What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Web Page Redirection And Pop-ups

7 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
i've done a hijack this log and am hoping for some help and here is some of my system info.



— PROBLEM —
'c:\WINNT\system32\drivers\detect.htm'. Make sure the path or internet address is correct.


— SYSTEM INFORMATION —
OS Name Microsoft Windows XP Home Edition
Version 5.1.2600 Service Pack 2 Build 2600
System Manufacturer Gateway
System Model E-4000
System Type X86-based PC
Processor x86 Family 15 Model 2 Stepping 7 GenuineIntel ~2399 Mhz


— IE Security settings —
My Computer Custom
Local intranet Medium-low
Trusted sites Medium
Internet Not Available
Restricted sites High
AOL Objects Custom


——————————— Logfile of HijackThis v1.99.1 ———————————
Scan saved at 2:08:36 PM, on 9/14/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\Explorer.EXE
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Common Files\AOL\1189613138\ee\AOLSoftware.exe
C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINNT\System32\NMSSvc.exe
C:\Program Files\Common Files\Lanovation\PrismXL\PRISMXL.SYS
C:\WINNT\wanmpsvc.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/home.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gateway.net
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
R3 - URLSearchHook: &Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: (no name) - {029e02f0-a0e5-4b19-b958-7bf2db29fb13} - (no file)
O2 - BHO: (no name) - {03770B87-7AC8-4862-9970-5BB7D5A59773} - C:\WINNT\system32\werweg.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: oembios32.msdn_hlp - {0B1C644A-E692-4413-A9C5-FE2EB9E4AA74} - C:\WINNT\System32\oembios32.dll
O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dll
O2 - BHO: (no name) - {2d7cb618-cc1c-4126-a7e3-f5b12d3bcf71} - (no file)
O2 - BHO: (no name) - {51641ef3-8a7a-4d84-8659-b0911e947cc8} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {54645654-2225-4455-44A1-9F4543D34546} - (no file)
O2 - BHO: (no name) - {6abc861a-31e7-4d91-b43b-d3c98f22a5c0} - (no file)
O2 - BHO: (no name) - {a4a435cf-3583-11d4-91bd-0048546a1450} - (no file)
O2 - BHO: (no name) - {BDF3E430-B101-42AD-A544-FADC6B084872} - (no file)
O2 - BHO: (no name) - {c2680e10-1655-4a0e-87f8-4259325a84b7} - (no file)
O2 - BHO: (no name) - {c4ca6559-2cf1-48b6-96b2-8340a06fd129} - (no file)
O2 - BHO: (no name) - {d8efadf1-9009-11d6-8c73-608c5dc19089} - (no file)
O2 - BHO: (no name) - {e9147a0a-a866-4214-b47c-da821891240f} - (no file)
O2 - BHO: (no name) - {e9306072-417e-43e3-81d5-369490beef7c} - (no file)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1189613138\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [SpyHunter] C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter.exe
O4 - HKLM\..\RunOnce: [OOBEDDDemise] cmd /x /c erase C:\WINNT\System32\oobe\msoobe.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINNT\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.aol.com
O16 - DPF: {2DFF31F9-7893-4922-AF66-C9A1EB4EBB31} (Rhapsody Player Engine) - http://forms.real.com/real/player/download…ne_Inst_Win.cab
O16 - DPF: {8C875948-9C60-4381-9248-0DF180542D53} - http://installs.spamblockerutility.com/ins…ckerutility.cab
O20 - AppInit_DLLs: c:\winnt\system32\ddayyvv.dll
O20 - Winlogon Notify: igfxcui - C:\WINNT\
O20 - Winlogon Notify: mgmdir - mgmdir.dll (file missing)
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Intel® NMS (NMSSvc) - Intel Corporation - C:\WINNT\System32\NMSSvc.exe
O23 - Service: PrismXL - Lanovation - C:\Program Files\Common Files\Lanovation\PrismXL\PRISMXL.SYS
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINNT\wanmpsvc.exe
Post #2
Hi! Welcome to the Tom Coyote forums.
My name is Scotty. I would be glad to take a look at your log and help you with solving any malware problems. HijackThis logs can take a while to research.
Please be patient and I'd be grateful if you would note the following:
  • I will working be on your Malware issues, this may or may not, solve other issues you have with your machine.
  • The fixes are specific to your problem and should only be used for this issue on this machine.
  • Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
  • It's often worth reading through these instructions and printing them for ease of reference.
  • If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
  • Please reply to this thread. Do not start a new topic.

Please make a uninstall list using HijackThis
To access the Uninstall Manager you would do the following:

1. Start HijackThis
2. Click on the Config button
3. Click on the Misc Tools button
4. Click on the Open Uninstall Manager button.
5. Click on the Save list… button and specify where you would like to save this file. When you press Save button a notepad will open with the contents of that file. Simply copy and paste the contents of that notepad here in a reply.


Please download VundoFix.exe to your desktop.
  • Double-click VundoFix.exe to run it.
  • Click the Scan for Vundo button.
  • Once it's done scanning, click the Remove Vundo button.
  • You will receive a prompt asking if you want to remove the files, click YES
  • Once you click yes, your desktop will go blank as it starts removing Vundo.
  • When completed, it will prompt that it will reboot your computer, click OK.
  • Please post the contents of C:\vundofix.txt and a new HiJackThis log.
Note: It is possible that VundoFix encountered a file it could not remove.
In this case, VundoFix will run on reboot, simply follow the above instructions starting from "Click the Scan for Vundo button." when VundoFix appears at reboot.
Post #4
Hi

Download and Run ComboFix
  • Download this file from below:

    Here
  • Disconnect from the Internet, than disable your anti-virus and any real-time anti-spyware monitors that are running.
  • Then double click combofix.exe & follow the prompts.
  • When finished, it shall produce a log for you. Post that log in your next reply with a new HijackThis log.
Note 1: Do not mouseclick combofix's window whilst it's running. That may cause it to stall
Note 2:Remember to re-enable your anti-virus and anti-spyware before reconnecting to the Internet.
Post #7
the following contains…

—————– ComboFix.txt —————–

—————– ComboFix-quarantined-files.txt —————–




—————– ComboFix.txt —————–


2007-01-28 09:51	  487	–a——	C:\Qoobox\Quarantine\C\Redemption.ECF.vir
2007-06-02 12:05	  97280	–a——	C:\Qoobox\Quarantine\C\WINNT\monterreyi_unknown.exe.vir
2007-06-02 12:05	  97280	–a——	C:\Qoobox\Quarantine\C\WINNT\system32\monterreyi_unknown.exe.vir
2007-06-03 14:40	  97280	–a——	C:\Qoobox\Quarantine\C\WINNT\monterreyj_unknown.exe.vir
2007-06-05 21:17	  97280	–a——	C:\Qoobox\Quarantine\C\WINNT\system32\monterreyj_unknown.exe.vir
2007-06-29 18:25	  152064	–a——	C:\Qoobox\Quarantine\C\WINNT\system32\drivero.dll.vir
2007-06-29 18:25	  97280	–a——	C:\Qoobox\Quarantine\C\WINNT\system32\monterreyo_unknown.exe.vir
2007-07-01 19:02	  152064	–a——	C:\Qoobox\Quarantine\C\WINNT\system32\reginix86a.dll.vir
2007-07-01 19:02	  97280	–a——	C:\Qoobox\Quarantine\C\WINNT\system32\reginia_unknown.exe.vir
2007-07-07 20:14	  152064	–a——	C:\Qoobox\Quarantine\C\WINNT\system32\reginix86b.dll.vir
2007-07-08 21:23	  15399	–a——	C:\Qoobox\Quarantine\C\ComboFix\FProps.vbs.vir
2007-07-10 20:11	  97280	–a——	C:\Qoobox\Quarantine\C\WINNT\system32\reginid_unknown.exe.vir
2007-07-15 12:43	  151552	–a——	C:\Qoobox\Quarantine\C\WINNT\system32\reginix86e.dll.vir
2007-07-15 12:43	  97280	–a——	C:\Qoobox\Quarantine\C\WINNT\system32\reginie_unknown.exe.vir
2007-07-19 19:58	  97280	–a——	C:\Qoobox\Quarantine\C\WINNT\system32\reginif_unknown.exe.vir
2007-07-28 12:19	  97280	–a——	C:\Qoobox\Quarantine\C\WINNT\system32\reginig_unknown.exe.vir
2007-08-26 15:52	  1014	–a——	C:\Qoobox\Quarantine\C\WINNT\system32\drivers\yellow_warning_ico.gif.vir
2007-08-26 15:52	  10193	–a——	C:\Qoobox\Quarantine\C\WINNT\system32\drivers\header_3.gif.vir
2007-08-26 15:52	  10260	–a——	C:\Qoobox\Quarantine\C\WINNT\system32\drivers\perfect_cleaner_box.jpg.vir
2007-08-26 15:52	  11077	–a——	C:\Qoobox\Quarantine\C\WINNT\system32\drivers\header_4.gif.vir
2007-08-26 15:52	  11927	–a——	C:\Qoobox\Quarantine\C\WINNT\system32\drivers\box_2.gif.vir
2007-08-26 15:52	  1204	–a——	C:\Qoobox\Quarantine\C\WINNT\system32\drivers\infected.gif.vir
2007-08-26 15:52	  12313	–a——	C:\Qoobox\Quarantine\C\WINNT\system32\drivers\box_1.gif.vir
2007-08-26 15:52	  12326	–a——	C:\Qoobox\Quarantine\C\WINNT\system32\drivers\box_3.gif.vir
2007-08-26 15:52	  1253	–a——	C:\Qoobox\Quarantine\C\WINNT\system32\drivers\product_1_name_small.gif.vir
2007-08-26 15:52	  1342	–a——	C:\Qoobox\Quarantine\C\WINNT\system32\drivers\cell_bg.gif.vir
2007-08-26 15:52	  1373	–a——	C:\Qoobox\Quarantine\C\WINNT\system32\drivers\cell_footer.gif.vir
2007-08-26 15:52	  1381	–a——	C:\Qoobox\Quarantine\C\WINNT\system32\drivers\warning_ico.gif.vir
2007-08-26 15:52	  15421	–a——	C:\Qoobox\Quarantine\C\WINNT\system32\drivers\header_2.gif.vir
2007-08-26 15:52	  1619	–a——	C:\Qoobox\Quarantine\C\WINNT\system32\drivers\button_buynow.gif.vir
2007-08-26 15:52	  1647	–a——	C:\Qoobox\Quarantine\C\WINNT\system32\drivers\button_freescan.gif.vir
2007-08-26 15:52	  16941	–a——	C:\Qoobox\Quarantine\C\WINNT\system32\drivers\icon_warning_big.gif.vir
2007-08-26 15:52	  16977	–a——	C:\Qoobox\Quarantine\C\WINNT\system32\drivers\header_red_protect_your_pc.gif.vir
2007-08-26 15:52	  1743	–a——	C:\Qoobox\Quarantine\C\WINNT\system32\drivers\remove_spyware_header.gif.vir
2007-08-26 15:52	  215	–a——	C:\Qoobox\Quarantine\C\WINNT\system32\drivers\main_back.gif.vir
2007-08-26 15:52	  2214	–a——	C:\Qoobox\Quarantine\C\WINNT\system32\drivers\product_2_header.gif.vir
2007-08-26 15:52	  2238	–a——	C:\Qoobox\Quarantine\C\WINNT\system32\drivers\download_box.gif.vir
2007-08-26 15:52	  2604	–a——	C:\Qoobox\Quarantine\C\WINNT\system32\drivers\product_1_header.gif.vir
2007-08-26 15:52	  26487	–a——	C:\Qoobox\Quarantine\C\WINNT\system32\drivers\screenshot.jpg.vir
2007-08-26 15:52	  28459	–a——	C:\Qoobox\Quarantine\C\WINNT\system32\drivers\header_1.gif.vir
2007-08-26 15:52	  2922	–a——	C:\Qoobox\Quarantine\C\WINNT\system32\drivers\footer_back.jpg.vir
2007-08-26 15:52	  3031	–a——	C:\Qoobox\Quarantine\C\WINNT\system32\drivers\spyware_detected.gif.vir
2007-08-26 15:52	  3216	–a——	C:\Qoobox\Quarantine\C\WINNT\system32\drivers\header_red_free_scan.gif.vir
2007-08-26 15:52	  3313	–a——	C:\Qoobox\Quarantine\C\WINNT\system32\drivers\cell_header_block.gif.vir
2007-08-26 15:52	  3479	–a——	C:\Qoobox\Quarantine\C\WINNT\system32\drivers\cell_header_scan.gif.vir
2007-08-26 15:52	  3552	–a——	C:\Qoobox\Quarantine\C\WINNT\system32\drivers\cell_header_remove.gif.vir
2007-08-26 15:52	  4008	–a——	C:\Qoobox\Quarantine\C\WINNT\system32\drivers\rating.gif.vir
2007-08-26 15:52	  4448	–a——	C:\Qoobox\Quarantine\C\WINNT\system32\drivers\download_now_btn.gif.vir
2007-08-26 15:52	  64	–a——	C:\Qoobox\Quarantine\C\WINNT\system32\drivers\close_ico.gif.vir
2007-08-26 15:52	  72	–a——	C:\Qoobox\Quarantine\C\WINNT\system32\drivers\bg_bg.gif.vir
2007-08-26 15:52	  821	–a——	C:\Qoobox\Quarantine\C\WINNT\system32\drivers\shadow_bg.gif.vir
2007-08-26 15:52	  835	–a——	C:\Qoobox\Quarantine\C\WINNT\system32\drivers\style.css.vir
2007-08-26 15:52	  837	–a——	C:\Qoobox\Quarantine\C\WINNT\system32\drivers\blank.gif.vir
2007-08-26 15:52	  838	–a——	C:\Qoobox\Quarantine\C\WINNT\system32\drivers\header_red_free_scan_bg.gif.vir
2007-08-26 15:52	  877	–a——	C:\Qoobox\Quarantine\C\WINNT\system32\drivers\header_red_bg.gif.vir
2007-08-26 15:52	  8852	–a——	C:\Qoobox\Quarantine\C\WINNT\system32\drivers\download_btn.jpg.vir
2007-08-26 15:52	  979	–a——	C:\Qoobox\Quarantine\C\WINNT\system32\drivers\product_2_name_small.gif.vir
2007-08-26 15:53	  124685	–a——	C:\Qoobox\Quarantine\C\DOCUME~1\Owner\APPLIC~1\tmp260.tmp.exe.vir
2007-08-26 15:53	  131465	–a——	C:\Qoobox\Quarantine\C\WINNT\effffc.dll.vir
2007-08-26 15:53	  1330	–a——	C:\Qoobox\Quarantine\C\WINNT\system32\drivers\product_features.gif.vir
2007-08-26 15:53	  13618	–a——	C:\Qoobox\Quarantine\C\WINNT\system32\drivers\spy_away_box.jpg.vir
2007-08-26 15:53	  1714	–a——	C:\Qoobox\Quarantine\C\WINNT\system32\drivers\product_3_name_small.gif.vir
2007-08-26 15:53	  1791	–a——	C:\Qoobox\Quarantine\C\WINNT\system32\drivers\win_logo.gif.vir
2007-08-26 15:53	  223	–a——	C:\Qoobox\Quarantine\C\WINNT\system32\drivers\star_gray_small.gif.vir
2007-08-26 15:53	  2798	–a——	C:\Qoobox\Quarantine\C\WINNT\system32\drivers\shadow.jpg.vir
2007-08-26 15:53	  283	–a——	C:\Qoobox\Quarantine\C\WINNT\system32\drivers\x.gif.vir
2007-08-26 15:53	  291	–a——	C:\Qoobox\Quarantine\C\WINNT\system32\drivers\v.gif.vir
2007-08-26 15:53	  3080	–a——	C:\Qoobox\Quarantine\C\WINNT\system32\drivers\product_3_header.gif.vir
2007-08-26 15:53	  3877	–a——	C:\Qoobox\Quarantine\C\WINNT\system32\drivers\warning_icon.gif.vir
2007-08-26 15:53	  425	–a——	C:\Qoobox\Quarantine\C\WINNT\system32\drivers\star_gray.gif.vir
2007-08-26 15:53	  49	–a——	C:\Qoobox\Quarantine\C\WINNT\system32\drivers\spacer.gif.vir
2007-08-26 15:53	  53	–a——	C:\Qoobox\Quarantine\C\WINNT\system32\drivers\sep_vert.gif.vir
2007-08-26 15:53	  550	–a——	C:\Qoobox\Quarantine\C\WINNT\system32\drivers\star_small.gif.vir
2007-08-26 15:53	  639	–a——	C:\Qoobox\Quarantine\C\WINNT\system32\drivers\star.gif.vir
2007-08-26 15:53	  65	–a——	C:\Qoobox\Quarantine\C\WINNT\system32\drivers\sep_hor.gif.vir
2007-08-26 15:53	  79635	–a——	C:\Qoobox\Quarantine\C\DOCUME~1\Owner\APPLIC~1\tmp263.tmp.exe.vir
2007-08-26 16:13	  10240	–a——	C:\Qoobox\Quarantine\C\Program Files\akl\akl.exe.vir
2007-08-26 16:13	  13312	–a——	C:\Qoobox\Quarantine\C\Program Files\p2pnetworks\amp2pl.exe.vir
2007-08-26 16:13	  14080	–a——	C:\Qoobox\Quarantine\C\Program Files\akl\unsetup.exe.vir
2007-08-26 16:13	  15616	–a——	C:\Qoobox\Quarantine\C\Program Files\akl\akl.dll.vir
2007-08-26 16:13	  17408	–a——	C:\Qoobox\Quarantine\C\Program Files\akl\uninstall.exe.vir
2007-08-26 16:13	  18688	–a——	C:\Qoobox\Quarantine\C\WINNT\xxxvideo.exe.vir
2007-08-26 16:13	  18944	–a——	C:\Qoobox\Quarantine\C\WINNT\hotporn.exe.vir
2007-08-26 16:13	  18944	–a——	C:\Qoobox\Quarantine\C\WINNT\ie_32.exe.vir
2007-08-26 16:13	  22528	–a——	C:\Qoobox\Quarantine\C\WINNT\aconti.exe.vir
2007-08-26 16:13	  23040	–a——	C:\Qoobox\Quarantine\C\Program Files\akl\unsetup.dat.vir
2007-08-26 16:13	  23296	–a——	C:\Qoobox\Quarantine\C\WINNT\dp0.dll.vir
2007-08-26 16:13	  23552	–a——	C:\Qoobox\Quarantine\C\Program Files\akl\curlog.htm.vir
2007-08-26 16:13	  23552	–a——	C:\Qoobox\Quarantine\C\Program Files\akl\readme.txt.vir
2007-08-26 16:13	  25088	–a——	C:\Qoobox\Quarantine\C\Program Files\akl\keylog.txt.vir
2007-08-26 16:13	  25600	–a——	C:\Qoobox\Quarantine\C\WINNT\flt.dll.vir
2007-08-26 16:13	  25600	–a——	C:\Qoobox\Quarantine\C\WINNT\ngd.dll.vir
2007-08-26 16:13	  28672	–a——	C:\Qoobox\Quarantine\C\Program Files\amsys\mfc42.dll.vir
2007-08-26 16:13	  32256	–a——	C:\Qoobox\Quarantine\C\WINNT\pbar.dll.vir
2007-08-26 16:14	  10496	–a——	C:\Qoobox\Quarantine\C\Program Files\amsys\unis000.exe.vir
2007-08-26 16:14	  11520	–a——	C:\Qoobox\Quarantine\C\WINNT\kkcomp$.exe.vir
2007-08-26 16:14	  11776	–a——	C:\Qoobox\Quarantine\C\Program Files\amsys\winam.dat.vir
2007-08-26 16:14	  12032	–a——	C:\Qoobox\Quarantine\C\WINNT\spredirect.dll.vir
2007-08-26 16:14	  12544	–a——	C:\Qoobox\Quarantine\C\WINNT\liqad$.exe.vir
2007-08-26 16:14	  13312	–a——	C:\Qoobox\Quarantine\C\WINNT\adbar.dll.vir
2007-08-26 16:14	  13312	–a——	C:\Qoobox\Quarantine\C\WINNT\system32\msole32.exe.vir
2007-08-26 16:14	  17408	–a——	C:\Qoobox\Quarantine\C\WINNT\fhfmm-Uninstaller.exe.vir
2007-08-26 16:14	  18944	–a——	C:\Qoobox\Quarantine\C\Program Files\amsys\msvcrt.dll.vir
2007-08-26 16:14	  19200	–a——	C:\Qoobox\Quarantine\C\WINNT\xadbrk_.exe.vir
2007-08-26 16:14	  20224	–a——	C:\Qoobox\Quarantine\C\WINNT\liqui-Uninstaller.exe.vir
2007-08-26 16:14	  22784	–a——	C:\Qoobox\Quarantine\C\Program Files\amsys\unins000.dat.vir
2007-08-26 16:14	  23552	–a——	C:\Qoobox\Quarantine\C\WINNT\xadbrk.exe.vir
2007-08-26 16:14	  24576	–a——	C:\Qoobox\Quarantine\C\WINNT\cbinst$.exe.vir
2007-08-26 16:14	  25856	–a——	C:\Qoobox\Quarantine\C\WINNT\kkcomp.exe.vir
2007-08-26 16:14	  26368	–a——	C:\Qoobox\Quarantine\C\WINNT\liqad.exe.vir
2007-08-26 16:14	  27648	–a——	C:\Qoobox\Quarantine\C\WINNT\eventlowg.dll.vir
2007-08-26 16:14	  27648	–a——	C:\Qoobox\Quarantine\C\WINNT\system32\ESHOPEE.exe.vir
2007-08-26 16:14	  28928	–a——	C:\Qoobox\Quarantine\C\WINNT\liqui.exe.vir
2007-08-26 16:14	  30208	–a——	C:\Qoobox\Quarantine\C\Program Files\e-zshopper\BarLcher.dll.vir
2007-08-26 16:14	  30720	–a——	C:\Qoobox\Quarantine\C\WINNT\daxtime.dll.vir
2007-08-26 16:14	  32768	–a——	C:\Qoobox\Quarantine\C\WINNT\jd2002.dll.vir
2007-08-26 16:14	  8704	–a——	C:\Qoobox\Quarantine\C\WINNT\fhfmm.exe.vir
2007-08-27 00:00	  12	–a——	C:\Qoobox\Quarantine\C\WINNT\system32\gtv_sd.bin.vir
2007-09-11 13:52	  1292257	–a——	C:\Qoobox\Quarantine\C\WINNT\cffffe.ini.vir
2007-09-11 13:53	  6688	–a——	C:\Qoobox\Quarantine\C\WINNT\new_drv.sys.vir
2007-09-11 14:13	  131375	–a——	C:\Qoobox\Quarantine\C\WINNT\rqpmml.dll.vir
2007-09-11 14:13	  2140	–a——	C:\Qoobox\Quarantine\C\WINNT\cookies.ini.vir
2007-09-11 14:14	  65536	–a——	C:\Qoobox\Quarantine\C\WINNT\system32\tmp1F.tmp.dll.vir
2007-09-11 14:14	  84992	–a——	C:\Qoobox\Quarantine\C\DOCUME~1\Owner\APPLIC~1\tmp1F.tmp.exe.vir
2007-09-11 14:16	  686633	–a——	C:\Qoobox\Quarantine\C\WINNT\lmmpqr.ini.vir
2007-09-18 09:56	  16384	–a——	C:\Qoobox\Quarantine\C\WINNT\system32\regsvc.exe.vir
2007-09-18 09:56	  18944	–a——	C:\Qoobox\Quarantine\C\WINNT\system32\msmapibx32.exe.vir
2007-09-18 09:56	  670	–a——	C:\Qoobox\Quarantine\C\DOCUME~1\Owner\STARTM~1\Programs\Startup\_.lnk.vir
2007-09-18 09:56	  692	–a——	C:\Qoobox\Quarantine\C\DOCUME~1\Owner\STARTM~1\Programs\Startup\.lnk.vir


Folder PATH listing
Volume serial number is 34A9-8974
C:\QOOBOX\QUARANTINE
+—C
|   |   Redemption.ECF.vir
|   |   
|   +—ComboFix
|   |	   FProps.vbs.vir
|   |	   
|   +—DOCUME~1
|   |   \—Owner
|   |	   +—APPLIC~1
|   |	   |	   tmp1F.tmp.exe.vir
|   |	   |	   tmp260.tmp.exe.vir
|   |	   |	   tmp263.tmp.exe.vir
|   |	   |	   
|   |	   \—STARTM~1
|   |		   \—Programs
|   |			   \—Startup
|   |					   .lnk.vir
|   |					   _.lnk.vir
|   |					   
|   +—Program Files
|   |   +—akl
|   |   |	   akl.dll.vir
|   |   |	   akl.exe.vir
|   |   |	   curlog.htm.vir
|   |   |	   keylog.txt.vir
|   |   |	   readme.txt.vir
|   |   |	   uninstall.exe.vir
|   |   |	   unsetup.dat.vir
|   |   |	   unsetup.exe.vir
|   |   |	   
|   |   +—amsys
|   |   |	   mfc42.dll.vir
|   |   |	   msvcrt.dll.vir
|   |   |	   unins000.dat.vir
|   |   |	   unis000.exe.vir
|   |   |	   winam.dat.vir
|   |   |	   
|   |   +—e-zshopper
|   |   |	   BarLcher.dll.vir
|   |   |	   
|   |   \—p2pnetworks
|   |		   amp2pl.exe.vir
|   |		   
|   \—WINNT
|	   |   aconti.exe.vir
|	   |   adbar.dll.vir
|	   |   cbinst$.exe.vir
|	   |   cffffe.ini.vir
|	   |   cookies.ini.vir
|	   |   daxtime.dll.vir
|	   |   dp0.dll.vir
|	   |   effffc.dll.vir
|	   |   eventlowg.dll.vir
|	   |   fhfmm-Uninstaller.exe.vir
|	   |   fhfmm.exe.vir
|	   |   flt.dll.vir
|	   |   hotporn.exe.vir
|	   |   ie_32.exe.vir
|	   |   jd2002.dll.vir
|	   |   kkcomp$.exe.vir
|	   |   kkcomp.exe.vir
|	   |   liqad$.exe.vir
|	   |   liqad.exe.vir
|	   |   liqui-Uninstaller.exe.vir
|	   |   liqui.exe.vir
|	   |   lmmpqr.ini.vir
|	   |   monterreyi_unknown.exe.vir
|	   |   monterreyj_unknown.exe.vir
|	   |   new_drv.sys.vir
|	   |   ngd.dll.vir
|	   |   pbar.dll.vir
|	   |   rqpmml.dll.vir
|	   |   spredirect.dll.vir
|	   |   xadbrk.exe.vir
|	   |   xadbrk_.exe.vir
|	   |   xxxvideo.exe.vir
|	   |   
|	   \—system32
|		   |   drivero.dll.vir
|		   |   ESHOPEE.exe.vir
|		   |   gtv_sd.bin.vir
|		   |   monterreyi_unknown.exe.vir
|		   |   monterreyj_unknown.exe.vir
|		   |   monterreyo_unknown.exe.vir
|		   |   msmapibx32.exe.vir
|		   |   msole32.exe.vir
|		   |   reginia_unknown.exe.vir
|		   |   reginid_unknown.exe.vir
|		   |   reginie_unknown.exe.vir
|		   |   reginif_unknown.exe.vir
|		   |   reginig_unknown.exe.vir
|		   |   reginix86a.dll.vir
|		   |   reginix86b.dll.vir
|		   |   reginix86e.dll.vir
|		   |   regsvc.exe.vir
|		   |   tmp1F.tmp.dll.vir
|		   |   
|		   \—drivers
|				   bg_bg.gif.vir
|				   blank.gif.vir
|				   box_1.gif.vir
|				   box_2.gif.vir
|				   box_3.gif.vir
|				   button_buynow.gif.vir
|				   button_freescan.gif.vir
|				   cell_bg.gif.vir
|				   cell_footer.gif.vir
|				   cell_header_block.gif.vir
|				   cell_header_remove.gif.vir
|				   cell_header_scan.gif.vir
|				   close_ico.gif.vir
|				   download_box.gif.vir
|				   download_btn.jpg.vir
|				   download_now_btn.gif.vir
|				   footer_back.jpg.vir
|				   header_1.gif.vir
|				   header_2.gif.vir
|				   header_3.gif.vir
|				   header_4.gif.vir
|				   header_red_bg.gif.vir
|				   header_red_free_scan.gif.vir
|				   header_red_free_scan_bg.gif.vir
|				   header_red_protect_your_pc.gif.vir
|				   icon_warning_big.gif.vir
|				   infected.gif.vir
|				   main_back.gif.vir
|				   perfect_cleaner_box.jpg.vir
|				   product_1_header.gif.vir
|				   product_1_name_small.gif.vir
|				   product_2_header.gif.vir
|				   product_2_name_small.gif.vir
|				   product_3_header.gif.vir
|				   product_3_name_small.gif.vir
|				   product_features.gif.vir
|				   rating.gif.vir
|				   remove_spyware_header.gif.vir
|				   screenshot.jpg.vir
|				   sep_hor.gif.vir
|				   sep_vert.gif.vir
|				   shadow.jpg.vir
|				   shadow_bg.gif.vir
|				   spacer.gif.vir
|				   spyware_detected.gif.vir
|				   spy_away_box.jpg.vir
|				   star.gif.vir
|				   star_gray.gif.vir
|				   star_gray_small.gif.vir
|				   star_small.gif.vir
|				   style.css.vir
|				   v.gif.vir
|				   warning_ico.gif.vir
|				   warning_icon.gif.vir
|				   win_logo.gif.vir
|				   x.gif.vir
|				   yellow_warning_ico.gif.vir
|				   
\—Registry_backups



—————– ComboFix.txt —————–


ComboFix 07-09-18.4 - "Owner" 2007-09-18 10:17:59.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.80 [GMT -4:00]
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\DOCUME~1\Owner\APPLIC~1\tmp1F.tmp.exe
C:\DOCUME~1\Owner\APPLIC~1\tmp260.tmp.exe
C:\DOCUME~1\Owner\APPLIC~1\tmp263.tmp.exe
C:\DOCUME~1\Owner\STARTM~1\Programs\Startup\.lnk
C:\DOCUME~1\Owner\STARTM~1\Programs\Startup\_.lnk
C:\Program Files\akl
C:\Program Files\akl\akl.dll
C:\Program Files\akl\akl.exe
C:\Program Files\akl\curlog.htm
C:\Program Files\akl\keylog.txt
C:\Program Files\akl\readme.txt
C:\Program Files\akl\uninstall.exe
C:\Program Files\akl\unsetup.dat
C:\Program Files\akl\unsetup.exe
C:\Program Files\amsys
C:\Program Files\amsys\mfc42.dll
C:\Program Files\amsys\msvcrt.dll
C:\Program Files\amsys\unins000.dat
C:\Program Files\amsys\unis000.exe
C:\Program Files\amsys\winam.dat
C:\Program Files\e-zshopper
C:\Program Files\e-zshopper\BarLcher.dll
C:\Program Files\p2pnetworks
C:\Program Files\p2pnetworks\amp2pl.exe
C:\Redemption.ECF
C:\WINNT\aconti.exe
C:\WINNT\adbar.dll
C:\WINNT\cbinst$.exe
C:\WINNT\cffffe.ini
C:\WINNT\cookies.ini
C:\WINNT\daxtime.dll
C:\WINNT\dp0.dll
C:\WINNT\effffc.dll
C:\WINNT\eventlowg.dll
C:\WINNT\fhfmm-Uninstaller.exe
C:\WINNT\fhfmm.exe
C:\WINNT\flt.dll
C:\WINNT\hotporn.exe
C:\WINNT\ie_32.exe
C:\WINNT\jd2002.dll
C:\WINNT\kkcomp$.exe
C:\WINNT\kkcomp.exe
C:\WINNT\liqad$.exe
C:\WINNT\liqad.exe
C:\WINNT\liqui-Uninstaller.exe
C:\WINNT\liqui.exe
C:\WINNT\lmmpqr.ini
C:\WINNT\monterreyi_unknown.exe
C:\WINNT\monterreyj_unknown.exe
C:\WINNT\new_drv.sys
C:\WINNT\ngd.dll
C:\WINNT\pbar.dll
C:\WINNT\rqpmml.dll
C:\WINNT\spredirect.dll
C:\WINNT\system32\drivero.dll
C:\WINNT\system32\drivers\bg_bg.gif
C:\WINNT\system32\drivers\blank.gif
C:\WINNT\system32\drivers\box_1.gif
C:\WINNT\system32\drivers\box_2.gif
C:\WINNT\system32\drivers\box_3.gif
C:\WINNT\system32\drivers\button_buynow.gif
C:\WINNT\system32\drivers\button_freescan.gif
C:\WINNT\system32\drivers\cell_bg.gif
C:\WINNT\system32\drivers\cell_footer.gif
C:\WINNT\system32\drivers\cell_header_block.gif
C:\WINNT\system32\drivers\cell_header_remove.gif
C:\WINNT\system32\drivers\cell_header_scan.gif
C:\WINNT\system32\drivers\close_ico.gif
C:\WINNT\system32\drivers\download_box.gif
C:\WINNT\system32\drivers\download_btn.jpg
C:\WINNT\system32\drivers\download_now_btn.gif
C:\WINNT\system32\drivers\footer_back.jpg
C:\WINNT\system32\drivers\header_1.gif
C:\WINNT\system32\drivers\header_2.gif
C:\WINNT\system32\drivers\header_3.gif
C:\WINNT\system32\drivers\header_4.gif
C:\WINNT\system32\drivers\header_red_bg.gif
C:\WINNT\system32\drivers\header_red_free_scan.gif
C:\WINNT\system32\drivers\header_red_free_scan_bg.gif
C:\WINNT\system32\drivers\header_red_protect_your_pc.gif
C:\WINNT\system32\drivers\icon_warning_big.gif
C:\WINNT\system32\drivers\infected.gif
C:\WINNT\system32\drivers\main_back.gif
C:\WINNT\system32\drivers\perfect_cleaner_box.jpg
C:\WINNT\system32\drivers\product_1_header.gif
C:\WINNT\system32\drivers\product_1_name_small.gif
C:\WINNT\system32\drivers\product_2_header.gif
C:\WINNT\system32\drivers\product_2_name_small.gif
C:\WINNT\system32\drivers\product_3_header.gif
C:\WINNT\system32\drivers\product_3_name_small.gif
C:\WINNT\system32\drivers\product_features.gif
C:\WINNT\system32\drivers\rating.gif
C:\WINNT\system32\drivers\remove_spyware_header.gif
C:\WINNT\system32\drivers\screenshot.jpg
C:\WINNT\system32\drivers\sep_hor.gif
C:\WINNT\system32\drivers\sep_vert.gif
C:\WINNT\system32\drivers\shadow.jpg
C:\WINNT\system32\drivers\shadow_bg.gif
C:\WINNT\system32\drivers\spacer.gif
C:\WINNT\system32\drivers\spy_away_box.jpg
C:\WINNT\system32\drivers\spyware_detected.gif
C:\WINNT\system32\drivers\star.gif
C:\WINNT\system32\drivers\star_gray.gif
C:\WINNT\system32\drivers\star_gray_small.gif
C:\WINNT\system32\drivers\star_small.gif
C:\WINNT\system32\drivers\style.css
C:\WINNT\system32\drivers\v.gif
C:\WINNT\system32\drivers\warning_ico.gif
C:\WINNT\system32\drivers\warning_icon.gif
C:\WINNT\system32\drivers\win_logo.gif
C:\WINNT\system32\drivers\x.gif
C:\WINNT\system32\drivers\yellow_warning_ico.gif
C:\WINNT\system32\ESHOPEE.exe
C:\WINNT\system32\gtv_sd.bin
C:\WINNT\system32\monterreyi_unknown.exe
C:\WINNT\system32\monterreyj_unknown.exe
C:\WINNT\system32\monterreyo_unknown.exe
C:\WINNT\system32\msmapibx32.exe
C:\WINNT\system32\msole32.exe
C:\WINNT\system32\reginia_unknown.exe
C:\WINNT\system32\reginid_unknown.exe
C:\WINNT\system32\reginie_unknown.exe
C:\WINNT\system32\reginif_unknown.exe
C:\WINNT\system32\reginig_unknown.exe
C:\WINNT\system32\reginix86a.dll
C:\WINNT\system32\reginix86b.dll
C:\WINNT\system32\reginix86e.dll
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\tmp1F.tmp.dll
C:\WINNT\xadbrk.exe
C:\WINNT\xadbrk_.exe
C:\WINNT\xxxvideo.exe

.
((((((((((((((((((((((((( Files Created from 2007-08-18 to 2007-09-18 )))))))))))))))))))))))))))))))
.

2007-09-18 10:16 51,200 –a—— C:\WINNT\NirCmd.exe
2007-09-18 10:15 0 –a—— C:\WINNT\system32\try.exe
2007-09-18 09:55 3,840 –a—— C:\WINNT\system32\drivers\ohcuusb.sys
2007-09-16 12:31 d——– C:\VundoFix Backups
2007-09-16 12:30 18,944 –a—— C:\WINNT\msmapibx32_unknown.exe
2007-09-15 12:44 18,944 –a—— C:\WINNT\system32\msmapibx32_unknown.exe
2007-09-14 14:25 33,792 –a—— C:\WINNT\system32\dllcache\custsat.dll
2007-09-14 11:41 23,040 ——— C:\WINNT\system32\dllcache\fltmc.exe
2007-09-14 11:41 16,896 ——— C:\WINNT\system32\dllcache\fltlib.dll
2007-09-14 11:41 128,896 ——— C:\WINNT\system32\dllcache\fltmgr.sys
2007-09-14 11:40 d——– C:\Program Files\MSXML 4.0
2007-09-13 16:49 d——– C:\WINNT\provisioning
2007-09-13 16:49 d——– C:\WINNT\peernet
2007-09-13 16:47 d——– C:\WINNT\ServicePackFiles
2007-09-13 16:42 d——– C:\WINNT\EHome
2007-09-13 16:34 4,569 ——— C:\WINNT\system32\secupd.dat
2007-09-13 16:34 11,776 ——— C:\WINNT\system32\spnpinst.exe
2007-09-13 16:02 614,912 –a—— C:\WINNT\system32\h323msp.dll
2007-09-13 16:02 40,960 ——— C:\WINNT\system32\dllcache\evtgprov.dll
2007-09-13 16:02 331,264 –a—— C:\WINNT\system32\ipnathlp.dll
2007-09-13 15:51 d——– C:\DOCUME~1\Owner\APPLIC~1\Wireshark
2007-09-13 15:50 d——– C:\Program Files\WinPcap
2007-09-13 15:49 d——– C:\Program Files\Wireshark
2007-09-13 10:18 d——– C:\Program Files\Enigma Software Group
2007-09-12 16:11 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
2007-09-12 12:07 87,040 –a—— C:\WINNT\system32\drmstor.dll
2007-09-12 12:07 695,296 –a—— C:\WINNT\system32\drmv2clt.dll
2007-09-12 12:07 299,520 –a—— C:\WINNT\system32\drmclien.dll
2007-09-12 12:07 286,208 –a—— C:\WINNT\system32\blackbox.dll
2007-09-12 12:07 259,072 –a—— C:\WINNT\system32\msnetobj.dll
2007-09-12 12:05 d——– C:\Program Files\AOL 9.0
2007-09-12 11:54 65,536 –a—— C:\WINNT\wanmpsvc.exe
2007-09-12 09:36 95,744 –a—— C:\WINNT\system32\werweg_unknown.exe
2007-09-12 09:36 95,744 –a—— C:\WINNT\system32\werweg.exe
2007-09-12 09:36 148,992 –a—— C:\WINNT\system32\werweg.dll
2007-09-11 17:32 1,082,368 –a—— C:\WINNT\system32\esent.dll
2007-09-11 17:23 d——– C:\WINNT\system32\bits
2007-09-11 17:22 22,752 –a—— C:\WINNT\system32\spupdsvc.exe
2007-09-11 17:22 d–h—– C:\WINNT\$hf_mig$
2007-09-11 17:08 d——– C:\Program Files\CCleaner
2007-09-11 16:47 8,192 ——— C:\WINNT\system32\bitsprx2.dll
2007-09-11 16:47 7,168 ——— C:\WINNT\system32\bitsprx3.dll
2007-09-11 16:47 351,232 –a—— C:\WINNT\system32\winhttp.dll
2007-09-11 16:47 18,944 –a—— C:\WINNT\system32\qmgrprxy.dll
2007-09-11 16:42 549,720 –a—— C:\WINNT\system32\wuapi.dll
2007-09-11 16:42 33,624 –a—— C:\WINNT\system32\wups.dll
2007-09-11 16:42 325,976 –a—— C:\WINNT\system32\wucltui.dll
2007-09-11 16:42 203,096 –a—— C:\WINNT\system32\wuweb.dll
2007-09-11 16:42 186,136 –a—— C:\WINNT\system32\wuaueng1.dll
2007-09-11 16:42 167,704 –a—— C:\WINNT\system32\wuauclt1.exe
2007-09-11 14:59 d——– C:\Program Files\Lavasoft
2007-09-11 14:59 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
2007-09-11 14:48 d——– C:\Program Files\Common Files\Wise Installation Wizard
2007-09-11 14:25 d——– C:\DOCUME~1\ADMINI~1\APPLIC~1\Symantec
2007-09-11 14:25 d——– C:\DOCUME~1\ADMINI~1\APPLIC~1\InterTrust
2007-09-11 14:08 95,232 –a—— C:\WINNT\system32\werwef_unknown.exe
2007-09-11 14:08 148,992 –a—— C:\WINNT\system32\werwef.dll
2007-09-11 13:55 d——– C:\WINNT\pss
2007-08-27 17:42 1,206,451 –a—— C:\WINNT\system32\dn34a98974.dat
2007-08-26 21:14 4 –a—— C:\WINNT\system32\stfv.bin
2007-08-26 16:13 d——– C:\WINNT\system32\acespy
2007-08-26 15:53 21,504 –a—— C:\WINNT\system32\oembios32.dll
2007-08-26 15:52 3,638 –a—— C:\WINNT\60ys5hfo.exe
2007-08-26 15:52 0 –a—— C:\WINNT\system32\nusrmgr.exe
2007-08-19 19:26 97,280 –a—— C:\WINNT\system32\werweb_unknown.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-09-18 09:56 3840 –a—— C:\WINNT\system32\drivers\ohcuusb.syt
2007-09-13 12:35 ——— d——– C:\Program Files\Yahoo!
2007-09-13 12:34 ——— d–h—– C:\Program Files\InstallShield Installation Information
2007-09-13 12:04 ——— d——– C:\Program Files\Common Files\Symantec Shared
2007-09-13 12:04 ——— d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec
2007-09-13 12:03 ——— d——– C:\Program Files\Symantec
2007-09-12 12:13 ——— d——– C:\Program Files\Common Files\AOL
2007-09-12 12:08 ——— d——– C:\DOCUME~1\Owner\APPLIC~1\AOL
2007-09-12 12:08 ——— d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\AOL
2007-09-12 12:07 ——— d——– C:\Program Files\Common Files\aolshare
2007-09-12 12:03 ——— d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\AOL Downloads
2007-09-01 12:24 ——— d——– C:\DOCUME~1\Owner\APPLIC~1\WeatherBug
2007-08-17 22:32 ——— d——– C:\Program Files\America Online 9.0
2007-08-16 19:31 ——— d——– C:\Program Files\EPSON
2007-08-07 13:58 8320 –a—— C:\WINNT\system32\drivers\AWRTRD.sys
2007-08-07 13:56 9344 –a—— C:\WINNT\system32\drivers\NSDriver.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{029e02f0-a0e5-4b19-b958-7bf2db29fb13}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{03770B87-7AC8-4862-9970-5BB7D5A59773}]
2007-09-12 09:36 148992 –a—— C:\WINNT\system32\werweg.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0B1C644A-E692-4413-A9C5-FE2EB9E4AA74}]
2007-08-26 15:53 21504 –a—— C:\WINNT\System32\oembios32.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2d7cb618-cc1c-4126-a7e3-f5b12d3bcf71}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{51641ef3-8a7a-4d84-8659-b0911e947cc8}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{54645654-2225-4455-44A1-9F4543D34546}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6abc861a-31e7-4d91-b43b-d3c98f22a5c0}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{a4a435cf-3583-11d4-91bd-0048546a1450}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{c2680e10-1655-4a0e-87f8-4259325a84b7}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{c4ca6559-2cf1-48b6-96b2-8340a06fd129}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{d8efadf1-9009-11d6-8c73-608c5dc19089}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{e9147a0a-a866-4214-b47c-da821891240f}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{e9306072-417e-43e3-81d5-369490beef7c}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2003-11-09 14:24]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\mgmdir]
mgmdir.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=c:\winnt\system32\ddayyvv.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 9.0 Tray Icon.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\America Online 9.0 Tray Icon.lnk
backup=C:\WINNT\pss\America Online 9.0 Tray Icon.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^AOL Companion.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\AOL Companion.lnk
backup=C:\WINNT\pss\AOL Companion.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^YourScreen.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\YourScreen.lnk
backup=C:\WINNT\pss\YourScreen.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdaptecDirectCD]
"C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\autoload]
C:\WINNT\System32\drivers\svchost.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\autorun]
C:\Documents and Settings\Owner\svchost.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp]
C:\Program Files\Common Files\Symantec Shared\ccApp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccRegVfy]
C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus C62 Series]
C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_S0BIC1.EXE /P23 "EPSON Stylus C62 Series" /O6 "USB001" /M "Stylus C62"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GWMDMMSG]
GWMDMMSG.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GWMDMpi]
C:\WINNT\GWMDMpi.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Hot Key Kbd 9910 Daemon]
SK9910DM.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
C:\WINNT\System32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
C:\WINNT\System32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Keyboard Preload Check]
C:\OEMDRVRS\KEYB\Preload.exe /DEVID: /CLASS:Keyboard /RunValue:"Keyboard Preload Check"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"C:\Program Files\Messenger\msmsgs.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NAV CfgWiz]
C:\PROGRA~1\NORTON~1\Cfgwiz.exe /R

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray]
C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\sysalgg]
C:\WINNT\System32\sysalgg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SystemOptimizer]
rundll32.exe "C:\WINNT\rqpmml.dll",forkonce

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ttool]
C:\WINNT\9129837.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Weather]
C:\PROGRA~1\AWS\WEATHE~1\Weather.exe 1

R1 cdudf_xp;cdudf_xp;C:\WINNT\system32\drivers\cdudf_xp.sys
R1 pwd_2k;pwd_2k;C:\WINNT\system32\drivers\pwd_2k.sys
R1 Sk9920nt;PS/2 Keyboard Filter Driver for NT 4.0;C:\WINNT\system32\DRIVERS\Sk9920nt.sys
R1 UdfReadr_xp;UdfReadr_xp;C:\WINNT\system32\drivers\UdfReadr_xp.sys
R2 ohcuusb;Open Host Controller Miniport USB Driver;\??\C:\WINNT\system32\drivers\ohcuusb.sys
R2 RioPNP;RioPNP;C:\WINNT\system32\drivers\RioPNP.sys
R3 GTWModem;GTW V.92 Voicemodem;C:\WINNT\system32\DRIVERS\GWMDM.sys
R3 mmc_2K;mmc_2K;C:\WINNT\system32\drivers\mmc_2K.sys
R3 Sk99202k;PS/2 Keyboard Filter Driver for Win2000;C:\WINNT\system32\DRIVERS\Sk99202k.sys
S2 NMSSvc;Intel® NMS;C:\WINNT\System32\NMSSvc.exe
S3 BCMModem;BCM V.90 56K Modem;C:\WINNT\system32\DRIVERS\BCMDM.sys
S3 dvd_2K;dvd_2K;C:\WINNT\system32\drivers\dvd_2K.sys
S3 NPF;NetGroup Packet Filter Driver;C:\WINNT\system32\drivers\npf.sys
S3 PCDRDRV;Pcdr Helper Driver;\??\C:\Atf\Qctest\PCDoc\PCDRDRV.sys

*Newly Created Service* - NMSSVC
.
**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-09-18 10:22:01
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

**************************************************************************
.
Completion time: 2007-09-18 10:24:12 - machine was rebooted
C:\ComboFix-quarantined-files.txt … 2007-09-18 10:23
.
— E O F —
Post #8
Hi

Open Notepad and Copy/Paste the text in the codebox below into it: 

File::
C:\WINNT\system32\drivers\ohcuusb.sys
C:\WINNT\msmapibx32_unknown.exe
C:\WINNT\system32\msmapibx32_unknown.exe
C:\WINNT\system32\werweg_unknown.exe
C:\WINNT\system32\werweg.exe
C:\WINNT\system32\werweg.dll
C:\WINNT\system32\werwef_unknown.exe
C:\WINNT\system32\werwef.dll
C:\WINNT\system32\stfv.bin
C:\WINNT\system32\oembios32.dll
C:\WINNT\60ys5hfo.exe
C:\WINNT\system32\nusrmgr.exe
C:\WINNT\system32\werweb_unknown.exe
C:\WINNT\system32\drivers\ohcuusb.syt
c:\winnt\system32\ddayyvv.dll
C:\WINNT\System32\sysalgg.exe
C:\WINNT\rqpmml.dll
C:\WINNT\9129837.exe

Folder::
C:\VundoFix Backups
C:\Program Files\Enigma Software Group
C:\WINNT\system32\acespy 

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{029e02f0-a0e5-4b19-b958-7bf2db29fb13}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{03770B87-7AC8-4862-9970-5BB7D5A59773}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0B1C644A-E692-4413-A9C5-FE2EB9E4AA74}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2d7cb618-cc1c-4126-a7e3-f5b12d3bcf71}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{51641ef3-8a7a-4d84-8659-b0911e947cc8}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{54645654-2225-4455-44A1-9F4543D34546}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6abc861a-31e7-4d91-b43b-d3c98f22a5c0}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{a4a435cf-3583-11d4-91bd-0048546a1450}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{c2680e10-1655-4a0e-87f8-4259325a84b7}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{c4ca6559-2cf1-48b6-96b2-8340a06fd129}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{d8efadf1-9009-11d6-8c73-608c5dc19089}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{e9147a0a-a866-4214-b47c-da821891240f}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{e9306072-417e-43e3-81d5-369490beef7c}]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\mgmdir]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=""
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\sysalgg]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SystemOptimizer]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ttool]

Driver::
ohcuusb

Save this as "CFScript"

[external image: Posted Image]


Refering to the picture above, drag CFScript into ComboFix.exe
Then post the resultant log with a new HijackThis log.
Post #9
ComboFix log after the CFScript u sent was pasted into ComboFix
—————————————-

ComboFix 07-09-18.4 - "Owner" 2007-09-19 15:16:12.2 - NTFSx86


Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.100 [GMT -4:00]
* Created a new restore point

FILE::
C:\WINNT\system32\drivers\ohcuusb.sys
C:\WINNT\msmapibx32_unknown.exe
C:\WINNT\system32\msmapibx32_unknown.exe
C:\WINNT\system32\werweg_unknown.exe
C:\WINNT\system32\werweg.exe
C:\WINNT\system32\werweg.dll
C:\WINNT\system32\werwef_unknown.exe
C:\WINNT\system32\werwef.dll
C:\WINNT\system32\stfv.bin
C:\WINNT\system32\oembios32.dll
C:\WINNT\60ys5hfo.exe
C:\WINNT\system32\nusrmgr.exe
C:\WINNT\system32\werweb_unknown.exe
C:\WINNT\system32\drivers\ohcuusb.syt
c:\winnt\system32\ddayyvv.dll
C:\WINNT\System32\sysalgg.exe
C:\WINNT\rqpmml.dll
C:\WINNT\9129837.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\DOCUME~1\Owner\STARTM~1\Programs\Startup\.lnk
C:\DOCUME~1\Owner\STARTM~1\Programs\Startup\_.lnk
C:\Program Files\Enigma Software Group
C:\Program Files\Enigma Software Group\SpyHunter\Backup\{21447C90-6EC1-4FC1-9379-BD515008AEDB}.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\{286E500C-EF0A-4AA3-A94D-E495F653EF4B}.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\{319260AB-BE0C-4025-8569-7A27ED2FAAB9}.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\{32C97A37-E2B8-4097-9330-5F3E1125E181}.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\{620D55B0-F2FB-464E-A278-B4308DB1DB2B}.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\{8AC5BC54-B13B-4642-99F9-0BAA2D116184}.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\{9809A6B4-70B1-4BB2-B3B5-B415763A534E}.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\{B0C3DE1B-E3FF-4DD0-9229-F452CF9C678E}.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\{BCE2E826-D0F5-41C8-97BE-28A6F540CEEB}.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\{D2D94732-A74D-433C-98F7-9ED740E82AE9}.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\{D5178F77-C5E6-4E8F-9787-48B5D7ECCCE8}.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\{DFD5D79B-EF2F-4A51-9821-5B469F05262E}.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\ASAPCom_ASAPClass.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\ASAPCom_ASAPEnvelope.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\ASAPCom_ASAPMain.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\ASAPCom_ASAPMessage.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\ASAPCom_ASAPRecipients.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\awmsg.dat.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\l3acdb.dll.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\Microsoft_Office_Outlook_Addins_SbHostOL_MailAnim.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\MICROSOFT_WINDOWS NT_CURRENTVERSION_WINLOGON_NOTIFY_igfxcui.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\Microsoft_Windows_CurrentVersion_Ext_PreApproved_{8109FD3D-D891-4f80-8339-50A4913ACE6F}.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\Microsoft_Windows_CurrentVersion_Ext_PreApproved_{90B5A95A-AFD5-4d11-B9BD-A69D53D22226}.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\owner@2o7[1].txt.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\[removed][1].txt.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\owner@atdmt[1].txt.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\owner@atwola[1].txt.dat
C:\Program Files\Enigma Software Group\SpyHunter\Backup\reginix86d.dll.dat
C:\Program Files\Enigma Software Group\SpyHunter\backupLog.dat
C:\Program Files\Enigma Software Group\SpyHunter\def.dat
C:\Program Files\Enigma Software Group\SpyHunter\def.dat.bak
C:\Program Files\Enigma Software Group\SpyHunter\Download\spyhunter_update.exe
C:\Program Files\Enigma Software Group\SpyHunter\EnigmaUpdater.dll
C:\Program Files\Enigma Software Group\SpyHunter\esgi_md5h.dll
C:\Program Files\Enigma Software Group\SpyHunter\Esgiutl1.dll
C:\Program Files\Enigma Software Group\SpyHunter\exclusions.dat
C:\Program Files\Enigma Software Group\SpyHunter\ExtendedRemover.dll
C:\Program Files\Enigma Software Group\SpyHunter\ExtendedScript.dat
C:\Program Files\Enigma Software Group\SpyHunter\INSTALL.LOG
C:\Program Files\Enigma Software Group\SpyHunter\install.sss
C:\Program Files\Enigma Software Group\SpyHunter\LSPFix.dll
C:\Program Files\Enigma Software Group\SpyHunter\purl.dat
C:\Program Files\Enigma Software Group\SpyHunter\readme.txt
C:\Program Files\Enigma Software Group\SpyHunter\settings.ini
C:\Program Files\Enigma Software Group\SpyHunter\SHSched.dll
C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter.chm
C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter.exe
C:\Program Files\Enigma Software Group\SpyHunter\support.log
C:\Program Files\Enigma Software Group\SpyHunter\Uninstall.exe
C:\VundoFix Backups
C:\WINNT\60ys5hfo.exe
C:\WINNT\msmapibx32_unknown.exe
C:\WINNT\system32\acespy
C:\WINNT\system32\acespy\__acelog.ndx
C:\WINNT\system32\acespy\systune.exe
C:\WINNT\system32\drivers\ohcuusb.sys
C:\WINNT\system32\drivers\ohcuusb.syt
C:\WINNT\system32\msmapibx32.exe
C:\WINNT\system32\msmapibx32_unknown.exe
C:\WINNT\system32\nusrmgr.exe
C:\WINNT\system32\oembios32.dll
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\stfv.bin
C:\WINNT\system32\werweb_unknown.exe
C:\WINNT\system32\werwef.dll
C:\WINNT\system32\werwef_unknown.exe
C:\WINNT\system32\werweg.dll
C:\WINNT\system32\werweg.exe
C:\WINNT\system32\werweg_unknown.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))


——-\LEGACY_OHCUUSB
——-\ohcuusb


((((((((((((((((((((((((( Files Created from 2007-08-19 to 2007-09-19 )))))))))))))))))))))))))))))))
.

2007-09-18 10:16 51,200 –a—— C:\WINNT\NirCmd.exe
2007-09-14 14:25 33,792 –a—— C:\WINNT\system32\dllcache\custsat.dll
2007-09-14 11:41 23,040 ——— C:\WINNT\system32\dllcache\fltmc.exe
2007-09-14 11:41 16,896 ——— C:\WINNT\system32\dllcache\fltlib.dll
2007-09-14 11:41 128,896 ——— C:\WINNT\system32\dllcache\fltmgr.sys
2007-09-14 11:40 d——– C:\Program Files\MSXML 4.0
2007-09-13 16:49 d——– C:\WINNT\provisioning
2007-09-13 16:49 d——– C:\WINNT\peernet
2007-09-13 16:47 d——– C:\WINNT\ServicePackFiles
2007-09-13 16:42 d——– C:\WINNT\EHome
2007-09-13 16:34 4,569 ——— C:\WINNT\system32\secupd.dat
2007-09-13 16:34 11,776 ——— C:\WINNT\system32\spnpinst.exe
2007-09-13 16:02 614,912 –a—— C:\WINNT\system32\h323msp.dll
2007-09-13 16:02 40,960 ——— C:\WINNT\system32\dllcache\evtgprov.dll
2007-09-13 16:02 331,264 –a—— C:\WINNT\system32\ipnathlp.dll
2007-09-13 15:51 d——– C:\DOCUME~1\Owner\APPLIC~1\Wireshark
2007-09-13 15:50 d——– C:\Program Files\WinPcap
2007-09-13 15:49 d——– C:\Program Files\Wireshark
2007-09-12 16:11 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
2007-09-12 12:07 87,040 –a—— C:\WINNT\system32\drmstor.dll
2007-09-12 12:07 695,296 –a—— C:\WINNT\system32\drmv2clt.dll
2007-09-12 12:07 299,520 –a—— C:\WINNT\system32\drmclien.dll
2007-09-12 12:07 286,208 –a—— C:\WINNT\system32\blackbox.dll
2007-09-12 12:07 259,072 –a—— C:\WINNT\system32\msnetobj.dll
2007-09-12 12:05 d——– C:\Program Files\AOL 9.0
2007-09-12 11:54 65,536 –a—— C:\WINNT\wanmpsvc.exe
2007-09-11 17:32 1,082,368 –a—— C:\WINNT\system32\esent.dll
2007-09-11 17:23 d——– C:\WINNT\system32\bits
2007-09-11 17:22 22,752 –a—— C:\WINNT\system32\spupdsvc.exe
2007-09-11 17:22 d–h—– C:\WINNT\$hf_mig$
2007-09-11 17:08 d——– C:\Program Files\CCleaner
2007-09-11 16:47 8,192 ——— C:\WINNT\system32\bitsprx2.dll
2007-09-11 16:47 7,168 ——— C:\WINNT\system32\bitsprx3.dll
2007-09-11 16:47 351,232 –a—— C:\WINNT\system32\winhttp.dll
2007-09-11 16:47 18,944 –a—— C:\WINNT\system32\qmgrprxy.dll
2007-09-11 16:42 549,720 –a—— C:\WINNT\system32\wuapi.dll
2007-09-11 16:42 33,624 –a—— C:\WINNT\system32\wups.dll
2007-09-11 16:42 325,976 –a—— C:\WINNT\system32\wucltui.dll
2007-09-11 16:42 203,096 –a—— C:\WINNT\system32\wuweb.dll
2007-09-11 16:42 186,136 –a—— C:\WINNT\system32\wuaueng1.dll
2007-09-11 16:42 167,704 –a—— C:\WINNT\system32\wuauclt1.exe
2007-09-11 14:59 d——– C:\Program Files\Lavasoft
2007-09-11 14:59 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
2007-09-11 14:48 d——– C:\Program Files\Common Files\Wise Installation Wizard
2007-09-11 14:25 d——– C:\DOCUME~1\ADMINI~1\APPLIC~1\Symantec
2007-09-11 14:25 d——– C:\DOCUME~1\ADMINI~1\APPLIC~1\InterTrust
2007-09-11 13:55 d——– C:\WINNT\pss
2007-08-27 17:42 1,206,451 –a—— C:\WINNT\system32\dn34a98974.dat

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-09-13 12:35 ——— d——– C:\Program Files\Yahoo!
2007-09-13 12:34 ——— d–h—– C:\Program Files\InstallShield Installation Information
2007-09-13 12:04 ——— d——– C:\Program Files\Common Files\Symantec Shared
2007-09-13 12:04 ——— d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec
2007-09-13 12:03 ——— d——– C:\Program Files\Symantec
2007-09-12 12:13 ——— d——– C:\Program Files\Common Files\AOL
2007-09-12 12:08 ——— d——– C:\DOCUME~1\Owner\APPLIC~1\AOL
2007-09-12 12:08 ——— d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\AOL
2007-09-12 12:07 ——— d——– C:\Program Files\Common Files\aolshare
2007-09-12 12:03 ——— d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\AOL Downloads
2007-09-01 12:24 ——— d——– C:\DOCUME~1\Owner\APPLIC~1\WeatherBug
2007-08-17 22:32 ——— d——– C:\Program Files\America Online 9.0
2007-08-16 19:31 ——— d——– C:\Program Files\EPSON
2007-08-07 13:58 8320 –a—— C:\WINNT\system32\drivers\AWRTRD.sys
2007-08-07 13:56 9344 –a—— C:\WINNT\system32\drivers\NSDriver.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2003-11-09 14:24]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 9.0 Tray Icon.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\America Online 9.0 Tray Icon.lnk
backup=C:\WINNT\pss\America Online 9.0 Tray Icon.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^AOL Companion.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\AOL Companion.lnk
backup=C:\WINNT\pss\AOL Companion.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^YourScreen.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\YourScreen.lnk
backup=C:\WINNT\pss\YourScreen.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdaptecDirectCD]
"C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\autoload]
C:\WINNT\System32\drivers\svchost.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\autorun]
C:\Documents and Settings\Owner\svchost.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp]
C:\Program Files\Common Files\Symantec Shared\ccApp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccRegVfy]
C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus C62 Series]
C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_S0BIC1.EXE /P23 "EPSON Stylus C62 Series" /O6 "USB001" /M "Stylus C62"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GWMDMMSG]
GWMDMMSG.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GWMDMpi]
C:\WINNT\GWMDMpi.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Hot Key Kbd 9910 Daemon]
SK9910DM.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
C:\WINNT\System32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
C:\WINNT\System32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Keyboard Preload Check]
C:\OEMDRVRS\KEYB\Preload.exe /DEVID: /CLASS:Keyboard /RunValue:"Keyboard Preload Check"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"C:\Program Files\Messenger\msmsgs.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NAV CfgWiz]
C:\PROGRA~1\NORTON~1\Cfgwiz.exe /R

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray]
C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Weather]
C:\PROGRA~1\AWS\WEATHE~1\Weather.exe 1

R1 cdudf_xp;cdudf_xp;C:\WINNT\system32\drivers\cdudf_xp.sys
R1 pwd_2k;pwd_2k;C:\WINNT\system32\drivers\pwd_2k.sys
R1 Sk9920nt;PS/2 Keyboard Filter Driver for NT 4.0;C:\WINNT\system32\DRIVERS\Sk9920nt.sys
R1 UdfReadr_xp;UdfReadr_xp;C:\WINNT\system32\drivers\UdfReadr_xp.sys
R2 RioPNP;RioPNP;C:\WINNT\system32\drivers\RioPNP.sys
R3 GTWModem;GTW V.92 Voicemodem;C:\WINNT\system32\DRIVERS\GWMDM.sys
R3 mmc_2K;mmc_2K;C:\WINNT\system32\drivers\mmc_2K.sys
R3 Sk99202k;PS/2 Keyboard Filter Driver for Win2000;C:\WINNT\system32\DRIVERS\Sk99202k.sys
S2 NMSSvc;Intel® NMS;C:\WINNT\System32\NMSSvc.exe
S3 BCMModem;BCM V.90 56K Modem;C:\WINNT\system32\DRIVERS\BCMDM.sys
S3 dvd_2K;dvd_2K;C:\WINNT\system32\drivers\dvd_2K.sys
S3 NPF;NetGroup Packet Filter Driver;C:\WINNT\system32\drivers\npf.sys
S3 PCDRDRV;Pcdr Helper Driver;\??\C:\Atf\Qctest\PCDoc\PCDRDRV.sys

*Newly Created Service* - NMSSVC
.
**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-09-19 15:20:16
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-09-19 15:22:04 - machine was rebooted
C:\ComboFix-quarantined-files.txt … 2007-09-19 15:21
C:\ComboFix2.txt … 2007-09-18 10:24
.
— E O F —




Logfile of HijackThis v1.99.1

—————————————-

Logfile of HijackThis v1.99.1
Scan saved at 3:52:55 PM, on 9/19/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Common Files\Lanovation\PrismXL\PRISMXL.SYS
C:\WINNT\wanmpsvc.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/home.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
R3 - URLSearchHook: &Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {BDF3E430-B101-42AD-A544-FADC6B084872} - (no file)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINNT\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.aol.com
O16 - DPF: {2DFF31F9-7893-4922-AF66-C9A1EB4EBB31} (Rhapsody Player Engine) - http://forms.real.com/real/player/download…ne_Inst_Win.cab
O20 - Winlogon Notify: igfxcui - C:\WINNT\
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Intel® NMS (NMSSvc) - Intel Corporation - C:\WINNT\System32\NMSSvc.exe
O23 - Service: PrismXL - Lanovation - C:\Program Files\Common Files\Lanovation\PrismXL\PRISMXL.SYS
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINNT\wanmpsvc.exe
Post #10
Hi

WeatherBug is a system tray icon that offers weather information and includes built-in ads. WeatherBug is controlled by AWS Convergence Technologies (weatherbugmedia.com). There is some controversy over whether WeatherBug should be targeted by anti-parasite software. AWS strongly deny their software is ‘spyware’, and by the definition used here, it is not, as it does not leak information back to its controlling servers. However, WeatherBug has in the past been silently installed by the FavoriteMan parasite and Freeze.com screensavers, and more recently has been bundled by software such as AIM and Blubster. This makes it ‘unsolicited’, and since it is installed to raise money for its creators through the built-in ads it is certainly ‘commercial’. So it does meet the definition for ‘parasite’: unsolicited commercial software. It is nonetheless listed as a borderline case because it is not overtly harmful and many people do install it deliberately. WeatherBug bundles the MySearch parasite in its standalone distribution and has in the past, installed Gator and SVAPlayer.

I recommend that you uninstall WeatherBugand choose one of these alternatives:
Weather Pulse
Weather Watcher
or
Get mozilla Firefox and then get FORECASTFOX!!!
or check the weather at these websites:
Weather Street: US Weather
Intellicast
To uninstall WeatherBug:
  • Click Start, point to Settings, and then click Control Panel.
  • In Control Panel, double-click Add or Remove Programs.
  • In Add or Remove Programs, highlight WeatherBug, click Remove.
  • Close the Add or Remove Programs and the Control Panel windows.
Run HijackThis, select Do a system scan only and place checks against the following entries (if they are still present):
R3 - URLSearchHook: &Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: (no name) - {BDF3E430-B101-42AD-A544-FADC6B084872} - (no file)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)


WITH ALL OTHER WINDOWS CLOSED Click on Fix Checked and exit HijackThis then reboot.

Download Superantispyware (SAS) free home version.

SAS Free

Install it and double-click the icon on your desktop to run it.
� It will ask if you want to update the program definitions, click Yes.
� Under Configuration and Preferences, click the Preferences button.
� Click the Scanning Control tab.
� Under Scanner Options make sure the following are checked:
  • Close browsers before scanning
  • Scan for tracking cookies
  • Terminate memory threats before quarantining.
  • Please leave the others unchecked.
  • Click the Close button to leave the control center screen.
� On the main screen, under Scan for Harmful Software click Scan your computer.
� On the left check C:\Fixed Drive.
� On the right, under Complete Scan, choose Perform Complete Scan.
� Click Next to start the scan. Please be patient while it scans your computer.
� After the scan is complete a summary box will appear. Click OK.
� Make sure everything in the white box has a check next to it, then click Next.
� It will quarantine what it found and if it asks if you want to reboot, click Yes.
� To retrieve the removal information for me please do the following:
  • After reboot, double-click the SUPERAntispyware icon on your desktop.
  • Click Preferences. Click the Statistics/Logs tab.
  • Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
  • It will open in your default text editor (such as Notepad/Wordpad).
  • Please highlight everything in the notepad, then right-click and choose copy.
� Click close and close again to exit the program.
� Please paste that information here for me with a new HijackThis log.
Post #11
hello scotty, WeatherBug wasn't in any kist ti remove, but no problem…. your intructions… Run HijackThis, select Do a system scan only and place checks against the following entries (if they are still present): R3 - URLSearchHook: &Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) O2 - BHO: (no name) - {BDF3E430-B101-42AD-A544-FADC6B084872} - (no file) O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file) WITH ALL OTHER WINDOWS CLOSED Click on Fix Checked and exit HijackThis then reboot. were a B I G S U C C E S S !!!! THANX VERY MUCH. ROB
Post #13
hello scotty,
SuperAntiSpyware and a new HijackThis logs comming up


————— SUPERAntiSpyware Scan Log —————
————— Generated 09/23/2007 at 01:45 PM —————

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 09/23/2007 at 01:45 PM

Application Version : 3.9.1008

Core Rules Database Version : 3311
Trace Rules Database Version: 1315

Scan type : Quick Scan
Total Scan Time : 00:12:42

Memory items scanned : 333
Memory threats detected : 0
Registry items scanned : 637
Registry threats detected : 0
File items scanned : 8728
File threats detected : 6

Adware.Tracking Cookie
C:\Documents and Settings\Owner\Cookies\owner@specificclick[1].txt
C:\Documents and Settings\Owner\Cookies\[removed][2].txt

Adware.HotBar/SpamBlockerUtility (Low Risk)
C:\WINNT\Downloaded Program Files\SpamBlockerUtility.inf

Trojan.Downloader-FakeRX
C:\QOOBOX\QUARANTINE\C\WINNT\SYSTEM32\OEMBIOS32.DLL.VIR

Trojan.Downloader-Gen/DriverM
C:\WINNT\SYSTEM32\DRIVERJ.DLL
C:\WINNT\SYSTEM32\DRIVERL.DLL

————— END - END - END —————


————— Logfile of HijackThis v1.99.1 —————
————— Scan saved at 1:51:27 PM, on 9/23/2007 —————


Logfile of HijackThis v1.99.1
Scan saved at 1:51:27 PM, on 9/23/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINNT\System32\NMSSvc.exe
C:\Program Files\Common Files\Lanovation\PrismXL\PRISMXL.SYS
C:\WINNT\wanmpsvc.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/home.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINNT\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.aol.com
O16 - DPF: {2DFF31F9-7893-4922-AF66-C9A1EB4EBB31} (Rhapsody Player Engine) - http://forms.real.com/real/player/download…ne_Inst_Win.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: igfxcui - C:\WINNT\
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Intel® NMS (NMSSvc) - Intel Corporation - C:\WINNT\System32\NMSSvc.exe
O23 - Service: PrismXL - Lanovation - C:\Program Files\Common Files\Lanovation\PrismXL\PRISMXL.SYS
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINNT\wanmpsvc.exe

————— END - END - END —————
Post #14
Hi

I would advise updating Adobe Reader, as the latest version clears up any vulnerabilities of previous versions.
First uninstall the version you have on your computer then download and install Adobe Reader 8.1.

This is my usual speech for when you are clean, which you appear to be.

Please follow these simple steps in order to keep your computer clean and secure:
Disable and Enable System Restore.

It's also a good idea to Flush your System Restore points after ridding yourself of malware:
  • Click Start | Help and Support | Undo changes to your computer with System Restore.
  • Click Create A Restore Point then click Next. Give it a name it and then click Create, then Close.
  • Close the Help and Support Center box.
  • Click Start | Run and type Cleanmgr
  • Select (C: ) then click OK.
  • Click the More Options tab.
  • Click Clean Up in the System Restore Section.
This will remove all previous restore points except the newly created one.

Here are some free programs, I recommend.

Install Spyware Guard
Download it from here
Find here the tutorial on how to use Spyware Guard here

Install SpyWare Blaster
Download it from here
Find here the tutorial on how to use Spyware Blaster here

Install WinPatrol
Download it from here
Here you can find information about how WinPatrol works here


Make sure your Windows is ALWAYS up to date!

An unpatched Windows is vulnerable and even with the "best" Antivirus and Firewall installed, malware will find its way through.
So visit http://windowsupdate.microsoft.com/ to download and install the latest updates.


Update your Antivirus programs and other security products regularly to avoid new threats that could infect your system.

Please check out Tony Klein's article "How did I get infected in the first place?"


Follow this list and your potential for being infected again will reduce dramatically.

Glad I was able to help.
Post #15
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI