re.gif
C:\Program Files\WildTangent\LFS\CDAData\UninstallerUI\Images\retry-over.gif
C:\Program Files\WildTangent\LFS\CDAData\UninstallerUI\Images\retry.gif
C:\Program Files\WildTangent\LFS\CDAData\UninstallerUI\InUseScreen\inuse.html
C:\Program Files\WildTangent\LFS\CDAData\UninstallerUI\InUseScreen\items.html
C:\Program Files\WildTangent\LFS\CDAData\UninstallerUI\InUseScreen\style.css
C:\Program Files\WildTangent\LFS\CDAData\UninstallerUI\ProgressScreen\style.css
C:\Program Files\WildTangent\LFS\CDAData\UninstallerUI\ProgressScreen\uninstall_progress.html
C:\Program Files\WildTangent\LFS\Scripts\Common\AUML01.cdas
C:\Program Files\WildTangent\LFS\Scripts\Common\CL01.cdas
C:\Program Files\WildTangent\LFS\Scripts\Common\CL01_Files.cdas
C:\Program Files\WildTangent\LFS\Scripts\Common\CL01_Install.cdas
C:\Program Files\WildTangent\LFS\Scripts\Common\CL01_InstallConditions.cdas
C:\Program Files\WildTangent\LFS\Scripts\Common\CL01_LFSInit.cdas
C:\Program Files\WildTangent\LFS\Scripts\Common\CL01_Registry.cdas
C:\Program Files\WildTangent\LFS\Scripts\Common\CL01_Scheduler.cdas
C:\Program Files\WildTangent\LFS\Scripts\Common\CL01_String.cdas
C:\Program Files\WildTangent\LFS\Scripts\Common\CL01_User.cdas
C:\Program Files\WildTangent\LFS\Scripts\Common\DpidLibrary_01.cdas
C:\Program Files\WildTangent\LFS\Scripts\Common\GameDataImmediate.cdas
C:\Program Files\WildTangent\LFS\Scripts\Common\MasterUpdateLibrary_01.cdas
C:\Program Files\WildTangent\LFS\Scripts\Common\UI_Stub.cdas
C:\Program Files\WildTangent\LFS\Scripts\Common\UrlUpdateList.cdas
C:\Program Files\WildTangent\LFS\Scripts\Downloaded\BandwidthUpload.cdas
C:\Program Files\WildTangent\LFS\Scripts\Downloaded\MasterUpdate.cdas
C:\Program Files\WildTangent\LFS\Scripts\Downloaded\SystemConfigurationUpload.cdas
C:\Program Files\WildTangent\LFS\Scripts\Downloaded\UrlUpdateList.cdas
C:\Program Files\WildTangent\LFS\Scripts\GameData.log
C:\Program Files\WildTangent\LFS\Scripts\Install\_0A03746C_E165_4493_ADF8_DACB1749355C_fileList.cdas
C:\Program Files\WildTangent\LFS\Scripts\Install\_0A03746C_E165_4493_ADF8_DACB1749355C_install.cdas
C:\Program Files\WildTangent\LFS\Scripts\Install\CDALogger_fileList.cdas
C:\Program Files\WildTangent\LFS\Scripts\Install\CDALogger_install.cdas
C:\Program Files\WildTangent\LFS\Scripts\Install\CPL_fileList.cdas
C:\Program Files\WildTangent\LFS\Scripts\Install\CPL_uninstall.cdas
C:\Program Files\WildTangent\LFS\Scripts\Install\DMMP_fileList.cdas
C:\Program Files\WildTangent\LFS\Scripts\Install\DMMP_install.cdas
C:\Program Files\WildTangent\LFS\Scripts\Install\DMMP_Uninstall.cdas
C:\Program Files\WildTangent\LFS\Scripts\Install\DRM0302_install.cdas
C:\Program Files\WildTangent\LFS\Scripts\Install\DRM0302_Uninstall.cdas
C:\Program Files\WildTangent\LFS\Scripts\Install\UI_checkin.cdas
C:\Program Files\WildTangent\LFS\Scripts\Install\UI_stub.cdas
C:\Program Files\WildTangent\LFS\Scripts\Install\Webd331_filelist.cdas
C:\Program Files\WildTangent\LFS\Scripts\Install\Webd331_Uninstall.cdas
C:\Program Files\WildTangent\LFS\Scripts\Install\Webd4_1_1_fileList.cdas
C:\Program Files\WildTangent\LFS\Scripts\Install\Webd4_1_1_install.cdas
C:\Program Files\WildTangent\LFS\Scripts\Install\Webd4_1_1_Uninstall.cdas
C:\Program Files\WildTangent\LFS\Scripts\SystemConfiguration.log
C:\Program Files\WildTangent\LFS\Scripts\Uninstall\DMMP.cdanfo
C:\Program Files\WildTangent\LFS\Scripts\Uninstall\DRM0302.cdanfo
C:\Program Files\WildTangent\LFS\Scripts\Uninstall\Uninstaller.cdas
C:\Program Files\WildTangent\LFS\Scripts\Uninstall\Webd331.cdanfo
C:\Program Files\WildTangent\LFS\Scripts\Uninstall\Webd4_1_1.cdanfo
C:\Program Files\WildTangent\LFS\System\wt.sto
C:\Program Files\WildTangent\LFS\TaskStore\Bandwidth.cdaed
C:\Program Files\WildTangent\LFS\TaskStore\Bandwidth.cdaes
C:\Program Files\WildTangent\LFS\TaskStore\Bandwidth.cdaet
C:\Program Files\WildTangent\LFS\TaskStore\CreateAppConfig.cdaed
C:\Program Files\WildTangent\LFS\TaskStore\CreateAppConfig.cdaes
C:\Program Files\WildTangent\LFS\TaskStore\CreateAppConfig.cdaet
C:\Program Files\WildTangent\LFS\TaskStore\GameData.cdaed
C:\Program Files\WildTangent\LFS\TaskStore\GameData.cdaes
C:\Program Files\WildTangent\LFS\TaskStore\GameData.cdaet
C:\Program Files\WildTangent\LFS\TaskStore\GameDataTriggered.cdaes
C:\Program Files\WildTangent\LFS\TaskStore\GameDataTriggered.cdaet
C:\Program Files\WildTangent\LFS\TaskStore\Maint.cdaed
C:\Program Files\WildTangent\LFS\TaskStore\Maint.cdaes
C:\Program Files\WildTangent\LFS\TaskStore\Maint.cdaet
C:\Program Files\WildTangent\LFS\TaskStore\ManualUpdate.cdaes
C:\Program Files\WildTangent\LFS\TaskStore\ManualUpdate.cdaet
C:\Program Files\WildTangent\LFS\TaskStore\MigrateDpid.cdaed
C:\Program Files\WildTangent\LFS\TaskStore\MigrateDpid.cdaes
C:\Program Files\WildTangent\LFS\TaskStore\MigrateDpid.cdaet
C:\Program Files\WildTangent\LFS\TaskStore\NewUser.cdaed
C:\Program Files\WildTangent\LFS\TaskStore\NewUser.cdaes
C:\Program Files\WildTangent\LFS\TaskStore\NewUser.cdaet
C:\Program Files\WildTangent\LFS\TaskStore\PersistentUpdateLibrary01.cdas
C:\Program Files\WildTangent\LFS\TaskStore\PersistentUpdateNormal.cdaed
C:\Program Files\WildTangent\LFS\TaskStore\PersistentUpdateNormal.cdaes
C:\Program Files\WildTangent\LFS\TaskStore\PersistentUpdateNormal.cdaet
C:\Program Files\WildTangent\LFS\TaskStore\PersistentUpdateQuick.cdaed
C:\Program Files\WildTangent\LFS\TaskStore\PersistentUpdateQuick.cdaes
C:\Program Files\WildTangent\LFS\TaskStore\PersistentUpdateQuick.cdaet
C:\Program Files\WildTangent\LFS\TaskStore\PersistentUpdateRestart.cdaed
C:\Program Files\WildTangent\LFS\TaskStore\PersistentUpdateRestart.cdaes
C:\Program Files\WildTangent\LFS\TaskStore\PersistentUpdateRestart.cdaet
C:\Program Files\WildTangent\LFS\TaskStore\ShutdownTest.cdaed
C:\Program Files\WildTangent\LFS\TaskStore\ShutdownTest.cdaes
C:\Program Files\WildTangent\LFS\TaskStore\ShutdownTest.cdaet
C:\Program Files\WildTangent\LFS\TaskStore\SystemConfiguration.cdaed
C:\Program Files\WildTangent\LFS\TaskStore\SystemConfiguration.cdaes
C:\Program Files\WildTangent\LFS\TaskStore\SystemConfiguration.cdaet
C:\Program Files\WildTangent\LFS\TaskStore\UpdateApplicationLibrary01.cdas
C:\Program Files\WildTangent\LFS\TaskStore\UpdateApplicationRestart.cdaed
C:\Program Files\WildTangent\LFS\TaskStore\UpdateApplicationRestart.cdaes
C:\Program Files\WildTangent\LFS\TaskStore\UpdateApplicationRestart.cdaet
C:\Program Files\WildTangent\LFS\TaskStore\UpdateApplicationTrigger.cdaes
C:\Program Files\WildTangent\LFS\TaskStore\UpdateApplicationTrigger.cdaet
C:\Program Files\WildTangent\LFS\TaskStore\updatecda.cdaes
C:\Program Files\WildTangent\LFS\TaskStore\updatecda.cdaet
C:\Program Files\WildTangent\LFS\TaskStore\UrlUpdate.cdaed
C:\Program Files\WildTangent\LFS\TaskStore\UrlUpdate.cdaes
C:\Program Files\WildTangent\LFS\TaskStore\UrlUpdate.cdaet
C:\Program Files\WildTangent\LFS\TaskStore\verify.cdaed
C:\Program Files\WildTangent\LFS\TaskStore\verify.cdaes
C:\Program Files\WildTangent\LFS\TaskStore\verify.cdaet
C:\Program Files\WildTangent\LFS\TaskStore\WeeklyCDA.cdaed
C:\Program Files\WildTangent\LFS\TaskStore\WeeklyCDA.cdaes
C:\Program Files\WildTangent\LFS\TaskStore\WeeklyCDA.cdaet
C:\Program Files\WildTangent\LicenseStores\WT\wt.sto
C:\WINDOWS\system32\drivers\asc3550.sys


((((((((((((((((((((((((( Files Created from 2007-08-10 to 2007-09-10 )))))))))))))))))))))))))))))))
.

2007-09-08 14:43 51,200 –a—— C:\WINDOWS\NirCmd.exe
2007-09-08 12:15 d——– C:\Program Files\Trend Micro
2007-09-06 15:39 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
2007-09-05 19:57 d——– C:\Program Files\SmartIsOn
2007-09-05 19:47 d——– C:\DOCUME~1\LOCALS~1\APPLIC~1\Talkback
2007-09-05 15:17 d–hs—- C:\WINDOWS\UmhvbmRhIEZhbGs
2007-09-05 15:17 d——– C:\WINDOWS\SYSTEM32\drvr2
2007-09-05 15:17 d——– C:\WINDOWS\SYSTEM32\cfig322
2007-09-05 15:17 d——– C:\WINDOWS\SYSTEM32\capcom
2007-09-05 15:17 d——– C:\Temp
2007-09-05 15:17 d——– C:\DOCUME~1\LOCALS~1\APPLIC~1\NetMon
2007-08-15 13:22 d——– C:\Program Files\MSXML 6.0

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-09-10 10:25 ——— d——– C:\Program Files\Common Files\Symantec Shared
2007-09-06 15:39 ——— d——– C:\Program Files\Lavasoft
2007-09-06 15:38 ——— d——– C:\Program Files\Common Files\Wise Installation Wizard
2007-08-09 12:59 22328 –a—— C:\WINDOWS\system32\drivers\PnkBstrK.sys
2007-08-07 13:58 8320 –a—— C:\WINDOWS\system32\drivers\AWRTRD.sys
2007-08-07 13:56 9344 –a—— C:\WINDOWS\system32\drivers\NSDriver.sys
2007-08-01 09:58 ——— d——– C:\Program Files\Windows Media Connect 2
2007-07-20 13:25 ——— d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\ATI MMC
2007-07-17 14:36 ——— d——– C:\Program Files\Common Files\PACE Anti-Piracy
2007-07-17 14:36 ——— d——– C:\DOCUME~1\Schloss\APPLIC~1\PACE Anti-Piracy
2007-07-17 14:36 ——— d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\PACE Anti-Piracy
2007-07-11 14:37 6272 –a—— C:\WINDOWS\system32\drivers\AWRTPD.sys
2007-06-13 05:23 1033216 –a—— C:\WINDOWS\explorer.exe
2005-07-29 21:24:26 472 –sha-r C:\WINDOWS\UmhvbmRhIEZhbGs\oA1SvAl1KHt1v3P.vbs
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DVDSentry"="C:\WINDOWS\System32\DSentry.exe" [2002-08-14 18:22]
"CTSysVol"="C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe" [2002-10-29 09:18]
"CTDVDDet"="C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE" [2002-09-30 01:00]
"CTHelper"="CTHELPER.EXE" [2003-02-20 16:45 C:\WINDOWS\SYSTEM32\CTHELPER.EXE]
"AsioReg"="REGSVR32.exe" [2004-08-04 02:56 C:\WINDOWS\SYSTEM32\regsvr32.exe]
"UpdReg"="C:\WINDOWS\UpdReg.EXE" [2000-05-11 01:00]
"NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2003-04-24 16:58]
"ATIPTA"="atiptaxx.exe" [2005-05-12 21:05 C:\WINDOWS\SYSTEM32\atiptaxx.exe]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2005-07-14 21:16]
"Symantec NetDriver Monitor"="C:\PROGRA~1\SYMNET~1\SNDMon.exe" [2005-08-08 15:45]
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 17:41]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-04-03 17:12]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2006-06-21 09:32]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 09:41]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AIM"="C:\Program Files\AIM\aim.exe" [2005-08-05 14:08]
"DellSupport"="C:\Program Files\DellSupport\DSAgnt.exe" [2007-03-15 11:09]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"RunNarrator"=Narrator.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"NoDispBackgroundPage"=0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoViewOnDrive"=0 (0x0)
"NoSMMyDocs"=1 (0x1)
"NoSMMyPictures"=1 (0x1)
"NoStartMenuMyMusic"=1 (0x1)
"NoRecentDocsMenu"=1 (0x1)
"NoAddPrinter"=0 (0x0)
"NoChangeAnimation"=0 (0x0)
"NoDeletePrinter"=0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 8.0 Tray Icon.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\America Online 8.0 Tray Icon.lnk
backup=C:\WINDOWS\pss\America Online 8.0 Tray Icon.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk
backup=C:\WINDOWS\pss\Digital Line Detect.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WinZip Quick Pick.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\WinZip Quick Pick.lnk
backup=C:\WINDOWS\pss\WinZip Quick Pick.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Schloss^Start Menu^Programs^Startup^OpenOffice.org 1.1.4.lnk]
path=C:\Documents and Settings\Schloss\Start Menu\Programs\Startup\OpenOffice.org 1.1.4.lnk
backup=C:\WINDOWS\pss\OpenOffice.org 1.1.4.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AceGain LiveUpdate]
C:\Program Files\AceGain\LiveUpdate\LiveUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdaptecDirectCD]
"C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AIM]
C:\Program Files\AIM\aim.exe -cnetwait.odl

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATI Launchpad]
"C:\Program Files\ATI Multimedia\main\launchpd.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EA Core]
"C:\Program Files\Electronic Arts\EA Link\Core.exe" -silent

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpfsched]
C:\WINDOWS\hpfsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCAgentExe]
c:\PROGRA~1\mcafee.com\agent\McAgent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCUpdateExe]
C:\PROGRA~1\mcafee.com\agent\mcupdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Update Detection]
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Mozilla Quick Launch]
"C:\Program Files\Netscape\Netscape\Netscp.exe" -turbo

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnappau]
"C:\Program Files\MSN Apps\Updater1.02.3000.1001\en-us\msnappau.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
"C:\Program Files\MSN Messenger\msnmsgr.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
nwiz.exe /install

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Red Swoosh EDN Client]
C:\Program Files\RSNet\RSEDNClient.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpyKiller]
C:\Program Files\SpyKiller\spykiller.exe /startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
"c:\progra~1\steam\steam.exe" -silent

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\System Soap Pro]
C:\PROGRA~1\SYSTEM~1\soap.exe min

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updatev01]
C:\WINDOWS\System32\updatev01.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ViewMgr]
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VirusScan Online]
c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Weather]
C:\Program Files\AWS\WeatherBug\Weather.EXE 1

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\_AntiSpyware]
C:\Program Files\McAfee\McAfee AntiSpyware\MssCli.exe

R1 atitray;atitray;\??\C:\Program Files\Radeon Omega Drivers\v2.6.42\ATI Tray Tools\atitray.sys
R1 cdudf_xp;cdudf_xp;C:\WINDOWS\system32\drivers\cdudf_xp.sys
R1 pwd_2k;pwd_2k;C:\WINDOWS\system32\drivers\pwd_2k.sys
R1 UdfReadr_xp;UdfReadr_xp;C:\WINDOWS\system32\drivers\UdfReadr_xp.sys
R2 HPFECP06;HPFECP06;C:\WINDOWS\system32\drivers\HPFECP06.SYS
R2 NkPtpEnumP2;NkPtpEnumP2;"C:\Program Files\Nikon\Wireless Camera Setup Utility\NkPtpEnum.exe" -a -d="C:\Program Files\Nikon\Wireless Camera Setup Utility\NkPtpip.dll"
R2 SVKP;SVKP;\??\C:\WINDOWS\system32\SVKP.sys
R3 dvd_2K;dvd_2K;C:\WINDOWS\system32\drivers\dvd_2K.sys
R3 VBus;Virtual Bus;C:\WINDOWS\system32\DRIVERS\NkVBus.sys
S2 cis1284;cis1284;\??\C:\WINDOWS\System32\drivers\cis1284.sys
S3 mmc_2K;mmc_2K;C:\WINDOWS\system32\drivers\mmc_2K.sys
S3 o1394bul;o1394bul;\??\C:\DOCUME~1\Schloss\LOCALS~1\Temp\o1394bul.sys
S3 SilverLink;Texas Instruments SilverLink (USB GraphLink) Cable;C:\WINDOWS\system32\Drivers\SilvrLnk.sys
S3 TICalc;TICalc;C:\WINDOWS\system32\drivers\TICalc.sys


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
AutoRun\command- F:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{71860fc1-a5b0-11db-bd8f-b4406390e31c}]
AutoRun\command- F:\LaunchU3.exe -a

.
Contents of the 'Scheduled Tasks' folder
"2007-08-25 23:58:01 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2006-12-31 00:15:15 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
"2007-08-25 01:00:13 C:\WINDOWS\Tasks\Norton AntiVirus - Scan my computer - Schloss.job"
.
**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-09-10 10:45:29
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-09-10 10:47:08 - machine was rebooted
C:\ComboFix-quarantined-files.txt … 2007-09-10 10:47
C:\ComboFix2.txt … 2007-09-09 15:02
.
— E O F —
Post #10
Here is the Hijack this after the CFScript Combofix

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:50:11 AM, on 9/10/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\Program Files\Nikon\Wireless Camera Setup Utility\NkPtpEnum.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\System32\DSentry.exe
C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE
C:\WINDOWS\system32\CTHELPER.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\Program Files\Belkin\USB F5D7050\Wireless Utility\Belkinwcui.exe
C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://msn.com/
N3 - Netscape 7: user_pref("browser.startup.homepage", "http://home.netscape.com/bookmark/7_1/home.html"); (C:\Documents and Settings\SCHLOSS\Application Data\Mozilla\Profiles\default\l78mjxlf.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\SCHLOSS\Application Data\Mozilla\Profiles\default\l78mjxlf.slt\prefs.js)
O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dll
O2 - BHO: (no name) - {7559B76E-0222-4d77-9499-CCE9EB4EDC2F} - (no file)
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST1.02.3000.1001\en-xu\stmain.dll (file missing)
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar1.02.3000.1001\en-us\msntb.dll (file missing)
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar1.02.3000.1001\en-us\msntb.dll (file missing)
O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
O4 - HKLM\..\Run: [CTDVDDet] C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [AsioReg] REGSVR32.EXE /S CTASIO.DLL
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [ATIPTA] atiptaxx.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Global Startup: Belkin Wireless USB Utility.lnk = C:\Program Files\Belkin\USB F5D7050\Wireless Utility\Belkinwcui.exe
O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Maintain Block List… - C:\PROGRA~1\AdShield\AdShield\maintain.htm
O8 - Extra context menu item: Add to &Block List… - C:\PROGRA~1\AdShield\AdShield\suppress.htm
O8 - Extra context menu item: Add to &Exclude List… - C:\PROGRA~1\AdShield\AdShield\restrict.htm
O8 - Extra context menu item: AdShield Option &Settings… - C:\PROGRA~1\AdShield\AdShield\settings.htm
O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm
O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: AdShield - {4FB6C25E-7B37-4c93-B592-16ECD8D18361} - C:\WINDOWS\System32\shdocvw.dll (HKCU)
O16 - DPF: ppctlcab - http://www.pestscan.com/scanner/ppctlcab.cab
O16 - DPF: {421A63BA-4632-43E0-A942-3B4AB645BE51} - http://download-ak.systemsoap.com/ssoap/pp…stemsoappro.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/m…84/mcinsctl.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/shared/m…,21/mcgdmgr.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - http://www.symantec.com/techsupp/asa/ctrl/SymAData.cab
O16 - DPF: {E123BED4-B8C7-42BB-958F-F13CA77EF95D} (Anark Client ActiveX Control) - http://install.anark.com/client/version2/w…en/AMClient.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\SYSTEM32\ati2sgag.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: Groove Games Licensing Service - Groove Games - C:\Program Files\Common Files\Groove Games Shared\Service\ggameslicsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: NkPtpEnumP2 - Nikon Corporation - C:\Program Files\Nikon\Wireless Camera Setup Utility\NkPtpEnum.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

–
End of file - 10690 bytes
Post #14
Here is the Kaspersky Report ——————————————————————————- KASPERSKY ONLINE SCANNER REPORT Monday, September 10, 2007 2:25:06 PM Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.93.1 Kaspersky Anti-Virus database last update: 9/09/2007 Kaspersky Anti-Virus database records: 410588 ——————————————————————————- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: A:\ C:\ D:\ E:\ Scan Statistics: Total number of scanned objects: 176493 Number of viruses found: 40 Number of infected objects: 100 Number of suspicious objects: 0 Duration of the scan process: 03:11:06 Infected Object Name / Virus Name / Last Action C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\settings.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\2007-09-10_Log.ALUSchedulerSvc.LiveUpdate Object is locked skipped C:\Documents and Settings\LocalService\Cookies\INDEX.DAT Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\INDEX.DAT Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\INDEX.DAT Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\Schloss\Application Data\GTek\GTUpdate\AUpdate\DellSupport\DSAgnt.log Object is locked skipped C:\Documents and Settings\Schloss\Application Data\GTek\GTUpdate\AUpdate\DellSupport\DSAgnt_GTActions.log Object is locked skipped C:\Documents and Settings\Schloss\Application Data\GTek\GTUpdate\AUpdate\DellSupport\gdql_d_DSAgnt.log Object is locked skipped C:\Documents and Settings\Schloss\Application Data\GTek\GTUpdate\AUpdate\DellSupport\glog.log Object is locked skipped C:\Documents and Settings\Schloss\Application Data\Microsoft\Windows\akcnb.exe Infected: Trojan-Downloader.Win32.Agent.buo skipped C:\Documents and Settings\Schloss\Application Data\Mozilla\Firefox\Profiles\zykawwtm.Default User\Cache\_CACHE_001_ Object is locked skipped C:\Documents and Settings\Schloss\Application Data\Mozilla\Firefox\Profiles\zykawwtm.Default User\Cache\_CACHE_002_ Object is locked skipped C:\Documents and Settings\Schloss\Application Data\Mozilla\Firefox\Profiles\zykawwtm.Default User\Cache\_CACHE_003_ Object is locked skipped C:\Documents and Settings\Schloss\Application Data\Mozilla\Firefox\Profiles\zykawwtm.Default User\Cache\_CACHE_MAP_ Object is locked skipped C:\Documents and Settings\Schloss\Application Data\Mozilla\Firefox\Profiles\zykawwtm.Default User\cert8.db Object is locked skipped C:\Documents and Settings\Schloss\Application Data\Mozilla\Firefox\Profiles\zykawwtm.Default User\formhistory.dat Object is locked skipped C:\Documents and Settings\Schloss\Application Data\Mozilla\Firefox\Profiles\zykawwtm.Default User\history.dat Object is locked skipped C:\Documents and Settings\Schloss\Application Data\Mozilla\Firefox\Profiles\zykawwtm.Default User\key3.db Object is locked skipped C:\Documents and Settings\Schloss\Application Data\Mozilla\Firefox\Profiles\zykawwtm.Default User\parent.lock Object is locked skipped C:\Documents and Settings\Schloss\Cookies\INDEX.DAT Object is locked skipped C:\Documents and Settings\Schloss\Local Settings\Application Data\ApplicationHistory\cli.exe.c88dbd71.ini.inuse Object is locked skipped C:\Documents and Settings\Schloss\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Schloss\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Schloss\Local Settings\History\History.IE5\INDEX.DAT Object is locked skipped C:\Documents and Settings\Schloss\Local Settings\Temp\Perflib_Perfdata_210.dat Object is locked skipped C:\Documents and Settings\Schloss\Local Settings\Temp\Perflib_Perfdata_5d0.dat Object is locked skipped C:\Documents and Settings\Schloss\Local Settings\Temp\Perflib_Perfdata_950.dat Object is locked skipped C:\Documents and Settings\Schloss\Local Settings\Temp\~DF7A1E.tmp Object is locked skipped C:\Documents and Settings\Schloss\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Schloss\NTUSER.DAT Object is locked skipped C:\Documents and Settings\Schloss\ntuser.dat.LOG Object is locked skipped C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcrst.dll Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SNDALRT.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SNDCON.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SNDDBG.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SNDFW.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SNDIDS.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SNDSYS.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPPolicy.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPStart.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPStop.log Object is locked skipped C:\Program Files\mIRC\mirc.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.612 skipped C:\Program Files\Norton AntiVirus\AVApp.log Object is locked skipped C:\Program Files\Norton AntiVirus\AVError.log Object is locked skipped C:\Program Files\Norton AntiVirus\AVVirus.log Object is locked skipped C:\Program Files\Norton AntiVirus\QuarantineBF52A83.dll Infected: not-a-virus:AdWare.Win32.Ipend skipped C:\Program Files\Norton AntiVirus\Quarantine\3BF70BEF.dll Infected: not-a-virus:AdWare.Win32.VB.a skipped C:\Program Files\Norton AntiVirus\Quarantine\3EEF4C0E.dll Infected: Trojan.Win32.TalkStocks.a skipped C:\Program Files\Norton AntiVirus\Quarantine\3F1219E6.cab/alchem.exe Infected: Trojan-Downloader.Win32.Alchemic skipped C:\Program Files\Norton AntiVirus\Quarantine\3F1219E6.cab CAB: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\3F1219E6.cab CryptFF: infected - 1 skipped C:\Program Files\Norton AntiVirus\Quarantine\3F1219E6.gif Infected: not-a-virus:AdWare.Win32.SearchAssistant.d skipped C:\Program Files\Norton AntiVirus\Quarantine\3F1643E3.dll Infected: not-a-virus:AdWare.Win32.ClientMan skipped C:\Program Files\Norton AntiVirus\Quarantine\3F1643E3.gif Infected: not-a-virus:AdWare.Win32.Ipend skipped C:\Program Files\Norton AntiVirus\Quarantine\3F196DDF.cab/twaintec.dll Infected: not-a-virus:AdWare.Win32.BiSpy.m skipped C:\Program Files\Norton AntiVirus\Quarantine\3F196DDF.cab/preInsTT.exe Infected: not-a-virus:AdWare.Win32.BiSpy.f skipped C:\Program Files\Norton AntiVirus\Quarantine\3F196DDF.cab CAB: infected - 2 skipped C:\Program Files\Norton AntiVirus\Quarantine\3F196DDF.cab CryptFF: infected - 2 skipped C:\Program Files\Norton AntiVirus\Quarantine\3F196DDF.dll Infected: not-a-virus:AdWare.Win32.WebSearch.o skipped C:\Program Files\Norton AntiVirus\Quarantine\49023D61.dll Infected: not-a-virus:AdWare.Win32.ClientMan skipped C:\Program Files\Norton AntiVirus\Quarantine\49023D61.gif Infected: Trojan-Spy.Win32.Delf.dx skipped C:\Program Files\Norton AntiVirus\Quarantine\5D69755F.zip/GetAccess.class Infected: Trojan.Java.ClassLoader.c skipped C:\Program Files\Norton AntiVirus\Quarantine\5D69755F.zip/InsecureClassLoader.class Infected: Exploit.Java.ByteVerify skipped C:\Program Files\Norton AntiVirus\Quarantine\5D69755F.zip/Dummy.class Infected: Trojan.Java.ClassLoader.Dummy.a skipped C:\Program Files\Norton AntiVirus\Quarantine\5D69755F.zip/Installer.class Infected: Trojan-Downloader.Java.OpenConnection.v skipped C:\Program Files\Norton AntiVirus\Quarantine\5D69755F.zip ZIP: infected - 4 skipped C:\Program Files\Norton AntiVirus\Quarantine\5D69755F.zip CryptFF: infected - 4 skipped C:\Program Files\Norton AntiVirus\Quarantine\680D3DAA.dat Infected: Trojan-Spy.Win32.Agent.l skipped C:\Program Files\Norton AntiVirus\Quarantine\6C000512.dll Infected: not-a-virus:AdWare.Win32.VB.a skipped C:\Program Files\Norton AntiVirus\Quarantine\76B70CD1.exe Infected: Backdoor.Win32.IRCBot.ct skipped C:\qoobox\Quarantine\C\DOCUME~1\Schloss\APPLIC~1\WinTouch\WTUninstaller.exe.vir Infected: Trojan-Downloader.Win32.Agent.buo skipped C:\qoobox\Quarantine\C\Program Files\Common Files\WinAntiSpyware 2007\WAS7Mon.exe.vir Infected: not-a-virus:Downloader.Win32.WinFixer.x skipped C:\qoobox\Quarantine\C\WINDOWS\b104.exe.vir/stream/data0002 Infected: Trojan-Downloader.Win32.Small.buy skipped C:\qoobox\Quarantine\C\WINDOWS\b104.exe.vir/stream/data0004 Infected: not-a-virus:AdWare.Win32.Mostofate.u skipped C:\qoobox\Quarantine\C\WINDOWS\b104.exe.vir/stream Infected: not-a-virus:AdWare.Win32.Mostofate.u skipped C:\qoobox\Quarantine\C\WINDOWS\b104.exe.vir NSIS: infected - 3 skipped C:\qoobox\Quarantine\C\WINDOWS\b138.exe.vir Infected: Trojan-Downloader.Win32.Agent.cbx skipped C:\qoobox\Quarantine\C\WINDOWS\DOWNLO~1\UWA7P_0001_N99M2908NetInstaller.exe.vir Infected: not-a-virus:Downloader.Win32.WinFixer.o skipped C:\qoobox\Quarantine\C\WINDOWS\retadpu1000106.exe.vir Infected: Trojan-Downloader.Win32.Agent.bls skipped C:\qoobox\Quarantine\C\WINDOWS\SYSTEM32\afecpbty.exe.vir Infected: Trojan.Win32.Agent.bck skipped C:\qoobox\Quarantine\C\WINDOWS\SYSTEM32\f02WtR\f02WtR1065.exe.vir Infected: Trojan-Downloader.Win32.VB.bgd skipped C:\qoobox\Quarantine\C\WINDOWS\SYSTEM32\fpnqmtlu.exe.vir Infected: Trojan.Win32.Agent.bck skipped C:\qoobox\Quarantine\C\WINDOWS\SYSTEM32\fxphsgyv.exe.vir Infected: Trojan.Win32.Agent.bck skipped C:\qoobox\Quarantine\C\WINDOWS\SYSTEM32\kdhqibhg.exe.vir Infected: Trojan-Downloader.Win32.Tiny.id skipped C:\qoobox\Quarantine\C\WINDOWS\SYSTEM32\MANTEC~1\javaw.exe.vir Infected: Trojan-Downloader.Win32.PurityScan.dx skipped C:\qoobox\Quarantine\C\WINDOWS\SYSTEM32\mhvitwje.exe.vir Infected: Trojan.Win32.Agent.bck skipped C:\qoobox\Quarantine\C\WINDOWS\SYSTEM32\mljjhgg.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped C:\qoobox\Quarantine\C\WINDOWS\SYSTEM32\oxfjrkqa.exe.vir Infected: Trojan.Win32.Agent.bck skipped C:\qoobox\Quarantine\C\WINDOWS\SYSTEM32\sovfakvr.exe.vir Infected: Trojan.Win32.Agent.bck skipped C:\qoobox\Quarantine\C\WINDOWS\SYSTEM32\tbbqgwwj.exe.vir Infected: Trojan.Win32.Agent.bck skipped C:\qoobox\Quarantine\C\WINDOWS\SYSTEM32\ulhepasa.exe.vir Infected: Trojan.Win32.Agent.bck skipped C:\qoobox\Quarantine\C\WINDOWS\SYSTEM32\wsdoxjnb.exe.vir Infected: Trojan.Win32.Agent.bck skipped C:\qoobox\Quarantine\catchme2007-09-09_150005.75.zip/rqrqnkj.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped C:\qoobox\Quarantine\catchme2007-09-09_150005.75.zip ZIP: infected - 1 skipped C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1001\A0170059.exe Infected: Trojan-Downloader.Win32.Agent.bls skipped C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1001\A0170063.exe/stream/data0002 Infected: Trojan-Downloader.Win32.Small.buy skipped C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1001\A0170063.exe/stream/data0004 Infected: not-a-virus:AdWare.Win32.Mostofate.u skipped C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1001\A0170063.exe/stream Infected: not-a-virus:AdWare.Win32.Mostofate.u skipped C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1001\A0170063.exe NSIS: infected - 3 skipped C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1001\A0170064.exe Infected: Trojan-Downloader.Win32.Agent.cbx skipped C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1001\A0170065.exe Infected: Trojan.Win32.Agent.bck skipped C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1001\A0170066.exe Infected: Trojan.Win32.Agent.bck skipped C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1001\A0170067.exe Infected: Trojan.Win32.Agent.bck skipped C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1001\A0170068.exe Infected: Trojan.Win32.Agent.bck skipped C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1001\A0170069.exe Infected: Trojan.Win32.Agent.bck skipped C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1001\A0170070.exe Infected: Trojan.Win32.Agent.bck skipped C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1001\A0170071.exe Infected: Trojan.Win32.Agent.bck skipped C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1001\A0170072.exe Infected: Trojan.Win32.Agent.bck skipped C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1001\A0170078.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1001\A0170081.exe Infected: Trojan-Downloader.Win32.Tiny.id skipped C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1001\A0170086.exe Infected: not-a-virus:Downloader.Win32.WinFixer.x skipped C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1001\A0170087.exe Infected: Trojan-Downloader.Win32.PurityScan.dx skipped C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1001\A0170089.exe Infected: Trojan-Downloader.Win32.Agent.buo skipped C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1001\A0170090.exe Infected: Trojan-Downloader.Win32.VB.bgd skipped C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1001\A0170101.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP1003\change.log Object is locked skipped C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP995\A0168778.exe Infected: not-a-virus:AdWare.Win32.Agent.co skipped C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP996\A0168802.exe/file2 Infected: not-a-virus:Downloader.Win32.WinFixer.t skipped C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP996\A0168802.exe Inno: infected - 1 skipped C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP999\A0169916.dll Infected: not-a-virus:AdWare.Win32.CommAd.a skipped C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP999\A0169917.exe Infected: not-a-virus:AdWare.Win32.CommAd.a skipped C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP999\A0169918.exe Infected: not-a-virus:Monitor.Win32.NetMon.a skipped C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP999\A0169919.exe Infected: Trojan-Downloader.Win32.PurityScan.dx skipped C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP999\A0169920.exe/stream/data0002/data0002 Infected: Trojan-Downloader.Win32.PurityScan.eh skipped C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP999\A0169920.exe/stream/data0002 Infected: Trojan-Downloader.Win32.PurityScan.eh skipped C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP999\A0169920.exe/stream/data0004 Infected: not-a-virus:AdWare.Win32.Mostofate.u skipped C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP999\A0169920.exe/stream Infected: not-a-virus:AdWare.Win32.Mostofate.u skipped C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP999\A0169920.exe NSIS: infected - 4 skipped C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP999\A0169921.exe/data0002 Infected: not-a-virus:AdWare.Win32.PurityScan.fk skipped C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP999\A0169921.exe/data0003 Infected: not-a-virus:AdWare.Win32.PurityScan.bu skipped C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP999\A0169921.exe NSIS: infected - 2 skipped C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP999\A0169927.exe Infected: not-a-virus:Downloader.Win32.WinFixer.t skipped C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP999\A0169928.exe Infected: Trojan-Downloader.Win32.PurityScan.eh skipped C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP999\A0169929.exe Infected: not-a-virus:AdWare.Win32.TTC.c skipped C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP999\A0169930.exe Infected: not-a-virus:AdWare.Win32.Rond.c skipped C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP999\A0169932.exe Infected: Trojan-Downloader.Win32.Agent.buo skipped C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP999\A0169935.dll Infected: not-a-virus:AdWare.Win32.CommAd.a skipped C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP999\A0169936.exe Infected: Trojan.Win32.Agent.bck skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\EventCache\{27E60E58-1171-4F03-B591-1A99D7D4498C}.bin Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\Sti_Trace.log Object is locked skipped C:\WINDOWS\SYSTEM32\capcom\nab22011.exe/data0004 Infected: not-a-virus:AdWare.Win32.TTC.c skipped C:\WINDOWS\SYSTEM32\capcom\nab22011.exe NSIS: infected - 1 skipped C:\WINDOWS\SYSTEM32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\SYSTEM32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\SYSTEM32\cfig322\icm33o.exe Infected: Trojan-Downloader.Win32.Small.fky skipped C:\WINDOWS\SYSTEM32\CONFIG\ACEEvent.evt Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\AppEvent.Evt Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SAM Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SAM.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SecEvent.Evt Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SECURITY Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SECURITY.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SysEvent.Evt Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\drvr2\bbc002nws.exe Infected: Trojan-Downloader.Win32.Small.buy skipped C:\WINDOWS\SYSTEM32\H323LOG.TXT Object is locked skipped C:\WINDOWS\SYSTEM32\msfdje.gif Infected: not-a-virus:AdWare.Win32.ClientMan skipped C:\WINDOWS\SYSTEM32\SPOOL\PRINTERS\004.SPL Object is locked skipped C:\WINDOWS\SYSTEM32\updatev03.exe Infected: not-a-virus:AdWare.Win32.Sahat.as skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\WIADEBUG.LOG Object is locked skipped C:\WINDOWS\WIASERVC.LOG Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped C:\WINDOWS\{00000002-00000000-00000002-00001102-00000004-10031102}.CDF Object is locked skipped Scan process completed.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI