What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Yellow Exclamation Mark - Cpu Spiking

9 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Had a problem a little while ago, thought that I had solved it. Apparently I haven't.

In my taskbar in windows xp, sometimes a small yellow triangle with an exclamation mark will appear. If I click on it, it disappears, it doesn't look as if any strange processes are running when it happens either.

I've also noticed some CPU spiking which wasn't happening a while ago, seems to freeze the computer for a moment and actually disrupts recording through audio programs.

Would prefer to not have to reinstall/format as there's a lot of work put into keeping the machine clean, but if I have to I will. Giving it a last shot. Here is my log, thanks for any help possible!!!

——————

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:19:35 PM, on 9/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\JulaPan.Exe
C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Documents and Settings\Administrator\Desktop\spyware\HiJackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
O2 - BHO: WebAssist - {85589B5D-D53D-4237-A677-46B82EA275F3} - C:\WINDOWS\system32\ofD8pA7E.dll
O4 - HKLM\..\Run: [JulaPan] JulaPan.Exe
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://go.divx.com/plugin/DivXBrowserPlugin.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{4A27027D-9371-47B2-A07A-1B5CC3A6F3B3}: NameServer = 192.168.1.1
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe

–
End of file - 1764 bytes
Post #2
Hello and welcome to the forum

I don't see a anti-virus program running or a firewall. Get the free ones.

Click HERE and Save, Install, Update and run a full scan.


Below is a list of some free firewalls (in no order of preference).It is important to note that you should only have one firewall installed at a time, but you can download to your Desktop and install each in turn to see which one you prefer.



Empty Recycle Bin

Reboot and "copy/paste" a new log file into this thread.
Also please describe how your computer behaves at the moment
Post #3 last edited
Thanks for the help, I have installed an run AVG, it found a few issues. I'm not sure which firewall to install, they both look like trials only? Do you happen to know which one has a smaller footprint?

Here is my most recent HJT log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:33:02 PM, on 9/15/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\JulaPan.Exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Documents and Settings\Administrator\Desktop\spyware\HiJackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
O2 - BHO: WebAssist - {85589B5D-D53D-4237-A677-46B82EA275F3} - C:\WINDOWS\system32\ofD8pA7E.dll
O4 - HKLM\..\Run: [JulaPan] JulaPan.Exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://go.divx.com/plugin/DivXBrowserPlugin.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{4A27027D-9371-47B2-A07A-1B5CC3A6F3B3}: NameServer = 192.168.1.1
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe

–
End of file - 2534 bytes


———————————————–

Also, here is what AVG found, I unfortunately can't figure out how to export the logs as a txt file (???), so they are images, sorry. I have also manually deleted the file that was in the torrents folder since AVG didn't do so:

[external image: Posted Image]

[external image: Posted Image]

[external image: Posted Image]

[external image: Posted Image]

[external image: Posted Image]

New symptoms have started to arise, but so far they are only popups in IE. Thanks again for the help!
Post #4

Do you happen to know which one has a smaller footprint?

No I don't

I don't like that Backdoor stuff.


Run hijackthis. Hit None of the above, Click Do a System Scan Only. Put a Check in the box on the left side on these:

O2 - BHO: WebAssist - {85589B5D-D53D-4237-A677-46B82EA275F3} - C:\WINDOWS\system32\ofD8pA7E.dll
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe

Close ALL windows and browsers except HijackThis and click "Fix checked"


Delete this File if listed:
C:\WINDOWS\system32\ofD8pA7E.dll



Next:

Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»

Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

Note:
(If you use FireFox or the Opera browser
To keep saved passwords, click No at the prompt.)


It's normal after running ATF cleaner that the PC will be slower to boot the first time.

Next:

Download the trial version of AVG Anti-Spyware from here and install it. When the program has been installed, and you click the Finish button, AVG Anti-Spyware will open.

If the program does not automatically update itself during installation, or you are unsure whether it has done so, please do the following:
  • Click the Update icon at the top and under Manual Update click the Start update button.
  • The program will either update or inform you that no update was available.
  • It is essential that you get the update - keep trying until successful. (Note: If you have problems getting the update, you can download an installer for the full database from here (save it on your desktop). Once you have downloaded the installer, make sure that AVG Anti-Spyware is closed and then double-click on avgas-signatures-full-current.exe to install the database).
Please set up the program as follows:
  • Click the Shield icon at the top and under Resident shield is… click active. This should now
    change to inactive.
  • Click the Update icon and untick the automatic update option.
  • Click on Scanner on the toolbar.
  • Click on the Settings tab.
  • Under How to act? - make sure that Quarantine is selected.
  • Under How to scan? - All checkboxes should be ticked.
  • Under Possibly unwanted software - All checkboxes should be ticked.
  • Under Reports - Select Do not automatically generate reports.
  • Under What to scan? - Select Scan every file.
Close all open windows.
Do not run a scan yet.

Reboot your computer into SafeMode
You can do this by restarting your computer and continually tapping the F8 key until a menu appears.
Use your up arrow key to highlight SafeMode then hit enter.


IMPORTANT: Do not open any other windows or
programs while AVG Anti-Spyware is scanning, it may interfere with the scanning proccess:

  • Lauch AVG Anti-Spyware by double-clicking the icon on your desktop.
  • Select the "Scanner" icon at the top and then the "Scan" tab
    then click on "Complete System Scan".
  • ewido will now begin the scanning process, be patient this may take a little
    time.
  • Let the program scan your computer.
  • When the scan has finished, follow the instructions below:
    • Make sure that Set all elements to: shows Quarantine
    • Important: Click on the Apply all Actions button (*** This must done before saving the report ***)
    • When the program has finished, it will display the message All actions have been applied.
    • Then click the Save Scan Report button.
    • Click the Save Report as button.
    • Save the report to your Desktop.
    • Right-click the AVG Tray Icon and select Exit. Confirm by clicking Yes.
    • Reboot in normal mode and copy the report back to this topic along with a new HijackThis log.
Post #5
Here are the most recent reports:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:47:18 PM, on 9/15/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\JulaPan.Exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Documents and Settings\Administrator\Desktop\spyware\HiJackThis.exe

O4 - HKLM\..\Run: [JulaPan] JulaPan.Exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://go.divx.com/plugin/DivXBrowserPlugin.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{4A27027D-9371-47B2-A07A-1B5CC3A6F3B3}: NameServer = 192.168.1.1
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe

–
End of file - 2427 bytes


——————————-

———————————————————
AVG Anti-Spyware - Scan Report
———————————————————

+ Created at: 7:42:32 PM 9/15/2007

+ Scan result:



Nothing found.



::Report end
Post #7
Definitely seems to be running better, although I always had little luck duplicating the symptoms. I've defragged all of my drives and ran a chkdsk on the c: (will do the rest later). I would like to run more tests if possible to see if I can find any other problems though, do you have any suggestions?
Post #8
Download ComboFix from Here or Here to your Desktop.
  • Double click combofix.exe and follow the prompts.
  • When finished, it shall produce a log for you. Post that log and a HiJackthis log in your next reply
Note: Do not mouseclick combofix's window while its running. That may cause it to stall
Post #9
Here are my most recent logs:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:58:45 AM, on 9/18/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\JulaPan.Exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\Raxco\PerfectDisk\PDAgent.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
C:\Documents and Settings\Administrator\Desktop\spyware\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O4 - HKLM\..\Run: [JulaPan] JulaPan.Exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://go.divx.com/plugin/DivXBrowserPlugin.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{4A27027D-9371-47B2-A07A-1B5CC3A6F3B3}: NameServer = 192.168.1.1
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: PDAgent - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDAgent.exe
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDEngine.exe

–
End of file - 3226 bytes

—————————–

ComboFix 07-09-17.2 - "Administrator" 2007-09-18 7:55:18.5 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1658 [GMT 2:00]
* Created a new restore point
.

((((((((((((((((((((((((( Files Created from 2007-08-18 to 2007-09-18 )))))))))))))))))))))))))))))))
.

2007-09-15 14:43 10,872 –a—— C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-09-06 03:41 184,320 –a—— C:\WINDOWS\system32\KgOLK40M.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-09-16 16:03 ——— d——– C:\DOCUME~1\ADMINI~1\APPLIC~1\Azureus
2007-09-14 00:11 ——— d——– C:\Program Files\PartyGaming
2007-08-16 19:59 ——— d——– C:\Program Files\Common Files\Logitech
2007-08-16 19:43 ——— d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\PC Suite
2007-08-16 19:43 ——— d——– C:\DOCUME~1\ADMINI~1\APPLIC~1\Nokia
2007-08-16 19:42 ——— d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Installations
2007-08-15 11:14 ——— d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Downloaded Installations
2007-08-15 10:55 ——— d–h—– C:\Program Files\InstallShield Installation Information
2007-08-15 10:55 ——— d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Logitech
2007-08-15 10:55 ——— d——– C:\DOCUME~1\ADMINI~1\APPLIC~1\Logitech
2007-08-15 10:53 ——— d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kaspersky Lab
2007-08-10 12:12 ——— d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kaspersky Lab Setup Files
2007-08-09 09:33 ——— d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Office Genuine Advantage
2007-08-08 10:27 ——— d——– C:\Program Files\Enigma Software Group
2006-06-12 23:17 0 –a—— C:\DOCUME~1\ADMINI~1\llh.dll
2006-06-06 23:06 69632 –a—— C:\DOCUME~1\ADMINI~1\DM.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"JulaPan"="JulaPan.Exe" [2005-07-05 17:27 C:\WINDOWS\system32\JulaPan.exe]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-09-15 11:41]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 11:25]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{93994DE8-8239-4655-B1D1-5F4E91300429}"= D:\Program Files\DVD Region+CSS Free\DVDShell.dll [2004-10-09 15:18 49152]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Administrator^Start Menu^Programs^Startup^Adobe Gamma Loader.exe]
path=C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\Adobe Gamma Loader.exe
backup=C:\WINDOWS\pss\Adobe Gamma Loader.exeStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Administrator^Start Menu^Programs^Startup^Adobe Gamma.lnk]
path=C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\Adobe Gamma.lnk
backup=C:\WINDOWS\pss\Adobe Gamma.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Administrator^Start Menu^Programs^Startup^HDD temperature.lnk]
path=C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\HDD temperature.lnk
backup=C:\WINDOWS\pss\HDD temperature.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Acrobat Speed Launcher.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Acrobat Speed Launcher.lnk
backup=C:\WINDOWS\pss\Adobe Acrobat Speed Launcher.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Acrobat Synchronizer.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Acrobat Synchronizer.lnk
backup=C:\WINDOWS\pss\Adobe Acrobat Synchronizer.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk
backup=C:\WINDOWS\pss\Adobe Reader Synchronizer.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^AutoCAD Startup Accelerator.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\AutoCAD Startup Accelerator.lnk
backup=C:\WINDOWS\pss\AutoCAD Startup Accelerator.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^BTTray.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\BTTray.lnk
backup=C:\WINDOWS\pss\BTTray.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^m-trip Launcher.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\m-trip Launcher.lnk
backup=C:\WINDOWS\pss\m-trip Launcher.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ABIT uGuru]
d:\Program Files\ABIT\ABIT uGuru\uGuru.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 7.0]
"D:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 8.0]
"C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
"C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
"C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]
"d:\Program Files\DAEMON Tools\daemon.exe" -lang 1033

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools-1033]
"D:\Program Files\D-Tools\daemon.exe" -lang 1033

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\gcasServ]
"C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GuruClock]
d:\Program Files\ABIT\ABIT uGuru\GuruClock.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H2O]
C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HDDHealth]
d:\Program Files\HDD Health\hddhealth.exe -wl

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Kernel and Hardware Abstraction Layer]
KHALMNPR.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Lexmark_X79-55]
C:\WINDOWS\system32\lsasss.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Hardware Abstraction Layer]
KHALMNPR.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Windows System Kernel]
kernel32.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
D:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -onlytray

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
SOUNDMAN.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
"C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr]
"D:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows installer]
C:\winstall.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"PDSched"=2 (0x2)

R3 ipgd;IC Plus IP1000 Family Gigabit Ethernet Adapter Driver;C:\WINDOWS\system32\DRIVERS\ipgdnd51.sys
R3 JULA_01;Service for Juli@ 1;C:\WINDOWS\system32\drivers\JulaWdm.sys
R3 JULA_AA;Service for Juli@ Audio Driver (EWDM);C:\WINDOWS\system32\drivers\Jula.sys
R3 vsbus;Virtual Serial Bus Enumerator;C:\WINDOWS\system32\DRIVERS\vsb.sys
S3 vserial;ELTIMA Virtual Serial Ports Driver;C:\WINDOWS\system32\DRIVERS\vserial.sys

.
Contents of the 'Scheduled Tasks' folder
"2007-09-17 22:00:00 C:\WINDOWS\Tasks\At1.job"
- C:\WINDOWS\system32\7BUSUvlk.exe
"2007-09-17 07:00:00 C:\WINDOWS\Tasks\At10.job"
"2007-09-17 08:00:00 C:\WINDOWS\Tasks\At11.job"
"2007-09-17 09:00:00 C:\WINDOWS\Tasks\At12.job"
- C:\WINDOWS\system32\7BUSUvlk.exe
"2007-09-17 10:00:00 C:\WINDOWS\Tasks\At13.job"
- C:\WINDOWS\system32\7BUSUvlk.exe
"2007-09-17 11:00:00 C:\WINDOWS\Tasks\At14.job"
- C:\WINDOWS\system32\7BUSUvlk.exe
"2007-09-17 12:00:00 C:\WINDOWS\Tasks\At15.job"
- C:\WINDOWS\system32\7BUSUvlk.exe
"2007-09-17 13:00:00 C:\WINDOWS\Tasks\At16.job"
- C:\WINDOWS\system32\7BUSUvlk.exe
"2007-09-17 14:00:00 C:\WINDOWS\Tasks\At17.job"
- C:\WINDOWS\system32\7BUSUvlk.exe
"2007-09-17 15:00:00 C:\WINDOWS\Tasks\At18.job"
- C:\WINDOWS\system32\7BUSUvlk.exe
"2007-09-17 16:00:00 C:\WINDOWS\Tasks\At19.job"
- C:\WINDOWS\system32\7BUSUvlk.exe
"2007-09-17 23:00:00 C:\WINDOWS\Tasks\At2.job"
- C:\WINDOWS\system32\7BUSUvlk.exe
"2007-09-17 17:00:00 C:\WINDOWS\Tasks\At20.job"
- C:\WINDOWS\system32\7BUSUvlk.exe
"2007-09-17 18:00:00 C:\WINDOWS\Tasks\At21.job"
- C:\WINDOWS\system32\7BUSUvlk.exe
"2007-09-17 19:00:00 C:\WINDOWS\Tasks\At22.job"
- C:\WINDOWS\system32\7BUSUvlk.exe
"2007-09-17 20:00:00 C:\WINDOWS\Tasks\At23.job"
- C:\WINDOWS\system32\7BUSUvlk.exe
"2007-09-17 21:00:00 C:\WINDOWS\Tasks\At24.job"
- C:\WINDOWS\system32\7BUSUvlk.exe
"2007-09-17 22:00:00 C:\WINDOWS\Tasks\At25.job"
- C:\WINDOWS\system32\wr68qA20.exe
"2007-09-17 23:00:00 C:\WINDOWS\Tasks\At26.job"
- C:\WINDOWS\system32\wr68qA20.exe
"2007-09-18 00:00:00 C:\WINDOWS\Tasks\At27.job"
- C:\WINDOWS\system32\wr68qA20.exe
"2007-09-18 01:00:00 C:\WINDOWS\Tasks\At28.job"
- C:\WINDOWS\system32\wr68qA20.exe
"2007-09-18 02:00:00 C:\WINDOWS\Tasks\At29.job"
- C:\WINDOWS\system32\wr68qA20.exe
"2007-09-18 00:00:00 C:\WINDOWS\Tasks\At3.job"
- C:\WINDOWS\system32\7BUSUvlk.exe
"2007-09-18 03:00:00 C:\WINDOWS\Tasks\At30.job"
- C:\WINDOWS\system32\wr68qA20.exe
"2007-09-18 04:00:00 C:\WINDOWS\Tasks\At31.job"
- C:\WINDOWS\system32\wr68qA20.exe
"2007-09-18 05:00:00 C:\WINDOWS\Tasks\At32.job"
- C:\WINDOWS\system32\wr68qA20.exe
"2007-09-17 06:00:00 C:\WINDOWS\Tasks\At33.job"
- C:\WINDOWS\system32\wr68qA20.exe
"2007-09-17 07:00:00 C:\WINDOWS\Tasks\At34.job"
"2007-09-17 08:00:00 C:\WINDOWS\Tasks\At35.job"
"2007-09-17 09:00:00 C:\WINDOWS\Tasks\At36.job"
- C:\WINDOWS\system32\wr68qA20.exe
"2007-09-17 10:00:00 C:\WINDOWS\Tasks\At37.job"
- C:\WINDOWS\system32\wr68qA20.exe
"2007-09-17 11:00:00 C:\WINDOWS\Tasks\At38.job"
"2007-09-17 12:00:00 C:\WINDOWS\Tasks\At39.job"
- C:\WINDOWS\system32\wr68qA20.exe
"2007-09-18 01:00:00 C:\WINDOWS\Tasks\At4.job"
- C:\WINDOWS\system32\7BUSUvlk.exe
"2007-09-17 13:00:00 C:\WINDOWS\Tasks\At40.job"
- C:\WINDOWS\system32\wr68qA20.exe
"2007-09-17 14:00:00 C:\WINDOWS\Tasks\At41.job"
- C:\WINDOWS\system32\wr68qA20.exe
"2007-09-17 15:00:00 C:\WINDOWS\Tasks\At42.job"
- C:\WINDOWS\system32\wr68qA20.exe
"2007-09-17 16:00:00 C:\WINDOWS\Tasks\At43.job"
- C:\WINDOWS\system32\wr68qA20.exe
"2007-09-17 17:00:00 C:\WINDOWS\Tasks\At44.job"
- C:\WINDOWS\system32\wr68qA20.exe
"2007-09-17 18:00:00 C:\WINDOWS\Tasks\At45.job"
- C:\WINDOWS\system32\wr68qA20.exe
"2007-09-17 19:00:00 C:\WINDOWS\Tasks\At46.job"
"2007-09-17 20:00:00 C:\WINDOWS\Tasks\At47.job"
- C:\WINDOWS\system32\wr68qA20.exe
"2007-09-17 21:00:00 C:\WINDOWS\Tasks\At48.job"
- C:\WINDOWS\system32\wr68qA20.exe
"2007-09-18 02:00:00 C:\WINDOWS\Tasks\At5.job"
- C:\WINDOWS\system32\7BUSUvlk.exe
"2007-09-18 03:00:00 C:\WINDOWS\Tasks\At6.job"
- C:\WINDOWS\system32\7BUSUvlk.exe
"2007-09-18 04:00:00 C:\WINDOWS\Tasks\At7.job"
- C:\WINDOWS\system32\7BUSUvlk.exe
"2007-09-18 05:00:00 C:\WINDOWS\Tasks\At8.job"
- C:\WINDOWS\system32\7BUSUvlk.exe
"2007-09-17 06:00:00 C:\WINDOWS\Tasks\At9.job"
- C:\WINDOWS\system32\7BUSUvlk.exe
.
**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-09-18 07:56:20
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-09-18 7:57:05
C:\ComboFix-quarantined-files.txt … 2007-08-09 11:55
C:\ComboFix2.txt … 2007-08-09 11:56
C:\ComboFix3.txt … 2007-08-09 08:11
.
— E O F —
Post #10
Sorry, too late to edit, just wanted to add something. There are several programs/folders in the combixfix log that have me confused, as I have uninstalled them (or so I thought). 2007-08-16 19:59 ——— d——– C:\Program Files\Common Files\Logitech 2007-08-16 19:43 ——— d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\PC Suite 2007-08-16 19:43 ——— d——– C:\DOCUME~1\ADMINI~1\APPLIC~1\Nokia 2007-08-16 19:42 ——— d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Installations 2007-08-15 11:14 ——— d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Downloaded Installations 2007-08-15 10:55 ——— d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Logitech 2007-08-15 10:55 ——— d——– C:\DOCUME~1\ADMINI~1\APPLIC~1\Logitech 2007-08-15 10:53 ——— d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kaspersky Lab 2007-08-10 12:12 ——— d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kaspersky Lab Setup Files I'm just wondering if there is any way to "clean" this stuff up as well?
Post #11
Open notepad and copy/paste the text in the quotebox below into it:

File::
C:\WINDOWS\system32\lsasss.exe
C:\winstall.exe
C:\WINDOWS\system32\7BUSUvlk.exe
C:\WINDOWS\system32\wr68qA20.exe

Folder::
C:\Program Files\Common Files\Logitech
C:\DOCUME~1\ALLUSE~1\APPLIC~1\PC Suite
C:\DOCUME~1\ADMINI~1\APPLIC~1\Nokia
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Installations
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Downloaded Installations
C:\DOCUME~1\ADMINI~1\APPLIC~1\Logitech
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kaspersky Lab

Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows installer]


Save this as Save this as "CFScript"


[external image: Posted Image]

Refering to the picture above, drag CFScript.txt into ComboFix.exe

Then post the results log
Post #12 last edited
Hi, thanks again for the help! Here is the log generated:

ComboFix 07-09-17.2 - "Administrator" 2007-09-19 7:06:17.6 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1212 [GMT 2:00]
Command switches used :: C:\Documents and Settings\Administrator\Desktop\cfscript.txt
* Created a new restore point

FILE::
C:\WINDOWS\system32\lsasss.exe
C:\winstall.exe
C:\WINDOWS\system32\7BUSUvlk.exe
C:\WINDOWS\system32\wr68qA20.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\DOCUME~1\ADMINI~1\APPLIC~1\Logitech
C:\DOCUME~1\ADMINI~1\APPLIC~1\Logitech\SetPoint\Last_user.xml
C:\DOCUME~1\ADMINI~1\APPLIC~1\Logitech\SetPoint\user.xml
C:\DOCUME~1\ADMINI~1\APPLIC~1\Nokia
C:\DOCUME~1\ADMINI~1\APPLIC~1\Nokia\GetConnectedWizard\Settings.xml
C:\DOCUME~1\ADMINI~1\APPLIC~1\Nokia\ImageStore\Settings.xml
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Downloaded Installations
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Installations
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Installations\{A982E6CC-9F0D-4948-9B18-BDFD55DE4A72}\Installations\CommonCustomActions\UninstCCD.exe
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Installations\{A982E6CC-9F0D-4948-9B18-BDFD55DE4A72}\Installations\CommonCustomActions\UninstPCS.exe
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Installations\{A982E6CC-9F0D-4948-9B18-BDFD55DE4A72}\Installations\CommonCustomActions\UninstPCSFEMsi.exe
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Installations\{A982E6CC-9F0D-4948-9B18-BDFD55DE4A72}\Installations\Nokia PC Suite\Nokia PC Suite.msi
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Installations\{A982E6CC-9F0D-4948-9B18-BDFD55DE4A72}\Installations\Nokia_Connectivity_Cable_Driver\Nokia_Connectivity_Cable_Driver.msi
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Installations\{A982E6CC-9F0D-4948-9B18-BDFD55DE4A72}\Installations\PCCS\PCCS.msi
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Installations\{A982E6CC-9F0D-4948-9B18-BDFD55DE4A72}\Nokia PC Suite.log
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Installations\{A982E6CC-9F0D-4948-9B18-BDFD55DE4A72}\Nokia_Connectivity_Cable_Driver.log
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Installations\{A982E6CC-9F0D-4948-9B18-BDFD55DE4A72}\Nokia_PC_Suite_6_84_10_3_eng_web[1].exe
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Installations\{A982E6CC-9F0D-4948-9B18-BDFD55DE4A72}\PCCS.log
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Installations\{A982E6CC-9F0D-4948-9B18-BDFD55DE4A72}\Resources\Eula\Licence_eng.rtf
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Installations\{A982E6CC-9F0D-4948-9B18-BDFD55DE4A72}\Third party copyright license and acknowledgement notices.txt
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kaspersky Lab
C:\DOCUME~1\ALLUSE~1\APPLIC~1\PC Suite
C:\Program Files\Common Files\Logitech
C:\Program Files\Common Files\Logitech\Bluetooth\BCM2045B.DRV
C:\Program Files\Common Files\Logitech\Bluetooth\btdfu.dll
C:\Program Files\Common Files\Logitech\Bluetooth\BtDfuMWizard.exe
C:\Program Files\Common Files\Logitech\Bluetooth\BtDfuMWizard.exe.manifest
C:\Program Files\Common Files\Logitech\Bluetooth\frmupgr.cat
C:\Program Files\Common Files\Logitech\Bluetooth\frmupgr.inf
C:\Program Files\Common Files\Logitech\Bluetooth\frmupgr.sys
C:\Program Files\Common Files\Logitech\Bluetooth\LBTSERV.EXE
C:\Program Files\Common Files\Logitech\Bluetooth\LBTServMsg.DLL
C:\Program Files\Common Files\Logitech\Bluetooth\LBTWlgn.DLL
C:\Program Files\Common Files\Logitech\Bluetooth\minidriveusb.bin
C:\Program Files\Common Files\Logitech\Bluetooth\RR4005_B0073.dfu
C:\Program Files\Common Files\Logitech\Bluetooth\RR5103_B0072.dfu
C:\Program Files\Common Files\Logitech\CDDRV\DPInst.exe
C:\Program Files\Common Files\Logitech\CDDRV\KHALMNPR.EXE
C:\Program Files\Common Files\Logitech\CDDRV\L8042Kbd.sys
C:\Program Files\Common Files\Logitech\CDDRV\L8042Mou.sys
C:\Program Files\Common Files\Logitech\CDDRV\LBeepKE.sys
C:\Program Files\Common Files\Logitech\CDDRV\lfhidhid.cat
C:\Program Files\Common Files\Logitech\CDDRV\LfHidHid.inf
C:\Program Files\Common Files\Logitech\CDDRV\lfhidusb.cat
C:\Program Files\Common Files\Logitech\CDDRV\LfHidUsb.inf
C:\Program Files\Common Files\Logitech\CDDRV\lfkbdhid.cat
C:\Program Files\Common Files\Logitech\CDDRV\LfKbdHid.inf
C:\Program Files\Common Files\Logitech\CDDRV\lfmouhid.cat
C:\Program Files\Common Files\Logitech\CDDRV\LfMouHid.inf
C:\Program Files\Common Files\Logitech\CDDRV\LHidFilt.sys
C:\Program Files\Common Files\Logitech\CDDRV\lkbdps2k.cat
C:\Program Files\Common Files\Logitech\CDDRV\LKbdPs2K.inf
C:\Program Files\Common Files\Logitech\CDDRV\LMouFilt.sys
C:\Program Files\Common Files\Logitech\CDDRV\LMouKE.sys
C:\Program Files\Common Files\Logitech\CDDRV\lmoups2k.cat
C:\Program Files\Common Files\Logitech\CDDRV\LMouPs2K.inf
C:\Program Files\Common Files\Logitech\CDDRV\lrcvbthk.cat
C:\Program Files\Common Files\Logitech\CDDRV\LUsbFilt.sys
C:\Program Files\Common Files\Logitech\CDDRV\WdfCoInstaller01005.dll
C:\Program Files\Common Files\Logitech\khalshared\device.ini
C:\Program Files\Common Files\Logitech\khalshared\KHALAPI.DLL
C:\Program Files\Common Files\Logitech\khalshared\KHALHID.dll
C:\Program Files\Common Files\Logitech\khalshared\KHALHPP.dll
C:\Program Files\Common Files\Logitech\khalshared\KhalInstaller.dll
C:\Program Files\Common Files\Logitech\khalshared\KHALITCH.dll
C:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.exe
C:\Program Files\Common Files\Logitech\khalshared\KHALMOU.dll
C:\Program Files\Common Files\Logitech\khalshared\KHALMW.dll
C:\Program Files\Common Files\Logitech\khalshared\KHALUSB.dll
C:\Program Files\Common Files\Logitech\WebColct\FireFox.lgm
C:\Program Files\Common Files\Logitech\WebColct\ie3.lgm
C:\Program Files\Common Files\Logitech\WebColct\ie4.lgm
C:\Program Files\Common Files\Logitech\WebColct\ie5.lgm
C:\Program Files\Common Files\Logitech\WebColct\ie6.lgm
C:\Program Files\Common Files\Logitech\WebColct\msn6.lgm
C:\Program Files\Common Files\Logitech\WebColct\neoplnet.lgm
C:\Program Files\Common Files\Logitech\WebColct\ns3.lgm
C:\Program Files\Common Files\Logitech\WebColct\ns4.lgm
C:\Program Files\Common Files\Logitech\WebColct\ns6.lgm
C:\Program Files\Common Files\Logitech\WebColct\opera.lgm

.
((((((((((((((((((((((((( Files Created from 2007-08-19 to 2007-09-19 )))))))))))))))))))))))))))))))
.

2007-09-15 14:43 10,872 –a—— C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-09-06 03:41 184,320 –a—— C:\WINDOWS\system32\KgOLK40M.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-09-19 07:07 ——— d——– C:\DOCUME~1\ADMINI~1\APPLIC~1\Azureus
2007-09-14 00:11 ——— d——– C:\Program Files\PartyGaming
2007-08-15 10:55 ——— d–h—– C:\Program Files\InstallShield Installation Information
2007-08-15 10:55 ——— d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Logitech
2007-08-10 12:12 ——— d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kaspersky Lab Setup Files
2007-08-09 09:33 ——— d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Office Genuine Advantage
2007-08-08 10:27 ——— d——– C:\Program Files\Enigma Software Group
2006-06-12 23:17 0 –a—— C:\DOCUME~1\ADMINI~1\llh.dll
2006-06-06 23:06 69632 –a—— C:\DOCUME~1\ADMINI~1\DM.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"JulaPan"="JulaPan.Exe" [2005-07-05 17:27 C:\WINDOWS\system32\JulaPan.exe]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-09-15 11:41]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 11:25]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=0 (0x0)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{93994DE8-8239-4655-B1D1-5F4E91300429}"= D:\Program Files\DVD Region+CSS Free\DVDShell.dll [2004-10-09 15:18 49152]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Administrator^Start Menu^Programs^Startup^Adobe Gamma Loader.exe]
path=C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\Adobe Gamma Loader.exe
backup=C:\WINDOWS\pss\Adobe Gamma Loader.exeStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Administrator^Start Menu^Programs^Startup^Adobe Gamma.lnk]
path=C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\Adobe Gamma.lnk
backup=C:\WINDOWS\pss\Adobe Gamma.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Administrator^Start Menu^Programs^Startup^HDD temperature.lnk]
path=C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\HDD temperature.lnk
backup=C:\WINDOWS\pss\HDD temperature.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Acrobat Speed Launcher.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Acrobat Speed Launcher.lnk
backup=C:\WINDOWS\pss\Adobe Acrobat Speed Launcher.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Acrobat Synchronizer.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Acrobat Synchronizer.lnk
backup=C:\WINDOWS\pss\Adobe Acrobat Synchronizer.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk
backup=C:\WINDOWS\pss\Adobe Reader Synchronizer.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^AutoCAD Startup Accelerator.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\AutoCAD Startup Accelerator.lnk
backup=C:\WINDOWS\pss\AutoCAD Startup Accelerator.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^BTTray.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\BTTray.lnk
backup=C:\WINDOWS\pss\BTTray.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^m-trip Launcher.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\m-trip Launcher.lnk
backup=C:\WINDOWS\pss\m-trip Launcher.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ABIT uGuru]
d:\Program Files\ABIT\ABIT uGuru\uGuru.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 7.0]
"D:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 8.0]
"C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
"C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
"C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]
"d:\Program Files\DAEMON Tools\daemon.exe" -lang 1033

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools-1033]
"D:\Program Files\D-Tools\daemon.exe" -lang 1033

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\gcasServ]
"C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GuruClock]
d:\Program Files\ABIT\ABIT uGuru\GuruClock.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H2O]
C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HDDHealth]
d:\Program Files\HDD Health\hddhealth.exe -wl

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Kernel and Hardware Abstraction Layer]
KHALMNPR.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Lexmark_X79-55]
C:\WINDOWS\system32\lsasss.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Hardware Abstraction Layer]
KHALMNPR.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Windows System Kernel]
kernel32.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
D:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -onlytray

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
SOUNDMAN.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
"C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr]
"D:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"PDSched"=2 (0x2)

R3 ipgd;IC Plus IP1000 Family Gigabit Ethernet Adapter Driver;C:\WINDOWS\system32\DRIVERS\ipgdnd51.sys
R3 JULA_01;Service for Juli@ 1;C:\WINDOWS\system32\drivers\JulaWdm.sys
R3 JULA_AA;Service for Juli@ Audio Driver (EWDM);C:\WINDOWS\system32\drivers\Jula.sys
R3 vsbus;Virtual Serial Bus Enumerator;C:\WINDOWS\system32\DRIVERS\vsb.sys
S3 vserial;ELTIMA Virtual Serial Ports Driver;C:\WINDOWS\system32\DRIVERS\vserial.sys

.
Contents of the 'Scheduled Tasks' folder
"2007-09-18 22:00:00 C:\WINDOWS\Tasks\At1.job"
- C:\WINDOWS\system32\7BUSUvlk.exe
"2007-09-18 07:00:00 C:\WINDOWS\Tasks\At10.job"
"2007-09-18 08:00:00 C:\WINDOWS\Tasks\At11.job"
"2007-09-18 09:00:00 C:\WINDOWS\Tasks\At12.job"
- C:\WINDOWS\system32\7BUSUvlk.exe
"2007-09-18 10:00:00 C:\WINDOWS\Tasks\At13.job"
- C:\WINDOWS\system32\7BUSUvlk.exe
"2007-09-18 11:00:00 C:\WINDOWS\Tasks\At14.job"
- C:\WINDOWS\system32\7BUSUvlk.exe
"2007-09-18 12:00:00 C:\WINDOWS\Tasks\At15.job"
- C:\WINDOWS\system32\7BUSUvlk.exe
"2007-09-18 13:00:00 C:\WINDOWS\Tasks\At16.job"
- C:\WINDOWS\system32\7BUSUvlk.exe
"2007-09-18 14:00:00 C:\WINDOWS\Tasks\At17.job"
- C:\WINDOWS\system32\7BUSUvlk.exe
"2007-09-18 15:00:00 C:\WINDOWS\Tasks\At18.job"
- C:\WINDOWS\system32\7BUSUvlk.exe
"2007-09-18 16:00:00 C:\WINDOWS\Tasks\At19.job"
- C:\WINDOWS\system32\7BUSUvlk.exe
"2007-09-18 23:00:00 C:\WINDOWS\Tasks\At2.job"
- C:\WINDOWS\system32\7BUSUvlk.exe
"2007-09-18 17:00:00 C:\WINDOWS\Tasks\At20.job"
- C:\WINDOWS\system32\7BUSUvlk.exe
"2007-09-18 18:00:00 C:\WINDOWS\Tasks\At21.job"
- C:\WINDOWS\system32\7BUSUvlk.exe
"2007-09-18 19:00:00 C:\WINDOWS\Tasks\At22.job"
- C:\WINDOWS\system32\7BUSUvlk.exe
"2007-09-18 20:00:00 C:\WINDOWS\Tasks\At23.job"
- C:\WINDOWS\system32\7BUSUvlk.exe
"2007-09-18 21:00:00 C:\WINDOWS\Tasks\At24.job"
- C:\WINDOWS\system32\7BUSUvlk.exe
"2007-09-18 22:00:00 C:\WINDOWS\Tasks\At25.job"
- C:\WINDOWS\system32\wr68qA20.exe
"2007-09-18 23:00:00 C:\WINDOWS\Tasks\At26.job"
- C:\WINDOWS\system32\wr68qA20.exe
"2007-09-19 00:00:00 C:\WINDOWS\Tasks\At27.job"
- C:\WINDOWS\system32\wr68qA20.exe
"2007-09-19 01:00:00 C:\WINDOWS\Tasks\At28.job"
- C:\WINDOWS\system32\wr68qA20.exe
"2007-09-19 02:00:00 C:\WINDOWS\Tasks\At29.job"
- C:\WINDOWS\system32\wr68qA20.exe
"2007-09-19 00:00:00 C:\WINDOWS\Tasks\At3.job"
- C:\WINDOWS\system32\7BUSUvlk.exe
"2007-09-19 03:00:00 C:\WINDOWS\Tasks\At30.job"
- C:\WINDOWS\system32\wr68qA20.exe
"2007-09-19 04:00:00 C:\WINDOWS\Tasks\At31.job"
- C:\WINDOWS\system32\wr68qA20.exe
"2007-09-19 05:00:00 C:\WINDOWS\Tasks\At32.job"
- C:\WINDOWS\system32\wr68qA20.exe
"2007-09-18 06:00:00 C:\WINDOWS\Tasks\At33.job"
- C:\WINDOWS\system32\wr68qA20.exe
"2007-09-18 07:00:00 C:\WINDOWS\Tasks\At34.job"
"2007-09-18 08:00:00 C:\WINDOWS\Tasks\At35.job"
"2007-09-18 09:00:00 C:\WINDOWS\Tasks\At36.job"
- C:\WINDOWS\system32\wr68qA20.exe
"2007-09-18 10:00:00 C:\WINDOWS\Tasks\At37.job"
- C:\WINDOWS\system32\wr68qA20.exe
"2007-09-18 11:00:00 C:\WINDOWS\Tasks\At38.job"
"2007-09-18 12:00:00 C:\WINDOWS\Tasks\At39.job"
- C:\WINDOWS\system32\wr68qA20.exe
"2007-09-19 01:00:00 C:\WINDOWS\Tasks\At4.job"
- C:\WINDOWS\system32\7BUSUvlk.exe
"2007-09-18 13:00:00 C:\WINDOWS\Tasks\At40.job"
- C:\WINDOWS\system32\wr68qA20.exe
"2007-09-18 14:00:00 C:\WINDOWS\Tasks\At41.job"
- C:\WINDOWS\system32\wr68qA20.exe
"2007-09-18 15:00:00 C:\WINDOWS\Tasks\At42.job"
- C:\WINDOWS\system32\wr68qA20.exe
"2007-09-18 16:00:00 C:\WINDOWS\Tasks\At43.job"
- C:\WINDOWS\system32\wr68qA20.exe
"2007-09-18 17:00:00 C:\WINDOWS\Tasks\At44.job"
- C:\WINDOWS\system32\wr68qA20.exe
"2007-09-18 18:00:00 C:\WINDOWS\Tasks\At45.job"
- C:\WINDOWS\system32\wr68qA20.exe
"2007-09-18 19:00:00 C:\WINDOWS\Tasks\At46.job"
"2007-09-18 20:00:00 C:\WINDOWS\Tasks\At47.job"
- C:\WINDOWS\system32\wr68qA20.exe
"2007-09-18 21:00:00 C:\WINDOWS\Tasks\At48.job"
- C:\WINDOWS\system32\wr68qA20.exe
"2007-09-19 02:00:00 C:\WINDOWS\Tasks\At5.job"
- C:\WINDOWS\system32\7BUSUvlk.exe
"2007-09-19 03:00:00 C:\WINDOWS\Tasks\At6.job"
- C:\WINDOWS\system32\7BUSUvlk.exe
"2007-09-19 04:00:00 C:\WINDOWS\Tasks\At7.job"
- C:\WINDOWS\system32\7BUSUvlk.exe
"2007-09-19 05:00:00 C:\WINDOWS\Tasks\At8.job"
- C:\WINDOWS\system32\7BUSUvlk.exe
"2007-09-18 06:00:00 C:\WINDOWS\Tasks\At9.job"
- C:\WINDOWS\system32\7BUSUvlk.exe
.
**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-09-19 07:09:08
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-09-19 7:09:55 - machine was rebooted
C:\ComboFix-quarantined-files.txt … 2007-09-19 07:09
C:\ComboFix2.txt … 2007-09-18 07:57
C:\ComboFix3.txt … 2007-08-09 11:56
.
— E O F —

————-

Also, here are the entries for programs that no longer are installed (maybe I need to run some kind of registry cleaning program?):

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Administrator^Start Menu^Programs^Startup^HDD temperature.lnk]
path=C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\HDD temperature.lnk
backup=C:\WINDOWS\pss\HDD temperature.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^BTTray.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\BTTray.lnk
backup=C:\WINDOWS\pss\BTTray.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^m-trip Launcher.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\m-trip Launcher.lnk
backup=C:\WINDOWS\pss\m-trip Launcher.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HDDHealth]
d:\Program Files\HDD Health\hddhealth.exe -wl

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Kernel and Hardware Abstraction Layer]
KHALMNPR.EXE

THIS ONE HAS ME CONCERNED
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Lexmark_X79-55]
C:\WINDOWS\system32\lsasss.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Hardware Abstraction Layer]
KHALMNPR.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
D:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -onlytray
Post #13
I thought killing the files would also kill the jobs but looks like I was wrong.

All those that show msconfig, looks like you unchecked them using msconfig. They aren't loading
so they aren't active, but we'll run a little program that should make them show-up in the HijackThis
log so we can kill them.

Open notepad and copy/paste the text in the quotebox below into it:

File::
C:\WINDOWS\Tasks\At1.job
C:\WINDOWS\system32\7BUSUvlk.exe
C:\WINDOWS\Tasks\At10.job
C:\WINDOWS\Tasks\At11.job
C:\WINDOWS\Tasks\At12.job
C:\WINDOWS\system32\7BUSUvlk.exe
C:\WINDOWS\Tasks\At13.job
C:\WINDOWS\system32\7BUSUvlk.exe
C:\WINDOWS\Tasks\At14.job
C:\WINDOWS\system32\7BUSUvlk.exe
C:\WINDOWS\Tasks\At15.job
C:\WINDOWS\system32\7BUSUvlk.exe
C:\WINDOWS\Tasks\At16.job
C:\WINDOWS\system32\7BUSUvlk.exe
C:\WINDOWS\Tasks\At17.job
C:\WINDOWS\system32\7BUSUvlk.exe
C:\WINDOWS\Tasks\At18.job
C:\WINDOWS\system32\7BUSUvlk.exe
C:\WINDOWS\Tasks\At19.job
C:\WINDOWS\system32\7BUSUvlk.exe
C:\WINDOWS\Tasks\At2.job
C:\WINDOWS\system32\7BUSUvlk.exe
C:\WINDOWS\Tasks\At20.job
C:\WINDOWS\system32\7BUSUvlk.exe
C:\WINDOWS\Tasks\At21.job
C:\WINDOWS\system32\7BUSUvlk.exe
C:\WINDOWS\Tasks\At22.job
C:\WINDOWS\system32\7BUSUvlk.exe
C:\WINDOWS\Tasks\At23.job
C:\WINDOWS\system32\7BUSUvlk.exe
C:\WINDOWS\Tasks\At24.job
C:\WINDOWS\system32\7BUSUvlk.exe
C:\WINDOWS\Tasks\At25.job
C:\WINDOWS\system32\wr68qA20.exe
C:\WINDOWS\Tasks\At26.job
C:\WINDOWS\system32\wr68qA20.exe
C:\WINDOWS\Tasks\At27.job
C:\WINDOWS\system32\wr68qA20.exe
C:\WINDOWS\Tasks\At28.job"
C:\WINDOWS\system32\wr68qA20.exe
C:\WINDOWS\Tasks\At29.job
C:\WINDOWS\system32\wr68qA20.exe
C:\WINDOWS\Tasks\At3.job
C:\WINDOWS\system32\7BUSUvlk.exe
C:\WINDOWS\Tasks\At30.job
C:\WINDOWS\system32\wr68qA20.exe
C:\WINDOWS\Tasks\At31.job
C:\WINDOWS\system32\wr68qA20.exe
C:\WINDOWS\Tasks\At32.job
C:\WINDOWS\system32\wr68qA20.exe
C:\WINDOWS\Tasks\At33.job
C:\WINDOWS\system32\wr68qA20.exe
C:\WINDOWS\Tasks\At34.job
C:\WINDOWS\Tasks\At35.job
C:\WINDOWS\Tasks\At36.job
C:\WINDOWS\system32\wr68qA20.exe
C:\WINDOWS\Tasks\At37.job
C:\WINDOWS\system32\wr68qA20.exe
C:\WINDOWS\Tasks\At38.job
C:\WINDOWS\Tasks\At39.job
C:\WINDOWS\system32\wr68qA20.exe
C:\WINDOWS\Tasks\At4.job
C:\WINDOWS\system32\7BUSUvlk.exe
C:\WINDOWS\Tasks\At40.job
C:\WINDOWS\system32\wr68qA20.exe
C:\WINDOWS\Tasks\At41.job
C:\WINDOWS\system32\wr68qA20.exe
C:\WINDOWS\Tasks\At42.job
C:\WINDOWS\system32\wr68qA20.exe
C:\WINDOWS\Tasks\At43.job
C:\WINDOWS\system32\wr68qA20.exe
C:\WINDOWS\Tasks\At44.job
C:\WINDOWS\system32\wr68qA20.exe
C:\WINDOWS\Tasks\At45.job
C:\WINDOWS\system32\wr68qA20.exe
C:\WINDOWS\Tasks\At46.job"
C:\WINDOWS\Tasks\At47.job"
C:\WINDOWS\system32\wr68qA20.exe
C:\WINDOWS\Tasks\At48.job
C:\WINDOWS\system32\wr68qA20.exe
C:\WINDOWS\Tasks\At5.job
C:\WINDOWS\system32\7BUSUvlk.exe
C:\WINDOWS\Tasks\At6.job
C:\WINDOWS\system32\7BUSUvlk.exe
C:\WINDOWS\Tasks\At7.job
C:\WINDOWS\system32\7BUSUvlk.exe
C:\WINDOWS\Tasks\At8.job
C:\WINDOWS\system32\7BUSUvlk.exe
C:\WINDOWS\Tasks\At9.job


Save this as Save this as "CFScript"


[external image: Posted Image]

Refering to the picture above, drag CFScript.txt into ComboFix.exe

Then post the results log


Next:

Please download SRENG

1. Extract it to Desktop & double click SREng.exe to run it

2. Select 'Smart Scan' & tick "Verify Digital Signatures"

3. Click on the [Scan] button

4. When finished, click on the [Save Reports] button & save the log to Desktop

5. Post the log on your next reply.

Also post a new HijackThis log.
Post #14
Two most recent logs. There was some syntax errors while ComboFix was running (it said that it couldn't complete some operations due to command syntaxes or something similar).

ComboFix 07-09-17.2 - "Administrator" 2007-09-20 8:03:02.8 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1657 [GMT 2:00]
Command switches used :: C:\Documents and Settings\Administrator\Desktop\cfscript.txt
* Created a new restore point

FILE::
C:\WINDOWS\Tasks\At1.job
C:\WINDOWS\system32\7BUSUvlk.exe
C:\WINDOWS\Tasks\At10.job
C:\WINDOWS\Tasks\At11.job
C:\WINDOWS\Tasks\At12.job
C:\WINDOWS\Tasks\At13.job
C:\WINDOWS\Tasks\At14.job
C:\WINDOWS\Tasks\At15.job
C:\WINDOWS\Tasks\At16.job
C:\WINDOWS\Tasks\At17.job
C:\WINDOWS\Tasks\At18.job
C:\WINDOWS\Tasks\At19.job
C:\WINDOWS\Tasks\At2.job
C:\WINDOWS\Tasks\At20.job
C:\WINDOWS\Tasks\At21.job
C:\WINDOWS\Tasks\At22.job
C:\WINDOWS\Tasks\At23.job
C:\WINDOWS\Tasks\At24.job
C:\WINDOWS\Tasks\At25.job
C:\WINDOWS\system32\wr68qA20.exe
C:\WINDOWS\Tasks\At26.job
C:\WINDOWS\Tasks\At27.job
C:\WINDOWS\Tasks\At28.job"
C:\WINDOWS\Tasks\At29.job
C:\WINDOWS\Tasks\At3.job
C:\WINDOWS\Tasks\At30.job
C:\WINDOWS\Tasks\At31.job
C:\WINDOWS\Tasks\At32.job
C:\WINDOWS\Tasks\At33.job
C:\WINDOWS\Tasks\At34.job
C:\WINDOWS\Tasks\At35.job
C:\WINDOWS\Tasks\At36.job
C:\WINDOWS\Tasks\At37.job
C:\WINDOWS\Tasks\At38.job
C:\WINDOWS\Tasks\At39.job
C:\WINDOWS\Tasks\At4.job
C:\WINDOWS\Tasks\At40.job
C:\WINDOWS\Tasks\At41.job
C:\WINDOWS\Tasks\At42.job
C:\WINDOWS\Tasks\At43.job
C:\WINDOWS\Tasks\At44.job
C:\WINDOWS\Tasks\At45.job
C:\WINDOWS\Tasks\At46.job"
C:\WINDOWS\Tasks\At47.job"
C:\WINDOWS\Tasks\At48.job
C:\WINDOWS\Tasks\At5.job
C:\WINDOWS\Tasks\At6.job
C:\WINDOWS\Tasks\At7.job
C:\WINDOWS\Tasks\At8.job
C:\WINDOWS\Tasks\At9.job
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\Tasks\At28.job . . . . failed to delete
C:\WINDOWS\Tasks\At46.job . . . . failed to delete
C:\WINDOWS\Tasks\At47.job . . . . failed to delete

.
((((((((((((((((((((((((( Files Created from 2007-08-20 to 2007-09-20 )))))))))))))))))))))))))))))))
.

2007-09-15 14:43 10,872 –a—— C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-09-06 03:41 184,320 –a—— C:\WINDOWS\system32\KgOLK40M.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-09-20 07:53 ——— d——– C:\DOCUME~1\ADMINI~1\APPLIC~1\Azureus
2007-09-14 00:11 ——— d——– C:\Program Files\PartyGaming
2007-08-15 10:55 ——— d–h—– C:\Program Files\InstallShield Installation Information
2007-08-15 10:55 ——— d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Logitech
2007-08-10 12:12 ——— d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kaspersky Lab Setup Files
2007-08-09 09:33 ——— d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Office Genuine Advantage
2007-08-08 10:27 ——— d——– C:\Program Files\Enigma Software Group
2006-06-12 23:17 0 –a—— C:\DOCUME~1\ADMINI~1\llh.dll
2006-06-06 23:06 69632 –a—— C:\DOCUME~1\ADMINI~1\DM.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"JulaPan"="JulaPan.Exe" [2005-07-05 17:27 C:\WINDOWS\system32\JulaPan.exe]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-09-15 11:41]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 11:25]
"ABIT uGuru"="d:\Program Files\ABIT\ABIT uGuru\uGuru.exe" []
"Acrobat Assistant 7.0"="D:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" []
"Acrobat Assistant 8.0"="C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" []
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" []
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" []
"DAEMON Tools"="d:\Program Files\DAEMON Tools\daemon.exe" [2005-12-10 16:57]
"DAEMON Tools-1033"="D:\Program Files\D-Tools\daemon.exe" []
"gcasServ"="C:\Program Files\Microsoft AntiSpyware\gcasServ.exe" []
"GuruClock"="d:\Program Files\ABIT\ABIT uGuru\GuruClock.exe" []
"H2O"="C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe" []
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" []
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" []
"Microsoft Windows System Kernel"="kernel32.exe" []
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50]
"PCSuiteTrayApplication"="D:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.exe" []
"SoundMan"="SOUNDMAN.EXE" [2005-01-10 04:36 C:\WINDOWS\SOUNDMAN.EXE]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HDDHealth"="d:\Program Files\HDD Health\hddhealth.exe" []
"updateMgr"="D:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" []

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=0 (0x0)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{93994DE8-8239-4655-B1D1-5F4E91300429}"= D:\Program Files\DVD Region+CSS Free\DVDShell.dll [2004-10-09 15:18 49152]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Administrator^Start Menu^Programs^Startup^Adobe Gamma Loader.exe]
path=C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\Adobe Gamma Loader.exe
backup=C:\WINDOWS\pss\Adobe Gamma Loader.exeStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Administrator^Start Menu^Programs^Startup^Adobe Gamma.lnk]
path=C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\Adobe Gamma.lnk
backup=C:\WINDOWS\pss\Adobe Gamma.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Administrator^Start Menu^Programs^Startup^HDD temperature.lnk]
path=C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\HDD temperature.lnk
backup=C:\WINDOWS\pss\HDD temperature.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Acrobat Speed Launcher.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Acrobat Speed Launcher.lnk
backup=C:\WINDOWS\pss\Adobe Acrobat Speed Launcher.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Acrobat Synchronizer.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Acrobat Synchronizer.lnk
backup=C:\WINDOWS\pss\Adobe Acrobat Synchronizer.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk
backup=C:\WINDOWS\pss\Adobe Reader Synchronizer.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^AutoCAD Startup Accelerator.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\AutoCAD Startup Accelerator.lnk
backup=C:\WINDOWS\pss\AutoCAD Startup Accelerator.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^BTTray.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\BTTray.lnk
backup=C:\WINDOWS\pss\BTTray.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^m-trip Launcher.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\m-trip Launcher.lnk
backup=C:\WINDOWS\pss\m-trip Launcher.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"PDSched"=2 (0x2)

R3 ipgd;IC Plus IP1000 Family Gigabit Ethernet Adapter Driver;C:\WINDOWS\system32\DRIVERS\ipgdnd51.sys
R3 JULA_01;Service for Juli@ 1;C:\WINDOWS\system32\drivers\JulaWdm.sys
R3 JULA_AA;Service for Juli@ Audio Driver (EWDM);C:\WINDOWS\system32\drivers\Jula.sys
R3 vsbus;Virtual Serial Bus Enumerator;C:\WINDOWS\system32\DRIVERS\vsb.sys
S3 vserial;ELTIMA Virtual Serial Ports Driver;C:\WINDOWS\system32\DRIVERS\vserial.sys

.
Contents of the 'Scheduled Tasks' folder
"2007-09-20 01:00:00 C:\WINDOWS\Tasks\At28.job"
- C:\WINDOWS\system32\wr68qA20.exe
"2007-09-19 19:00:00 C:\WINDOWS\Tasks\At46.job"
"2007-09-19 20:00:00 C:\WINDOWS\Tasks\At47.job"
- C:\WINDOWS\system32\wr68qA20.exe
.
**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-09-20 08:05:17
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-09-20 8:06:16 - machine was rebooted
C:\ComboFix-quarantined-files.txt … 2007-09-20 08:05
C:\ComboFix2.txt … 2007-09-19 07:09
C:\ComboFix3.txt … 2007-09-18 07:57
.
— E O F —


Have to attach the other log as it is too large to post.

Thank you.

Attachments:

Post #15
Open notepad and copy/paste the text in the quotebox below into it:

File::
C:\WINDOWS\Tasks\At28.job
C:\WINDOWS\Tasks\At46.job
C:\WINDOWS\Tasks\At47.job
C:\WINDOWS\system32\wr68qA20.exe


Save this as Save this as "CFScript"


[external image: Posted Image]

Refering to the picture above, drag CFScript.txt into ComboFix.exe

Then post the results log


"copy/paste" a new HijackThis log file into this thread.

Also please describe how your computer behaves at the moment.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI