What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Popup problems and more

6 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hey. For some weeks now i've been getting lots of popups. They appear every 10 min or so usually being about my system not being safe enough and telling to buy this and that virus program. I also get a lot of virus warnings from my virus program "avast" and when i try to delete the viruses they come back.

So far i tryed scanning with avast, ad-aware and trojanhunter to no succes.

I really need some help with this.

HJT log:

Logfile of HijackThis v1.99.1
Scan saved at 11:01:25, on 2007-10-02
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program\Alwil Software\Avast4\aswUpdSv.exe
C:\Program\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\Config\lsass.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program\ALWILS~1\Avast4\ashDisp.exe
C:\Program\Razer\razerhid.exe
C:\Program\Java\jre1.5.0_11\bin\jusched.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Program\DAEMON Tools\daemon.exe
C:\Program\ATI Technologies\ATI.ACE\cli.exe
C:\Program\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program\TrojanHunter 5.0\THGuard.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program\MSN Messenger\MsnMsgr.Exe
C:\Program\Hamachi\hamachi.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\Program\Razer\razertra.exe
C:\Program\Razer\razerofa.exe
C:\Program\Alwil Software\Avast4\ashMaiSv.exe
C:\Program\Alwil Software\Avast4\ashWebSv.exe
C:\Program\ATI Technologies\ATI.ACE\cli.exe
C:\Program\ATI Technologies\ATI.ACE\cli.exe
C:\Program\MSN Messenger\usnsvc.exe
C:\Program\Mozilla Firefox\firefox.exe
C:\Program\Java\jre1.5.0_11\bin\jucheck.exe
C:\Documents and Settings\Olof\Skrivbord\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.worldcybergames.com/5th/beyondthegame.wma
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Config\lsass.exe
O4 - HKLM\..\Run: [avast!] C:\Program\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [razer] C:\Program\Razer\razerhid.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program\Java\jre1.5.0_11\bin\jusched.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [ATICCC] "C:\Program\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [THGuard] "C:\Program\TrojanHunter 5.0\THGuard.exe"
O4 - HKLM\..\Run: [SearchIndexer] rundll32.exe "C:\WINDOWS\system32\ltjxbxjk.dll",sitypnow
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program\Delade filer\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [igndlm.exe] C:\Program\Download Manager\DLM.exe /windowsstart /startifwork
O4 - Startup: PowerReg Scheduler V3.exe
O4 - Startup: PowerReg Scheduler.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Hamachi.lnk = C:\Program\Hamachi\hamachi.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: Download all with Free Download Manager - file://C:\Program\Free Download Manager\dlall.htm
O8 - Extra context menu item: Download selected with Free Download Manager - file://C:\Program\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Download web site with Free Download Manager - file://C:\Program\Free Download Manager\dlpage.htm
O8 - Extra context menu item: Download with Free Download Manager - file://C:\Program\Free Download Manager\dllink.htm
O8 - Extra context menu item: E&xportera till Microsoft Excel - res://C:\Program\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java-konsol - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=48835
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (CDownloadCtrl Object) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.6.108.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{733DF7E4-F82E-4EC0-ABFE-45300DA5A11D}: NameServer = 192.168.0.1
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program\MSNMES~1\MSGRAP~1.DLL
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program\Delade filer\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
Post #2
Hi! Welcome to the WTT forums.
My name is Scotty. I would be glad to take a look at your log and help you with solving any malware problems. HijackThis logs can take a while to research.
Please be patient and I'd be grateful if you would note the following:
  • I will working be on your Malware issues, this may or may not, solve other issues you have with your machine.
  • The fixes are specific to your problem and should only be used for this issue on this machine.
  • Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
  • It's often worth reading through these instructions and printing them for ease of reference.
  • If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
  • Please reply to this thread. Do not start a new topic.

Rename HijackThis
There is a possibility an infection which is hiding part of the HijackThis log because it's called hijackthis.exe.
Please rename hijackthis.exe to iseeu.exe by right-clicking on the Desktop icon and selecting Rename.

Now scan again and post a new log, please.

Please make a uninstall list using HijackThis
To access the Uninstall Manager you would do the following:

1. Start HijackThis
2. Click on the Config button
3. Click on the Misc Tools button
4. Click on the Open Uninstall Manager button.
5. Click on the Save list… button and specify where you would like to save this file. When you press Save button a notepad will open with the contents of that file. Simply copy and paste the contents of that notepad here in a reply.
Post #3
Hey Scotty. Thanks for helping me out.

here's the new HJT log:

Logfile of HijackThis v1.99.1
Scan saved at 12:03:01, on 2007-10-02
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program\Alwil Software\Avast4\aswUpdSv.exe
C:\Program\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Config\lsass.exe
C:\Program\ALWILS~1\Avast4\ashDisp.exe
C:\Program\Razer\razerhid.exe
C:\Program\Java\jre1.5.0_11\bin\jusched.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Program\DAEMON Tools\daemon.exe
C:\Program\ATI Technologies\ATI.ACE\cli.exe
C:\Program\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program\TrojanHunter 5.0\THGuard.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program\MSN Messenger\MsnMsgr.Exe
C:\Program\Delade filer\Teleca Shared\CapabilityManager.exe
C:\Program\Hamachi\hamachi.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\Program\Razer\razertra.exe
C:\Program\Razer\razerofa.exe
C:\Program\Alwil Software\Avast4\ashMaiSv.exe
C:\Program\Alwil Software\Avast4\ashWebSv.exe
C:\Program\ATI Technologies\ATI.ACE\cli.exe
C:\Program\ATI Technologies\ATI.ACE\cli.exe
C:\Program\MSN Messenger\usnsvc.exe
C:\Program\Mozilla Firefox\firefox.exe
C:\Program\Java\jre1.5.0_11\bin\jucheck.exe
C:\Documents and Settings\Olof\Skrivbord\Hijackthis\iseeu.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.worldcybergames.com/5th/beyondthegame.wma
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Config\lsass.exe
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {187CA0D5-EF8F-4F8F-9941-32EC197AC696} - C:\WINDOWS\system32\awvtu.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program\Delade filer\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {CC358019-D328-40B4-8E2D-818CE142616C} - C:\WINDOWS\system32\gebxuuv.dll (file missing)
O2 - BHO: (no name) - {E1D78646-E57E-45E9-854B-4983DC38D133} - C:\WINDOWS\system32\vtstr.dll (file missing)
O4 - HKLM\..\Run: [avast!] C:\Program\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [razer] C:\Program\Razer\razerhid.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program\Java\jre1.5.0_11\bin\jusched.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [ATICCC] "C:\Program\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [THGuard] "C:\Program\TrojanHunter 5.0\THGuard.exe"
O4 - HKLM\..\Run: [SearchIndexer] rundll32.exe "C:\WINDOWS\system32\ltjxbxjk.dll",sitypnow
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program\Delade filer\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [igndlm.exe] C:\Program\Download Manager\DLM.exe /windowsstart /startifwork
O4 - Startup: PowerReg Scheduler V3.exe
O4 - Startup: PowerReg Scheduler.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Hamachi.lnk = C:\Program\Hamachi\hamachi.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: Download all with Free Download Manager - file://C:\Program\Free Download Manager\dlall.htm
O8 - Extra context menu item: Download selected with Free Download Manager - file://C:\Program\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Download web site with Free Download Manager - file://C:\Program\Free Download Manager\dlpage.htm
O8 - Extra context menu item: Download with Free Download Manager - file://C:\Program\Free Download Manager\dllink.htm
O8 - Extra context menu item: E&xportera till Microsoft Excel - res://C:\Program\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java-konsol - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=48835
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (CDownloadCtrl Object) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.6.108.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{733DF7E4-F82E-4EC0-ABFE-45300DA5A11D}: NameServer = 192.168.0.1
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: gebxuuv - gebxuuv.dll (file missing)
O20 - Winlogon Notify: vtstr - C:\WINDOWS\system32\vtstr.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program\Delade filer\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

And the uninstall thing:

µTorrent
Ad-Aware SE Personal
Adobe Flash Player 9 ActiveX
Adobe Reader 7.0.9
Adobe® Photoshop® Album Starter Edition 3.0
Adobe® Photoshop® Album Starter Edition 3.0.1
Aliens vs. Predator 2
AltoMP3 Gold 5.06
ATI - Software Uninstall Utility
ATI Catalyst Control Center
ATI Catalyst Control Center
ATI Display Driver
avast! Antivirus
Battlefield 2™
ConvertXtoDVD 2.2.3.258
Counter-Strike
Counter-Strike 1.0
Dawn of War - Dark Crusade
Dawn Of War - Winter Assault
DawnOfWar
DC++ 0.699
Disc2Phone
DivX
DivX Converter
DivX Player
DivX Web Player
DivxToDVD 0.5.2
Download Manager 2.3.6
Enemy Territory - QUAKE Wars™ Demo
Free Download Manager 2.0
GTA San Andreas
Hamachi 1.0.1.4
Hijackthis 1.99.1
HijackThis 1.99.1
Homeworld2
Hotfix for Windows XP (KB915865)
J2SE Runtime Environment 5.0 Update 10
J2SE Runtime Environment 5.0 Update 11
J2SE Runtime Environment 5.0 Update 6
J2SE Runtime Environment 5.0 Update 9
Majesty - Gold Edition
Medieval II Total War
Medieval II Total War : Kingdoms : Americas
Medieval II Total War : Kingdoms : Britannia
Medieval II Total War : Kingdoms : Crusades
Medieval II Total War : Kingdoms : Teutonic
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft .NET Framework 2.0
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft Motocross Madness 2
Microsoft National Language Support Downlevel APIs
Microsoft Office XP Standard
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual J# .NET Redistributable Package 1.1
Mozilla Firefox (2.0.0.7)
MP3 Converter Simple
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
Mythos
N.A.W Cat Island
N.A.W Daqing Oilfields
N.A.W Desert Rats
N.A.W Desert Storm
N.A.W Dragon Valley
Neverwinter Nights 2
NVIDIA Drivers
PartyPoker
PCMark05
PlayLinc
Project Reality v0.6.0.9
QuickTime
Razer
Realtek AC'97 Audio
Rome - Total War™
Security Update för Microsoft .NET Framework 2.0 (kB928365)
Skype 2.5
Snabbkorrigering för Windows XP (KB914440)
Sony Ericsson PC Suite 1.20.173
SpeechRedist
SpeedFan (remove only)
Steam
Steam
Säkerhetsuppdatering för Windows Internet Explorer 7 (KB928090)
Säkerhetsuppdatering för Windows Internet Explorer 7 (KB931768)
Säkerhetsuppdatering för Windows Internet Explorer 7 (KB933566)
Säkerhetsuppdatering för Windows Internet Explorer 7 (KB937143)
Säkerhetsuppdatering för Windows Internet Explorer 7 (KB938127)
Säkerhetsuppdatering för Windows Media Player (KB911564)
Säkerhetsuppdatering för Windows Media Player 10 (KB911565)
Säkerhetsuppdatering för Windows Media Player 10 (KB917734)
Säkerhetsuppdatering för Windows Media Player 10 (KB936782)
Säkerhetsuppdatering för Windows Media Player 6.4 (KB925398)
Säkerhetsuppdatering för Windows XP (KB890046)
Säkerhetsuppdatering för Windows XP (KB893756)
Säkerhetsuppdatering för Windows XP (KB896358)
Säkerhetsuppdatering för Windows XP (KB896422)
Säkerhetsuppdatering för Windows XP (KB896423)
Säkerhetsuppdatering för Windows XP (KB896424)
Säkerhetsuppdatering för Windows XP (KB896428)
Säkerhetsuppdatering för Windows XP (KB899587)
Säkerhetsuppdatering för Windows XP (KB899591)
Säkerhetsuppdatering för Windows XP (KB900725)
Säkerhetsuppdatering för Windows XP (KB901017)
Säkerhetsuppdatering för Windows XP (KB901214)
Säkerhetsuppdatering för Windows XP (KB902400)
Säkerhetsuppdatering för Windows XP (KB904706)
Säkerhetsuppdatering för Windows XP (KB905414)
Säkerhetsuppdatering för Windows XP (KB905749)
Säkerhetsuppdatering för Windows XP (KB905915)
Säkerhetsuppdatering för Windows XP (KB908519)
Säkerhetsuppdatering för Windows XP (KB908531)
Säkerhetsuppdatering för Windows XP (KB911280)
Säkerhetsuppdatering för Windows XP (KB911562)
Säkerhetsuppdatering för Windows XP (KB911567)
Säkerhetsuppdatering för Windows XP (KB911927)
Säkerhetsuppdatering för Windows XP (KB912812)
Säkerhetsuppdatering för Windows XP (KB912919)
Säkerhetsuppdatering för Windows XP (KB913446)
Säkerhetsuppdatering för Windows XP (KB913580)
Säkerhetsuppdatering för Windows XP (KB914388)
Säkerhetsuppdatering för Windows XP (KB914389)
Säkerhetsuppdatering för Windows XP (KB916281)
Säkerhetsuppdatering för Windows XP (KB917159)
Säkerhetsuppdatering för Windows XP (KB917344)
Säkerhetsuppdatering för Windows XP (KB917422)
Säkerhetsuppdatering för Windows XP (KB917953)
Säkerhetsuppdatering för Windows XP (KB918118)
Säkerhetsuppdatering för Windows XP (KB918439)
Säkerhetsuppdatering för Windows XP (KB918899)
Säkerhetsuppdatering för Windows XP (KB919007)
Säkerhetsuppdatering för Windows XP (KB920213)
Säkerhetsuppdatering för Windows XP (KB920214)
Säkerhetsuppdatering för Windows XP (KB920670)
Säkerhetsuppdatering för Windows XP (KB920683)
Säkerhetsuppdatering för Windows XP (KB920685)
Säkerhetsuppdatering för Windows XP (KB921398)
Säkerhetsuppdatering för Windows XP (KB921503)
Säkerhetsuppdatering för Windows XP (KB921883)
Säkerhetsuppdatering för Windows XP (KB922616)
Säkerhetsuppdatering för Windows XP (KB922760)
Säkerhetsuppdatering för Windows XP (KB922819)
Säkerhetsuppdatering för Windows XP (KB923191)
Säkerhetsuppdatering för Windows XP (KB923414)
Säkerhetsuppdatering för Windows XP (KB923689)
Säkerhetsuppdatering för Windows XP (KB923694)
Säkerhetsuppdatering för Windows XP (KB923980)
Säkerhetsuppdatering för Windows XP (KB924191)
Säkerhetsuppdatering för Windows XP (KB924270)
Säkerhetsuppdatering för Windows XP (KB924496)
Säkerhetsuppdatering för Windows XP (KB924667)
Säkerhetsuppdatering för Windows XP (KB925454)
Säkerhetsuppdatering för Windows XP (KB925486)
Säkerhetsuppdatering för Windows XP (KB925902)
Säkerhetsuppdatering för Windows XP (KB926255)
Säkerhetsuppdatering för Windows XP (KB926436)
Säkerhetsuppdatering för Windows XP (KB927779)
Säkerhetsuppdatering för Windows XP (KB927802)
Säkerhetsuppdatering för Windows XP (KB928255)
Säkerhetsuppdatering för Windows XP (KB928843)
Säkerhetsuppdatering för Windows XP (KB929123)
Säkerhetsuppdatering för Windows XP (KB930178)
Säkerhetsuppdatering för Windows XP (KB931261)
Säkerhetsuppdatering för Windows XP (KB931784)
Säkerhetsuppdatering för Windows XP (KB932168)
Säkerhetsuppdatering för Windows XP (KB935839)
Säkerhetsuppdatering för Windows XP (KB935840)
Säkerhetsuppdatering för Windows XP (KB936021)
Säkerhetsuppdatering för Windows XP (KB938829)
TeamSpeak 2 RC2
TrojanHunter 5.0
UltraStar 0.5.2
Unreal Tournament 2004
Uppdatering för Windows XP (KB894391)
Uppdatering för Windows XP (KB898461)
Uppdatering för Windows XP (KB900485)
Uppdatering för Windows XP (KB904942)
Uppdatering för Windows XP (KB910437)
Uppdatering för Windows XP (KB916595)
Uppdatering för Windows XP (KB920872)
Uppdatering för Windows XP (KB922582)
Uppdatering för Windows XP (KB927891)
Uppdatering för Windows XP (KB929338)
Uppdatering för Windows XP (KB930916)
Uppdatering för Windows XP (KB931836)
Uppdatering för Windows XP (KB933360)
Uppdatering för Windows XP (KB938828)
WC3Banlist
Ventrilo
VideoLAN VLC media player 0.8.6
Winamp (remove only)
Windows Installer 3.1 (KB893803)
Windows Internet Explorer 7
Windows Live Messenger
Windows Live Sign-in Assistant
Windows Media Encoder 9 Series
Windows Media Encoder 9 Series
Windows Media Format Runtime
Windows Media Player 10
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885250
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB885884
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB887742
Windows XP Hotfix - KB888113
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB891781
winLAME prerelease4
WinPcap 3.1
WinRAR archiver
World in Conflict - DEMO
VSO Inspector [removed]
Xfire (remove only)
ZoneAlarm
Post #4
Hi

P2P Warning!
Please note that as long as you are using any form of Peer-to-Peer networking and downloading files from non-documented sources, you can expect infestations of malware to occur
Once upon a time, P2P file sharing was fairly safe. That is no longer true. You may continue to use P2P sharing at your own risk; however, please keep in mind that this practice may be the source of your current malware infestation
Additional information on the safety of Peer to Peer programs themselves is here :
Clean/Infected P2P Programs
Please refrain from using your P2P during the course of your fix, so you dont risk inviting more malware onto your computer.

Download and Run ComboFix
  • Download this file from below:

    Here
  • Disconnect from the Internet, than disable your anti-virus and any real-time anti-spyware monitors that are running.
  • Then double click combofix.exe & follow the prompts.
  • When finished, it shall produce a log for you. Post that log in your next reply with a new HijackThis log.
Note 1: Do not mouseclick combofix's window whilst it's running. That may cause it to stall
Note 2:Remember to re-enable your anti-virus and anti-spyware before reconnecting to the Internet.
Post #5
though you're probably right about the P2P I use it so much right now so i think it's worth the risk. But i'll try to be more carfull in the future.

But anyway here's the log:

ComboFix 07-10-02.2 - Olof 2007-10-02 13:57:20.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1053.18.1510 [GMT 2:00]
Running from: C:\Documents and Settings\[removed]\Skrivbord\Filer\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\check_LSA7.txt
C:\country.exe
C:\Documents and Settings\Olof\Application Data\inst.exe
C:\ms1.exe
C:\tool1.exe
C:\tool2.exe
C:\tool3.exe
C:\tool4.exe
C:\tool5.exe
C:\toolbar.exe
C:\WINDOWS\cookies.ini
C:\WINDOWS\hosts
C:\WINDOWS\system32\anykonnb.dll
C:\WINDOWS\system32\awvtu.dll
C:\WINDOWS\system32\axilmhqc.ini
C:\WINDOWS\system32\bnnokyna.ini
C:\WINDOWS\system32\cqhmlixa.dll
C:\WINDOWS\system32\dctstkfs.dll
C:\WINDOWS\system32\frultcks.dll
C:\WINDOWS\system32\kjxbxjtl.ini
C:\WINDOWS\system32\ltjxbxjk.dll
C:\WINDOWS\system32\sfktstcd.ini
C:\WINDOWS\system32\skctlurf.ini
C:\WINDOWS\system32\utvwa.bak1
C:\WINDOWS\system32\utvwa.bak2
C:\WINDOWS\system32\utvwa.ini

.
((((((((((((((((((((((((( Files Created from 2007-09-02 to 2007-10-02 )))))))))))))))))))))))))))))))
.

2007-10-02 13:54 51,200 –a—— C:\WINDOWS\NirCmd.exe
2007-10-01 14:51 d——– C:\Documents and Settings\Olof\Application Data\TrojanHunter
2007-10-01 14:17 d——– C:\Program\TrojanHunter 5.0
2007-09-30 12:29 d——– C:\WINDOWS\pss
2007-09-30 12:20 d——– C:\Program\Sony Ericsson
2007-09-29 23:53 d——– C:\Program\Rockstar Games
2007-09-29 20:09 43,520 –a—— C:\WINDOWS\system32\CmdLineExt03.dll
2007-09-29 03:42 d——– C:\Program\directx
2007-09-29 03:38 d——– C:\Program\Fox
2007-09-29 03:37 21,840 –a—-t- C:\WINDOWS\system32\SIntfNT.dll
2007-09-29 03:37 17,212 –a—-t- C:\WINDOWS\system32\SIntf32.dll
2007-09-29 03:37 12,067 –a—-t- C:\WINDOWS\system32\SIntf16.dll
2007-09-28 23:53 d——– C:\Program\Microsoft Games
2007-09-28 21:43 d——– C:\UT2004
2007-09-28 19:38 d——– C:\Program\Steam
2007-09-28 19:31 d——– C:\Program\DC++
2007-09-27 11:45 d——– C:\Program\Download Manager
2007-09-27 11:45 d——– C:\Documents and Settings\Olof\Application Data\IGN_DLM
2007-09-21 20:03 8,900,640 –ahs—- C:\WINDOWS\system32\drivers\fidbox.dat
2007-09-21 20:00 d——– C:\Documents and Settings\All Users\Application Data\MailFrontier
2007-09-20 15:52 d——– C:\Documents and Settings\Olof\Application Data\Bioshock
2007-09-16 15:12 d——– C:\Program\Sierra
2007-09-14 17:21 d——– C:\Documents and Settings\All Users\Application Data\vsosdk
2007-09-13 17:21 217,127 –a—— C:\WINDOWS\system32\drv43260.dll
2007-09-13 17:21 208,935 –a—— C:\WINDOWS\system32\drv33260.dll
2007-09-13 17:21 176,165 –a—— C:\WINDOWS\system32\drv23260.dll
2007-09-13 16:54 d——– C:\Documents and Settings\Olof\Application Data\Nero
2007-09-12 16:53 363,520 –a–c— C:\WINDOWS\system32\dllcache\psisdecd.dll
2007-09-12 16:53 363,520 –a—— C:\WINDOWS\system32\PsisDecd.dll
2007-09-12 16:53 15,360 –a–c— C:\WINDOWS\system32\dllcache\mpe.sys
2007-09-12 16:53 15,360 –a—— C:\WINDOWS\system32\drivers\MPE.sys
2007-09-12 16:53 11,776 –a–c— C:\WINDOWS\system32\dllcache\bdasup.sys
2007-09-12 16:53 11,776 –a—— C:\WINDOWS\system32\drivers\BdaSup.sys
2007-09-12 16:46 169,344 –a—— C:\WINDOWS\system32\drivers\atinavt2.sys
2007-09-12 16:25 66,872 –a—— C:\WINDOWS\system32\PnkBstrA.exe
2007-09-12 16:25 22,328 –a—— C:\WINDOWS\system32\drivers\PnkBstrK.sys
2007-09-12 16:25 22,328 –a—— C:\Documents and Settings\Olof\Application Data\PnkBstrK.sys
2007-09-12 16:25 103,736 –a—— C:\WINDOWS\system32\PnkBstrB.exe
2007-09-12 16:22 d——– C:\Program\id Software

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-10-02 14:00 105356 –ahs—- C:\WINDOWS\system32\drivers\fidbox.idx
2007-10-02 13:59 ——— d——– C:\Documents and Settings\Olof\Application Data\Hamachi
2007-10-02 13:44 ——— d——– C:\Program\Warcraft III
2007-10-02 11:54 ——— d——– C:\Documents and Settings\Olof\Application Data\uTorrent
2007-09-30 12:20 ——— d——– C:\Program\Delade filer\Teleca Shared
2007-09-30 01:25 ——— d——– C:\Program\Counter-Strike
2007-09-29 23:53 ——— d–h—– C:\Program\InstallShield Installation Information
2007-09-18 22:02 ——— d——– C:\Documents and Settings\Olof\Application Data\Vso
2007-09-16 15:30 682 –a—— C:\Program\INSTALL.LOG
2007-09-15 13:45 ——— d——– C:\Program\vso
2007-09-14 17:21 ——— d——– C:\Documents and Settings\All Users\Application Data\vsosdk
2007-09-13 17:32 ——— d——– C:\Program\MSN Messenger
2007-09-13 17:21 47360 –a—— C:\WINDOWS\system32\drivers\pcouffin.sys
2007-09-13 17:21 47360 –a—— C:\Documents and Settings\Olof\Application Data\pcouffin.sys
2007-09-13 17:07 ——— d——– C:\Documents and Settings\Olof\Application Data\Ahead
2007-09-12 16:51 ——— d——– C:\Documents and Settings\Olof\Application Data\ATI
2007-09-12 16:48 ——— d——– C:\Program\ATI Technologies
2007-09-12 15:26 ——— d——– C:\Documents and Settings\Olof\Application Data\Free Download Manager
2007-09-06 16:14 75248 –a—— C:\WINDOWS\zllsputility.exe
2007-09-06 12:05 94416 –a—— C:\WINDOWS\system32\drivers\aswmon2.sys
2007-09-06 12:05 92848 –a—— C:\WINDOWS\system32\drivers\aswmon.sys
2007-09-06 12:03 23152 –a—— C:\WINDOWS\system32\drivers\aswRdr.sys
2007-09-06 12:02 42912 –a—— C:\WINDOWS\system32\drivers\aswTdi.sys
2007-09-06 12:00 26624 –a—— C:\WINDOWS\system32\drivers\aavmker4.sys
2007-08-30 18:06 ——— d——– C:\Documents and Settings\Olof\Application Data\Skype
2007-08-28 17:35 ——— d——– C:\Program\Flagship Studios
2007-08-25 15:31 ——— d——– C:\Program\Sierra Entertainment
2007-08-25 15:27 ——— d——– C:\Program\WAR
2007-08-22 15:22 ——— d——– C:\Program\Nero
2007-08-20 19:22 ——— d——– C:\Program\Vodei
2007-08-19 18:24 ——— d——– C:\Program\DaemonTools_WhenUSave_Installer
2007-08-19 11:49 ——— d——– C:\Program\Infogrames Interactive
2007-08-06 14:32 ——— d——– C:\Program\WC3Banlist
2007-08-04 13:56 ——— d——– C:\Program\WinPcap
2006-08-09 20:15 1 –a—— C:\Documents and Settings\Olof\SI.bin
2003-12-18 11:33 20102 –a—— C:\Program\Readme.txt
2003-09-03 07:46 10960 –a—— C:\Program\EULA.txt
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E1D78646-E57E-45E9-854B-4983DC38D133}]
C:\WINDOWS\system32\vtstr.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="C:\Program\ALWILS~1\Avast4\ashDisp.exe" [2007-09-06 12:06]
"razer"="C:\Program\Razer\razerhid.exe" [2005-05-17 19:21]
"QuickTime Task"="C:\Program\QuickTime\qttask.exe" [2006-03-17 16:59]
"SunJavaUpdateSched"="C:\Program\Java\jre1.5.0_11\bin\jusched.exe" [2006-12-15 03:23]
"SoundMan"="SOUNDMAN.EXE" [2006-01-11 16:08 C:\WINDOWS\soundman.exe]
"Sony Ericsson PC Suite"="C:\Program\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 16:17]
"Adobe Photo Downloader"="C:\Program\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-07 00:46]
"DAEMON Tools"="C:\Program\DAEMON Tools\daemon.exe" [2006-11-12 12:48]
"ATICCC"="C:\Program\ATI Technologies\ATI.ACE\cli.exe" [2005-08-12 15:43]
"ZoneAlarm Client"="C:\Program\Zone Labs\ZoneAlarm\zlclient.exe" [2007-09-06 16:14]
"THGuard"="C:\Program\TrojanHunter 5.0\THGuard.exe" [2007-09-09 09:31]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 14:00]
"MsnMsgr"="C:\Program\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program\Delade filer\Ahead\Lib\NMBgMonitor.exe" []
"igndlm.exe"="C:\Program\Download Manager\DLM.exe" [2007-03-05 23:57]

C:\Documents and Settings\All Users\Start-meny\Program\Autostart\
Adobe Reader Speed Launch.lnk - C:\Program\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26]
Hamachi.lnk - C:\Program\Hamachi\hamachi.exe [2006-11-30 17:53:00]
Microsoft Office.lnk - C:\Program\Microsoft Office\Office10\OSA.EXE [2001-02-13 10:01:04]

C:\Documents and Settings\Olof\Start-meny\Program\Autostart\
PowerReg Scheduler V3.exe [2006-10-03 15:14:28]
PowerReg Scheduler.exe [2007-08-19 11:52:45]

C:\Documents and Settings\All Users\Start-meny\Program\Autostart\
Adobe Reader Speed Launch.lnk - C:\Program\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26]
Hamachi.lnk - C:\Program\Hamachi\hamachi.exe [2006-11-30 17:53:00]
Microsoft Office.lnk - C:\Program\Microsoft Office\Office10\OSA.EXE [2001-02-13 10:01:04]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\gebxuuv]
gebxuuv.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\vtstr]
C:\WINDOWS\system32\vtstr.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
"c:\program\steam\steam.exe" -silent

R0 nvcchflt;NVIDIA Disk Cache Filter Driver;C:\WINDOWS\system32\DRIVERS\nvcchflt.sys
R3 Razerlow;Razerlow USB Filter Driver;C:\WINDOWS\system32\Drivers\Razerlow.sys
S3 hamachi_oem;PlayLinc Adapter;C:\WINDOWS\system32\DRIVERS\gan_adapter.sys
S3 mdxgthkn;mdxgthkn;\??\C:\DOCUME~1\Olof\LOKALA~1\Temp\mdxgthkn.sys
S3 NPF;NetGroup Packet Filter Driver;C:\WINDOWS\system32\drivers\npf.sys


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{12ae9f0b-ab72-11da-b037-00508d7dc620}]
AutoRun\command- E:\AutoPlay.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c757b241-9e4b-11da-af66-806d6172696f}]
AutoRun\command- D:\Autorun.exe root.ini

.
**************************************************************************

catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-10-02 14:02:21
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

C:\WINDOWS\WindowsUpdate.log
C:\WINDOWS\winhelp.exe
C:\WINDOWS\winhlp32.exe
C:\WINDOWS\winnt.bmp
C:\WINDOWS\winnt256.bmp
C:\WINDOWS\WinSxS
C:\WINDOWS\wmprfSVE.prx
C:\WINDOWS\wmsetup.log
C:\WINDOWS\wmsetup10.log
C:\WINDOWS\WMSysPr9.prx
C:\WINDOWS\WORDPAD.INI
C:\WINDOWS\zllsputility.exe
C:\WINDOWS\_default.pif
C:\WINDOWS\_nvidia_xxx_.log
C:\WINDOWS\Ärgad koppar.bmp
C:\WINDOWS\Ökensand.bmp
C:\WINDOWS\WindowsShell.Manifest
C:\WINDOWS\win.tmp

scan completed successfully
hidden files: 18

**************************************************************************
.
Completion time: 2007-10-02 14:04:23 - machine was rebooted
C:\ComboFix-quarantined-files.txt … 2007-10-02 14:04
.
— E O F —
Post #6
Hi

Open Notepad and Copy/Paste the text in the codebox below into it: 

File::
C:\WINDOWS\system32\vtstr.dll
C:\DOCUME~1\Olof\LOKALA~1\Temp\mdxgthkn.sys
 
Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E1D78646-E57E-45E9-854B-4983DC38D133}]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\gebxuuv]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\vtstr]
 
Driver::
mdxgthkn

Save this as "CFScript"

[external image: Posted Image]


Refering to the picture above, drag CFScript into ComboFix.exe
Then post the resultant log.

Download ATF (Atribune Temp File) Cleaner� by Atribune to your desktop.

Double-click ATF Cleaner.exe to open it.

Under Main choose:
Windows Temp
Current User Temp
All Users Temp
Cookies
Temporary Internet Files
Prefetch
Java Cache
*The other boxes are optional*
Then click the Empty Selected button.

Firefox:
Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

Opera:
Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

Click Exit on the Main menu to close the program.

*Note* If you do not have Firefox or Opera, those options will be greyed out.


Please do an online scan with Kaspersky Online Scanner. You will be prompted to install an ActiveX component from Kaspersky, Click Yes.
  • The program will launch and then start to download the latest definition files.
  • Once the scanner is installed and the definitions downloaded, click Next.
  • Now click on Scan Settings
  • In the scan settings make sure that the following are selected:
    • Scan using the following Anti-Virus database:

      + Extended(If available otherwise Standard)
    • Scan Options:

      + Scan Archives
      + Scan Mail Bases
  • Click OK
  • Now under select a target to scan select My Computer
  • The scan will take a while so be patient and let it run. Once the scan is complete it will display if your system has been infected.
  • Now click on the Save as Text button
  • Save the file to your desktop.
  • Copy and paste that information in your next post with a new HijackThis log.
Post #7
Hi again Scotty.

ComboFix 07-10-02.2 - Olof 2007-10-02 15:23:52.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1053.18.1480 [GMT 2:00]
Running from: C:\Documents and Settings\[removed]\Skrivbord\ComboFix.exe
Command switches used :: C:\Documents and Settings\Olof\Skrivbord\CFScript.txt
* Created a new restore point

FILE::
C:\WINDOWS\system32\vtstr.dll
C:\DOCUME~1\Olof\LOKALA~1\Temp\mdxgthkn.sys
.

((((((((((((((((((((((((( Files Created from 2007-09-02 to 2007-10-02 )))))))))))))))))))))))))))))))
.

2007-10-02 13:54 51,200 –a—— C:\WINDOWS\NirCmd.exe
2007-10-01 14:51 d——– C:\Documents and Settings\Olof\Application Data\TrojanHunter
2007-10-01 14:17 d——– C:\Program\TrojanHunter 5.0
2007-09-30 12:29 d——– C:\WINDOWS\pss
2007-09-30 12:20 d——– C:\Program\Sony Ericsson
2007-09-29 23:53 d——– C:\Program\Rockstar Games
2007-09-29 20:09 43,520 –a—— C:\WINDOWS\system32\CmdLineExt03.dll
2007-09-29 03:42 d——– C:\Program\directx
2007-09-29 03:38 d——– C:\Program\Fox
2007-09-29 03:37 21,840 –a—-t- C:\WINDOWS\system32\SIntfNT.dll
2007-09-29 03:37 17,212 –a—-t- C:\WINDOWS\system32\SIntf32.dll
2007-09-29 03:37 12,067 –a—-t- C:\WINDOWS\system32\SIntf16.dll
2007-09-28 23:53 d——– C:\Program\Microsoft Games
2007-09-28 21:43 d——– C:\UT2004
2007-09-28 19:38 d——– C:\Program\Steam
2007-09-28 19:31 d——– C:\Program\DC++
2007-09-27 11:45 d——– C:\Program\Download Manager
2007-09-27 11:45 d——– C:\Documents and Settings\Olof\Application Data\IGN_DLM
2007-09-21 20:03 8,931,360 –ahs—- C:\WINDOWS\system32\drivers\fidbox.dat
2007-09-21 20:00 d——– C:\Documents and Settings\All Users\Application Data\MailFrontier
2007-09-20 15:52 d——– C:\Documents and Settings\Olof\Application Data\Bioshock
2007-09-16 15:12 d——– C:\Program\Sierra
2007-09-14 17:21 d——– C:\Documents and Settings\All Users\Application Data\vsosdk
2007-09-13 17:21 217,127 –a—— C:\WINDOWS\system32\drv43260.dll
2007-09-13 17:21 208,935 –a—— C:\WINDOWS\system32\drv33260.dll
2007-09-13 17:21 176,165 –a—— C:\WINDOWS\system32\drv23260.dll
2007-09-13 16:54 d——– C:\Documents and Settings\Olof\Application Data\Nero
2007-09-12 16:53 363,520 –a–c— C:\WINDOWS\system32\dllcache\psisdecd.dll
2007-09-12 16:53 363,520 –a—— C:\WINDOWS\system32\PsisDecd.dll
2007-09-12 16:53 15,360 –a–c— C:\WINDOWS\system32\dllcache\mpe.sys
2007-09-12 16:53 15,360 –a—— C:\WINDOWS\system32\drivers\MPE.sys
2007-09-12 16:53 11,776 –a–c— C:\WINDOWS\system32\dllcache\bdasup.sys
2007-09-12 16:53 11,776 –a—— C:\WINDOWS\system32\drivers\BdaSup.sys
2007-09-12 16:46 169,344 –a—— C:\WINDOWS\system32\drivers\atinavt2.sys
2007-09-12 16:25 66,872 –a—— C:\WINDOWS\system32\PnkBstrA.exe
2007-09-12 16:25 22,328 –a—— C:\WINDOWS\system32\drivers\PnkBstrK.sys
2007-09-12 16:25 22,328 –a—— C:\Documents and Settings\Olof\Application Data\PnkBstrK.sys
2007-09-12 16:25 103,736 –a—— C:\WINDOWS\system32\PnkBstrB.exe
2007-09-12 16:22 d——– C:\Program\id Software

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-10-02 15:30 ——— d——– C:\Documents and Settings\Olof\Application Data\Hamachi
2007-10-02 15:27 105692 –ahs—- C:\WINDOWS\system32\drivers\fidbox.idx
2007-10-02 15:04 ——— d——– C:\Program\Warcraft III
2007-10-02 11:54 ——— d——– C:\Documents and Settings\Olof\Application Data\uTorrent
2007-09-30 12:20 ——— d——– C:\Program\Delade filer\Teleca Shared
2007-09-30 01:25 ——— d——– C:\Program\Counter-Strike
2007-09-29 23:53 ——— d–h—– C:\Program\InstallShield Installation Information
2007-09-18 22:02 ——— d——– C:\Documents and Settings\Olof\Application Data\Vso
2007-09-16 15:30 682 –a—— C:\Program\INSTALL.LOG
2007-09-15 13:45 ——— d——– C:\Program\vso
2007-09-14 17:21 ——— d——– C:\Documents and Settings\All Users\Application Data\vsosdk
2007-09-13 17:32 ——— d——– C:\Program\MSN Messenger
2007-09-13 17:21 47360 –a—— C:\WINDOWS\system32\drivers\pcouffin.sys
2007-09-13 17:21 47360 –a—— C:\Documents and Settings\Olof\Application Data\pcouffin.sys
2007-09-13 17:07 ——— d——– C:\Documents and Settings\Olof\Application Data\Ahead
2007-09-12 16:51 ——— d——– C:\Documents and Settings\Olof\Application Data\ATI
2007-09-12 16:48 ——— d——– C:\Program\ATI Technologies
2007-09-12 15:26 ——— d——– C:\Documents and Settings\Olof\Application Data\Free Download Manager
2007-09-06 16:14 75248 –a—— C:\WINDOWS\zllsputility.exe
2007-09-06 12:05 94416 –a—— C:\WINDOWS\system32\drivers\aswmon2.sys
2007-09-06 12:05 92848 –a—— C:\WINDOWS\system32\drivers\aswmon.sys
2007-09-06 12:03 23152 –a—— C:\WINDOWS\system32\drivers\aswRdr.sys
2007-09-06 12:02 42912 –a—— C:\WINDOWS\system32\drivers\aswTdi.sys
2007-09-06 12:00 26624 –a—— C:\WINDOWS\system32\drivers\aavmker4.sys
2007-08-30 18:06 ——— d——– C:\Documents and Settings\Olof\Application Data\Skype
2007-08-28 17:35 ——— d——– C:\Program\Flagship Studios
2007-08-25 15:31 ——— d——– C:\Program\Sierra Entertainment
2007-08-25 15:27 ——— d——– C:\Program\WAR
2007-08-22 15:22 ——— d——– C:\Program\Nero
2007-08-20 19:22 ——— d——– C:\Program\Vodei
2007-08-19 18:24 ——— d——– C:\Program\DaemonTools_WhenUSave_Installer
2007-08-19 11:49 ——— d——– C:\Program\Infogrames Interactive
2007-08-06 14:32 ——— d——– C:\Program\WC3Banlist
2007-08-04 13:56 ——— d——– C:\Program\WinPcap
2006-08-09 20:15 1 –a—— C:\Documents and Settings\Olof\SI.bin
2003-12-18 11:33 20102 –a—— C:\Program\Readme.txt
2003-09-03 07:46 10960 –a—— C:\Program\EULA.txt
.

((((((((((((((((((((((((((((( snapshot@2007-10-02_14.04.01.93 )))))))))))))))))))))))))))))))))))))))))
.
—-a-w 62,344 2007-10-02 12:05:29 C:\WINDOWS\system32\perfc009.dat
—-a-w 73,728 2007-10-02 12:05:29 C:\WINDOWS\system32\perfc01D.dat
—-a-w 401,064 2007-10-02 12:05:29 C:\WINDOWS\system32\perfh009.dat
—-a-w 404,004 2007-10-02 12:05:29 C:\WINDOWS\system32\perfh01D.dat
—-atw 16,384 2007-10-02 13:28:26 C:\WINDOWS\Temp\Perflib_Perfdata_794.dat
.
—-a-w 62,344 2007-07-12 01:02:32 C:\WINDOWS\system32\perfc009.dat
—-a-w 73,728 2007-07-12 01:02:32 C:\WINDOWS\system32\perfc01D.dat
—-a-w 401,064 2007-07-12 01:02:32 C:\WINDOWS\system32\perfh009.dat
—-a-w 404,004 2007-07-12 01:02:32 C:\WINDOWS\system32\perfh01D.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="C:\Program\ALWILS~1\Avast4\ashDisp.exe" [2007-09-06 12:06]
"razer"="C:\Program\Razer\razerhid.exe" [2005-05-17 19:21]
"QuickTime Task"="C:\Program\QuickTime\qttask.exe" [2006-03-17 16:59]
"SunJavaUpdateSched"="C:\Program\Java\jre1.5.0_11\bin\jusched.exe" [2006-12-15 03:23]
"SoundMan"="SOUNDMAN.EXE" [2006-01-11 16:08 C:\WINDOWS\soundman.exe]
"Sony Ericsson PC Suite"="C:\Program\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 16:17]
"Adobe Photo Downloader"="C:\Program\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-07 00:46]
"DAEMON Tools"="C:\Program\DAEMON Tools\daemon.exe" [2006-11-12 12:48]
"ATICCC"="C:\Program\ATI Technologies\ATI.ACE\cli.exe" [2005-08-12 15:43]
"ZoneAlarm Client"="C:\Program\Zone Labs\ZoneAlarm\zlclient.exe" [2007-09-06 16:14]
"THGuard"="C:\Program\TrojanHunter 5.0\THGuard.exe" [2007-09-09 09:31]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 14:00]
"MsnMsgr"="C:\Program\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program\Delade filer\Ahead\Lib\NMBgMonitor.exe" []
"igndlm.exe"="C:\Program\Download Manager\DLM.exe" [2007-03-05 23:57]

C:\Documents and Settings\All Users\Start-meny\Program\Autostart\
Adobe Reader Speed Launch.lnk - C:\Program\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26]
Hamachi.lnk - C:\Program\Hamachi\hamachi.exe [2006-11-30 17:53:00]
Microsoft Office.lnk - C:\Program\Microsoft Office\Office10\OSA.EXE [2001-02-13 10:01:04]

C:\Documents and Settings\Olof\Start-meny\Program\Autostart\
PowerReg Scheduler V3.exe [2006-10-03 15:14:28]
PowerReg Scheduler.exe [2007-08-19 11:52:45]

C:\Documents and Settings\All Users\Start-meny\Program\Autostart\
Adobe Reader Speed Launch.lnk - C:\Program\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26]
Hamachi.lnk - C:\Program\Hamachi\hamachi.exe [2006-11-30 17:53:00]
Microsoft Office.lnk - C:\Program\Microsoft Office\Office10\OSA.EXE [2001-02-13 10:01:04]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
"c:\program\steam\steam.exe" -silent

R0 nvcchflt;NVIDIA Disk Cache Filter Driver;C:\WINDOWS\system32\DRIVERS\nvcchflt.sys
R3 Razerlow;Razerlow USB Filter Driver;C:\WINDOWS\system32\Drivers\Razerlow.sys
S3 hamachi_oem;PlayLinc Adapter;C:\WINDOWS\system32\DRIVERS\gan_adapter.sys
S3 NPF;NetGroup Packet Filter Driver;C:\WINDOWS\system32\drivers\npf.sys


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{12ae9f0b-ab72-11da-b037-00508d7dc620}]
AutoRun\command- E:\AutoPlay.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c757b241-9e4b-11da-af66-806d6172696f}]
AutoRun\command- D:\Autorun.exe root.ini

.
**************************************************************************

catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-10-02 15:29:01
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

C:\WINDOWS\WindowsUpdate.log
C:\WINDOWS\winhelp.exe
C:\WINDOWS\winhlp32.exe
C:\WINDOWS\winnt.bmp
C:\WINDOWS\winnt256.bmp
C:\WINDOWS\WinSxS
C:\WINDOWS\wmprfSVE.prx
C:\WINDOWS\wmsetup.log
C:\WINDOWS\wmsetup10.log
C:\WINDOWS\WMSysPr9.prx
C:\WINDOWS\WORDPAD.INI
C:\WINDOWS\zllsputility.exe
C:\WINDOWS\_default.pif
C:\WINDOWS\_nvidia_xxx_.log
C:\WINDOWS\Ärgad koppar.bmp
C:\WINDOWS\Ökensand.bmp
C:\WINDOWS\WindowsShell.Manifest
C:\WINDOWS\win.tmp

scan completed successfully
hidden files: 18

**************************************************************************
.
Completion time: 2007-10-02 15:31:17 - machine was rebooted
C:\ComboFix-quarantined-files.txt … 2007-10-02 15:31
C:\ComboFix2.txt … 2007-10-02 14:04
.
— E O F —




——————————————————————————-
KASPERSKY ONLINE SCANNER REPORT
Tuesday, October 02, 2007 5:29:23 PM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.93.1
Kaspersky Anti-Virus database last update: 2/10/2007
Kaspersky Anti-Virus database records: 426288
——————————————————————————-

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\
E:\

Scan Statistics:
Total number of scanned objects: 91868
Number of viruses found: 8
Number of infected objects: 18
Number of suspicious objects: 0
Duration of the scan process: 01:37:04

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Lokala inställningar\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Lokala inställningar\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Lokala inställningar\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Lokala inställningar\Tidigare\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Lokala inställningar\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Lokala inställningar\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\Olof\Application Data\Mozilla\Firefox\Profiles\8ivvl607.default\cert8.db Object is locked skipped
C:\Documents and Settings\Olof\Application Data\Mozilla\Firefox\Profiles\8ivvl607.default\formhistory.dat Object is locked skipped
C:\Documents and Settings\Olof\Application Data\Mozilla\Firefox\Profiles\8ivvl607.default\history.dat Object is locked skipped
C:\Documents and Settings\Olof\Application Data\Mozilla\Firefox\Profiles\8ivvl607.default\key3.db Object is locked skipped
C:\Documents and Settings\Olof\Application Data\Mozilla\Firefox\Profiles\8ivvl607.default\parent.lock Object is locked skipped
C:\Documents and Settings\Olof\Application Data\Mozilla\Firefox\Profiles\8ivvl607.default\search.sqlite Object is locked skipped
C:\Documents and Settings\Olof\Application Data\Mozilla\Firefox\Profiles\8ivvl607.default\urlclassifier2.sqlite Object is locked skipped
C:\Documents and Settings\Olof\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Olof\Lokala inställningar\Application Data\ApplicationHistory\cli.exe.65d44588.ini.inuse Object is locked skipped
C:\Documents and Settings\Olof\Lokala inställningar\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\Logs\Dfsr00005.log Object is locked skipped
C:\Documents and Settings\Olof\Lokala inställningar\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\pending.dat Object is locked skipped
C:\Documents and Settings\Olof\Lokala inställningar\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\Working\database_72B8_C459_B8C4_1E0B\dfsr.db Object is locked skipped
C:\Documents and Settings\Olof\Lokala inställningar\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\Working\database_72B8_C459_B8C4_1E0B\fsr.log Object is locked skipped
C:\Documents and Settings\Olof\Lokala inställningar\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\Working\database_72B8_C459_B8C4_1E0B\fsrtmp.log Object is locked skipped
C:\Documents and Settings\Olof\Lokala inställningar\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\Working\database_72B8_C459_B8C4_1E0B\tmp.edb Object is locked skipped
C:\Documents and Settings\Olof\Lokala inställningar\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Olof\Lokala inställningar\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Olof\Lokala inställningar\Application Data\Microsoft\Windows Live Contacts\[removed]\real\members.stg Object is locked skipped
C:\Documents and Settings\Olof\Lokala inställningar\Application Data\Microsoft\Windows Live Contacts\[removed]\shadow\members.stg Object is locked skipped
C:\Documents and Settings\Olof\Lokala inställningar\Application Data\Mozilla\Firefox\Profiles\8ivvl607.default\Cache\_CACHE_001_ Object is locked skipped
C:\Documents and Settings\Olof\Lokala inställningar\Application Data\Mozilla\Firefox\Profiles\8ivvl607.default\Cache\_CACHE_002_ Object is locked skipped
C:\Documents and Settings\Olof\Lokala inställningar\Application Data\Mozilla\Firefox\Profiles\8ivvl607.default\Cache\_CACHE_003_ Object is locked skipped
C:\Documents and Settings\Olof\Lokala inställningar\Application Data\Mozilla\Firefox\Profiles\8ivvl607.default\Cache\_CACHE_MAP_ Object is locked skipped
C:\Documents and Settings\Olof\Lokala inställningar\Temp\Perflib_Perfdata_c8.dat Object is locked skipped
C:\Documents and Settings\Olof\Lokala inställningar\Temp\Perflib_Perfdata_d34.dat Object is locked skipped
C:\Documents and Settings\Olof\Lokala inställningar\Temp\Perflib_Perfdata_d74.dat Object is locked skipped
C:\Documents and Settings\Olof\Lokala inställningar\Temp\~DFB635.tmp Object is locked skipped
C:\Documents and Settings\Olof\Lokala inställningar\Temp\~DFB81E.tmp Object is locked skipped
C:\Documents and Settings\Olof\Lokala inställningar\Temp\~DFEE18.tmp Object is locked skipped
C:\Documents and Settings\Olof\Lokala inställningar\Temp\~DFFE55.tmp Object is locked skipped
C:\Documents and Settings\Olof\Lokala inställningar\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped
C:\Documents and Settings\Olof\Lokala inställningar\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Olof\Lokala inställningar\Tidigare\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Olof\Lokala inställningar\Tidigare\History.IE5\MSHist012007100220071003\index.dat Object is locked skipped
C:\Documents and Settings\Olof\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Olof\ntuser.dat.LOG Object is locked skipped
C:\Program\Alwil Software\Avast4\DATA\aswResp.dat Object is locked skipped
C:\Program\Alwil Software\Avast4\DATA\Avast4.db Object is locked skipped
C:\Program\Alwil Software\Avast4\DATA\log\AshWebSv.ws Object is locked skipped
C:\Program\Alwil Software\Avast4\DATA\log\aswMaiSv.log Object is locked skipped
C:\Program\Alwil Software\Avast4\DATA\log\nshield.log Object is locked skipped
C:\Program\Alwil Software\Avast4\DATA\report\Resident protection.txt Object is locked skipped
C:\Program\DAEMON Tools\SetupDTSB.exe Infected: not-a-virus:AdTool.Win32.WhenU.a skipped
C:\Program\TrojanHunter 5.0\Quarantine\XcXII.dat Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{EEB21D84-5E44-42B4-8A3E-419977C9DAE7}\RP384\A0119381.exe/data.rar/keygen.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped
C:\System Volume Information\_restore{EEB21D84-5E44-42B4-8A3E-419977C9DAE7}\RP384\A0119381.exe/data.rar/patch.exe Infected: Trojan.Win32.Dialer.qn skipped
C:\System Volume Information\_restore{EEB21D84-5E44-42B4-8A3E-419977C9DAE7}\RP384\A0119381.exe/data.rar/crack.exe Infected: Trojan-Downloader.Win32.LoadAdv.gen skipped
C:\System Volume Information\_restore{EEB21D84-5E44-42B4-8A3E-419977C9DAE7}\RP384\A0119381.exe/data.rar Infected: Trojan-Downloader.Win32.LoadAdv.gen skipped
C:\System Volume Information\_restore{EEB21D84-5E44-42B4-8A3E-419977C9DAE7}\RP384\A0119381.exe RarSFX: infected - 4 skipped
C:\System Volume Information\_restore{EEB21D84-5E44-42B4-8A3E-419977C9DAE7}\RP384\A0119383.exe/Toolbar.exe Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped
C:\System Volume Information\_restore{EEB21D84-5E44-42B4-8A3E-419977C9DAE7}\RP384\A0119383.exe RAR: infected - 1 skipped
C:\System Volume Information\_restore{EEB21D84-5E44-42B4-8A3E-419977C9DAE7}\RP396\A0123111.exe/data0000.cab/zombie.exe Infected: Trojan-Downloader.Win32.Small.fky skipped
C:\System Volume Information\_restore{EEB21D84-5E44-42B4-8A3E-419977C9DAE7}\RP396\A0123111.exe/data0000.cab Infected: Trojan-Downloader.Win32.Small.fky skipped
C:\System Volume Information\_restore{EEB21D84-5E44-42B4-8A3E-419977C9DAE7}\RP396\A0123111.exe Rsrc-Package: infected - 2 skipped
C:\System Volume Information\_restore{EEB21D84-5E44-42B4-8A3E-419977C9DAE7}\RP396\A0123112.exe/data0000.cab/zombie.exe Infected: Trojan-Downloader.Win32.Small.fky skipped
C:\System Volume Information\_restore{EEB21D84-5E44-42B4-8A3E-419977C9DAE7}\RP396\A0123112.exe/data0000.cab Infected: Trojan-Downloader.Win32.Small.fky skipped
C:\System Volume Information\_restore{EEB21D84-5E44-42B4-8A3E-419977C9DAE7}\RP396\A0123112.exe Rsrc-Package: infected - 2 skipped
C:\System Volume Information\_restore{EEB21D84-5E44-42B4-8A3E-419977C9DAE7}\RP421\A0151574.dll Infected: not-a-virus:AdWare.Win32.Mostofate.p skipped
C:\System Volume Information\_restore{EEB21D84-5E44-42B4-8A3E-419977C9DAE7}\RP421\A0151581.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped
C:\System Volume Information\_restore{EEB21D84-5E44-42B4-8A3E-419977C9DAE7}\RP423\change.log Object is locked skipped
C:\WINDOWS\Config\lsass.exe Infected: Trojan-Downloader.Win32.VB.bbn skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\Internet Logs\fwdbglog.txt Object is locked skipped
C:\WINDOWS\Internet Logs\fwpktlog.txt Object is locked skipped
C:\WINDOWS\Internet Logs\IAMDB.RDB Object is locked skipped
C:\WINDOWS\Internet Logs\OLOF.ldb Object is locked skipped
C:\WINDOWS\Internet Logs\tvDebug.log Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\ACEEvent.evt Object is locked skipped
C:\WINDOWS\system32\config\Antivirus.Evt Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\drivers\fidbox.dat Object is locked skipped
C:\WINDOWS\system32\drivers\fidbox.idx Object is locked skipped
C:\WINDOWS\system32\drivers\sptd.sys Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\Temp\Perflib_Perfdata_794.dat Object is locked skipped
C:\WINDOWS\Temp\ZLT01c79.TMP Object is locked skipped
C:\WINDOWS\Temp\ZLT01c7d.TMP Object is locked skipped
C:\WINDOWS\Temp\_avast4_\Webshlock.txt Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped

Scan process completed.






Logfile of HijackThis v1.99.1
Scan saved at 17:29:56, on 2007-10-02
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program\Alwil Software\Avast4\aswUpdSv.exe
C:\Program\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program\Alwil Software\Avast4\ashMaiSv.exe
C:\Program\Alwil Software\Avast4\ashWebSv.exe
C:\Program\ALWILS~1\Avast4\ashDisp.exe
C:\Program\Razer\razerhid.exe
C:\Program\Java\jre1.5.0_11\bin\jusched.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Program\DAEMON Tools\daemon.exe
C:\Program\ATI Technologies\ATI.ACE\cli.exe
C:\Program\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program\TrojanHunter 5.0\THGuard.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program\MSN Messenger\MsnMsgr.Exe
C:\Program\Hamachi\hamachi.exe
C:\Program\Razer\razertra.exe
C:\Program\Razer\razerofa.exe
C:\Program\ATI Technologies\ATI.ACE\cli.exe
C:\Program\ATI Technologies\ATI.ACE\cli.exe
C:\Program\MSN Messenger\usnsvc.exe
C:\WINDOWS\system32\notepad.exe
C:\Program\Mozilla Firefox\firefox.exe
C:\Program\Java\jre1.5.0_11\bin\jucheck.exe
C:\Program\Internet Explorer\iexplore.exe
C:\Program\Delade filer\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Documents and Settings\Olof\Skrivbord\Hijackthis\iseeu.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.worldcybergames.com/5th/beyondthegame.wma
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program\Delade filer\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [avast!] C:\Program\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [razer] C:\Program\Razer\razerhid.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program\Java\jre1.5.0_11\bin\jusched.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [ATICCC] "C:\Program\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [THGuard] "C:\Program\TrojanHunter 5.0\THGuard.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program\Delade filer\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [igndlm.exe] C:\Program\Download Manager\DLM.exe /windowsstart /startifwork
O4 - Startup: PowerReg Scheduler V3.exe
O4 - Startup: PowerReg Scheduler.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Hamachi.lnk = C:\Program\Hamachi\hamachi.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: Download all with Free Download Manager - file://C:\Program\Free Download Manager\dlall.htm
O8 - Extra context menu item: Download selected with Free Download Manager - file://C:\Program\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Download web site with Free Download Manager - file://C:\Program\Free Download Manager\dlpage.htm
O8 - Extra context menu item: Download with Free Download Manager - file://C:\Program\Free Download Manager\dllink.htm
O8 - Extra context menu item: E&xportera till Microsoft Excel - res://C:\Program\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java-konsol - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=48835
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (CDownloadCtrl Object) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.6.108.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{733DF7E4-F82E-4EC0-ABFE-45300DA5A11D}: NameServer = 192.168.0.1
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program\Delade filer\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
Post #8
Hi

Open Notepad and Copy/Paste the text in the codebox below into it: 

File::
C:\Program\DAEMON Tools\SetupDTSB.exe
C:\WINDOWS\Config\lsass.exe

DirLook::
C:\WINDOWS\Config\

Save this as "CFScript"

[external image: Posted Image]


Refering to the picture above, drag CFScript into ComboFix.exe
Then post the resultant log with a new HijackThis log.
Post #9
ComboFix 07-10-02.2 - Olof 2007-10-02 18:19:04.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1053.18.1361 [GMT 2:00]
Running from: C:\Documents and Settings\[removed]\Skrivbord\ComboFix.exe
Command switches used :: C:\Documents and Settings\Olof\Skrivbord\CFScript.txt
* Created a new restore point

FILE::
C:\Program\DAEMON Tools\SetupDTSB.exe
C:\WINDOWS\Config\lsass.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program\DAEMON Tools\SetupDTSB.exe
C:\WINDOWS\Config\lsass.exe

.
((((((((((((((((((((((((( Files Created from 2007-09-02 to 2007-10-02 )))))))))))))))))))))))))))))))
.

2007-10-02 15:37 d——– C:\WINDOWS\system32\Kaspersky Lab
2007-10-02 15:37 d——– C:\WINDOWS\LastGood
2007-10-02 15:37 d——– C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2007-10-02 13:54 51,200 –a—— C:\WINDOWS\NirCmd.exe
2007-10-01 14:51 d——– C:\Documents and Settings\Olof\Application Data\TrojanHunter
2007-10-01 14:17 d——– C:\Program\TrojanHunter 5.0
2007-09-30 12:29 d——– C:\WINDOWS\pss
2007-09-30 12:20 d——– C:\Program\Sony Ericsson
2007-09-29 23:53 d——– C:\Program\Rockstar Games
2007-09-29 20:09 43,520 –a—— C:\WINDOWS\system32\CmdLineExt03.dll
2007-09-29 03:42 d——– C:\Program\directx
2007-09-29 03:38 d——– C:\Program\Fox
2007-09-29 03:37 21,840 –a—-t- C:\WINDOWS\system32\SIntfNT.dll
2007-09-29 03:37 17,212 –a—-t- C:\WINDOWS\system32\SIntf32.dll
2007-09-29 03:37 12,067 –a—-t- C:\WINDOWS\system32\SIntf16.dll
2007-09-28 23:53 d——– C:\Program\Microsoft Games
2007-09-28 21:43 d——– C:\UT2004
2007-09-28 19:38 d——– C:\Program\Steam
2007-09-28 19:31 d——– C:\Program\DC++
2007-09-27 11:45 d——– C:\Program\Download Manager
2007-09-27 11:45 d——– C:\Documents and Settings\Olof\Application Data\IGN_DLM
2007-09-21 20:03 9,164,832 –ahs—- C:\WINDOWS\system32\drivers\fidbox.dat
2007-09-21 20:00 d——– C:\Documents and Settings\All Users\Application Data\MailFrontier
2007-09-20 15:52 d——– C:\Documents and Settings\Olof\Application Data\Bioshock
2007-09-16 15:12 d——– C:\Program\Sierra
2007-09-14 17:21 d——– C:\Documents and Settings\All Users\Application Data\vsosdk
2007-09-13 17:21 217,127 –a—— C:\WINDOWS\system32\drv43260.dll
2007-09-13 17:21 208,935 –a—— C:\WINDOWS\system32\drv33260.dll
2007-09-13 17:21 176,165 –a—— C:\WINDOWS\system32\drv23260.dll
2007-09-13 16:54 d——– C:\Documents and Settings\Olof\Application Data\Nero
2007-09-12 16:53 363,520 –a–c— C:\WINDOWS\system32\dllcache\psisdecd.dll
2007-09-12 16:53 363,520 –a—— C:\WINDOWS\system32\PsisDecd.dll
2007-09-12 16:53 15,360 –a–c— C:\WINDOWS\system32\dllcache\mpe.sys
2007-09-12 16:53 15,360 –a—— C:\WINDOWS\system32\drivers\MPE.sys
2007-09-12 16:53 11,776 –a–c— C:\WINDOWS\system32\dllcache\bdasup.sys
2007-09-12 16:53 11,776 –a—— C:\WINDOWS\system32\drivers\BdaSup.sys
2007-09-12 16:46 169,344 –a—— C:\WINDOWS\system32\drivers\atinavt2.sys
2007-09-12 16:25 66,872 –a—— C:\WINDOWS\system32\PnkBstrA.exe
2007-09-12 16:25 22,328 –a—— C:\WINDOWS\system32\drivers\PnkBstrK.sys
2007-09-12 16:25 22,328 –a—— C:\Documents and Settings\Olof\Application Data\PnkBstrK.sys
2007-09-12 16:25 103,736 –a—— C:\WINDOWS\system32\PnkBstrB.exe
2007-09-12 16:22 d——– C:\Program\id Software

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-10-02 18:20 ——— d——– C:\Program\DAEMON Tools
2007-10-02 18:20 ——— d——– C:\Documents and Settings\Olof\Application Data\Hamachi
2007-10-02 15:27 105692 –ahs—- C:\WINDOWS\system32\drivers\fidbox.idx
2007-10-02 15:04 ——— d——– C:\Program\Warcraft III
2007-10-02 11:54 ——— d——– C:\Documents and Settings\Olof\Application Data\uTorrent
2007-09-30 12:20 ——— d——– C:\Program\Delade filer\Teleca Shared
2007-09-30 03:45 98304 –a—— C:\WINDOWS\system32\CmdLineExt.dll
2007-09-30 01:25 ——— d——– C:\Program\Counter-Strike
2007-09-29 23:53 ——— d–h—– C:\Program\InstallShield Installation Information
2007-09-18 22:02 ——— d——– C:\Documents and Settings\Olof\Application Data\Vso
2007-09-17 16:36 963765 —hs—- C:\WINDOWS\system32\rtstv.bak2
2007-09-16 15:30 682 –a—— C:\Program\INSTALL.LOG
2007-09-15 13:45 ——— d——– C:\Program\vso
2007-09-14 17:21 ——— d——– C:\Documents and Settings\All Users\Application Data\vsosdk
2007-09-13 17:32 ——— d——– C:\Program\MSN Messenger
2007-09-13 17:21 47360 –a—— C:\WINDOWS\system32\drivers\pcouffin.sys
2007-09-13 17:21 47360 –a—— C:\Documents and Settings\Olof\Application Data\pcouffin.sys
2007-09-13 17:07 ——— d——– C:\Documents and Settings\Olof\Application Data\Ahead
2007-09-12 16:51 ——— d——– C:\Documents and Settings\Olof\Application Data\ATI
2007-09-12 16:48 ——— d——– C:\Program\ATI Technologies
2007-09-12 15:26 ——— d——– C:\Documents and Settings\Olof\Application Data\Free Download Manager
2007-09-06 16:14 75248 –a—— C:\WINDOWS\zllsputility.exe
2007-09-06 16:14 1086952 –a—— C:\WINDOWS\system32\zpeng24.dll
2007-09-06 12:09 801144 –a—— C:\WINDOWS\system32\aswBoot.exe
2007-09-06 12:05 94416 –a—— C:\WINDOWS\system32\drivers\aswmon2.sys
2007-09-06 12:05 92848 –a—— C:\WINDOWS\system32\drivers\aswmon.sys
2007-09-06 12:03 23152 –a—— C:\WINDOWS\system32\drivers\aswRdr.sys
2007-09-06 12:02 42912 –a—— C:\WINDOWS\system32\drivers\aswTdi.sys
2007-09-06 12:00 95608 –a—— C:\WINDOWS\system32\AVASTSS.scr
2007-09-06 12:00 26624 –a—— C:\WINDOWS\system32\drivers\aavmker4.sys
2007-08-30 18:06 ——— d——– C:\Documents and Settings\Olof\Application Data\Skype
2007-08-28 17:35 ——— d——– C:\Program\Flagship Studios
2007-08-25 15:31 ——— d——– C:\Program\Sierra Entertainment
2007-08-25 15:27 ——— d——– C:\Program\WAR
2007-08-22 15:22 ——— d——– C:\Program\Nero
2007-08-22 04:09 352256 –a—— C:\WINDOWS\system32\ATIDEMGX.dll
2007-08-22 03:48 8306688 –a—— C:\WINDOWS\system32\atioglx2.dll
2007-08-22 03:15 172032 –a—— C:\WINDOWS\system32\atiok3x2.dll
2007-08-21 21:05 593920 ——— C:\WINDOWS\system32\ati2sgag.exe
2007-08-21 18:20 6456 —hs—- C:\WINDOWS\system32\rtstv.bak1
2007-08-20 19:22 ——— d——– C:\Program\Vodei
2007-08-19 18:24 ——— d——– C:\Program\DaemonTools_WhenUSave_Installer
2007-08-19 11:49 ——— d——– C:\Program\Infogrames Interactive
2007-08-06 14:32 ——— d——– C:\Program\WC3Banlist
2007-08-04 13:56 ——— d——– C:\Program\WinPcap
2007-07-30 19:19 92504 –a—— C:\WINDOWS\system32\cdm.dll
2007-07-30 19:19 549720 –a—— C:\WINDOWS\system32\wuapi.dll
2007-07-30 19:19 53080 –a—— C:\WINDOWS\system32\wuauclt.exe
2007-07-30 19:19 43352 –a—— C:\WINDOWS\system32\wups2.dll
2007-07-30 19:19 325976 –a—— C:\WINDOWS\system32\wucltui.dll
2007-07-30 19:19 203096 –a—— C:\WINDOWS\system32\wuweb.dll
2007-07-30 19:19 1712984 –a—— C:\WINDOWS\system32\wuaueng.dll
2007-07-30 19:18 33624 –a—— C:\WINDOWS\system32\wups.dll
2006-08-09 20:15 1 –a—— C:\Documents and Settings\Olof\SI.bin
2003-12-18 11:33 20102 –a—— C:\Program\Readme.txt
2003-09-03 07:46 10960 –a—— C:\Program\EULA.txt
.

(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))


—- Directory of C:\WINDOWS\Config\ —-

2007-08-30 21:00 296462 –a—— C:\WINDOWS\Config\\lsass.exe


((((((((((((((((((((((((((((( snapshot@2007-10-02_14.04.01.93 )))))))))))))))))))))))))))))))))))))))))
.
—-a-w 62,344 2007-10-02 12:05:29 C:\WINDOWS\system32\perfc009.dat
—-a-w 73,728 2007-10-02 12:05:29 C:\WINDOWS\system32\perfc01D.dat
—-a-w 401,064 2007-10-02 12:05:29 C:\WINDOWS\system32\perfh009.dat
—-a-w 404,004 2007-10-02 12:05:29 C:\WINDOWS\system32\perfh01D.dat
—-a-w 213,048 2005-05-24 09:27:16 C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavss.dll
—-a-w 94,208 2007-09-07 09:29:00 C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavuninstall.exe
—-a-w 946,176 2007-09-07 09:29:00 C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavwebscan.dll
—-atw 16,384 2007-10-02 13:28:26 C:\WINDOWS\Temp\Perflib_Perfdata_794.dat
.
—-a-w 62,344 2007-07-12 01:02:32 C:\WINDOWS\system32\perfc009.dat
—-a-w 73,728 2007-07-12 01:02:32 C:\WINDOWS\system32\perfc01D.dat
—-a-w 401,064 2007-07-12 01:02:32 C:\WINDOWS\system32\perfh009.dat
—-a-w 404,004 2007-07-12 01:02:32 C:\WINDOWS\system32\perfh01D.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="C:\Program\ALWILS~1\Avast4\ashDisp.exe" [2007-09-06 12:06]
"razer"="C:\Program\Razer\razerhid.exe" [2005-05-17 19:21]
"QuickTime Task"="C:\Program\QuickTime\qttask.exe" [2006-03-17 16:59]
"SunJavaUpdateSched"="C:\Program\Java\jre1.5.0_11\bin\jusched.exe" [2006-12-15 03:23]
"SoundMan"="SOUNDMAN.EXE" [2006-01-11 16:08 C:\WINDOWS\soundman.exe]
"Sony Ericsson PC Suite"="C:\Program\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 16:17]
"Adobe Photo Downloader"="C:\Program\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-07 00:46]
"DAEMON Tools"="C:\Program\DAEMON Tools\daemon.exe" [2006-11-12 12:48]
"ATICCC"="C:\Program\ATI Technologies\ATI.ACE\cli.exe" [2005-08-12 15:43]
"ZoneAlarm Client"="C:\Program\Zone Labs\ZoneAlarm\zlclient.exe" [2007-09-06 16:14]
"THGuard"="C:\Program\TrojanHunter 5.0\THGuard.exe" [2007-09-09 09:31]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 14:00]
"MsnMsgr"="C:\Program\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program\Delade filer\Ahead\Lib\NMBgMonitor.exe" []
"igndlm.exe"="C:\Program\Download Manager\DLM.exe" [2007-03-05 23:57]

C:\Documents and Settings\All Users\Start-meny\Program\Autostart\
Adobe Reader Speed Launch.lnk - C:\Program\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26]
Hamachi.lnk - C:\Program\Hamachi\hamachi.exe [2006-11-30 17:53:00]
Microsoft Office.lnk - C:\Program\Microsoft Office\Office10\OSA.EXE [2001-02-13 10:01:04]

C:\Documents and Settings\Olof\Start-meny\Program\Autostart\
PowerReg Scheduler V3.exe [2006-10-03 15:14:28]
PowerReg Scheduler.exe [2007-08-19 11:52:45]

C:\Documents and Settings\All Users\Start-meny\Program\Autostart\
Adobe Reader Speed Launch.lnk - C:\Program\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26]
Hamachi.lnk - C:\Program\Hamachi\hamachi.exe [2006-11-30 17:53:00]
Microsoft Office.lnk - C:\Program\Microsoft Office\Office10\OSA.EXE [2001-02-13 10:01:04]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
"c:\program\steam\steam.exe" -silent

R0 nvcchflt;NVIDIA Disk Cache Filter Driver;C:\WINDOWS\system32\DRIVERS\nvcchflt.sys
R3 Razerlow;Razerlow USB Filter Driver;C:\WINDOWS\system32\Drivers\Razerlow.sys
S3 hamachi_oem;PlayLinc Adapter;C:\WINDOWS\system32\DRIVERS\gan_adapter.sys
S3 NPF;NetGroup Packet Filter Driver;C:\WINDOWS\system32\drivers\npf.sys


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{12ae9f0b-ab72-11da-b037-00508d7dc620}]
AutoRun\command- E:\AutoPlay.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c757b241-9e4b-11da-af66-806d6172696f}]
AutoRun\command- D:\Autorun.exe root.ini

.
**************************************************************************

catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-10-02 18:20:41
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

C:\WINDOWS\WindowsUpdate.log
C:\WINDOWS\winhelp.exe
C:\WINDOWS\winhlp32.exe
C:\WINDOWS\winnt.bmp
C:\WINDOWS\winnt256.bmp
C:\WINDOWS\WinSxS
C:\WINDOWS\wmprfSVE.prx
C:\WINDOWS\wmsetup.log
C:\WINDOWS\wmsetup10.log
C:\WINDOWS\WMSysPr9.prx
C:\WINDOWS\WORDPAD.INI
C:\WINDOWS\zllsputility.exe
C:\WINDOWS\_default.pif
C:\WINDOWS\_nvidia_xxx_.log
C:\WINDOWS\Ärgad koppar.bmp
C:\WINDOWS\Ökensand.bmp
C:\WINDOWS\WindowsShell.Manifest
C:\WINDOWS\win.tmp
IPC error: 2 Det går inte att hitta filen.
scan completed successfully
hidden files: 18

**************************************************************************
.
Completion time: 2007-10-02 18:21:35
C:\ComboFix-quarantined-files.txt … 2007-10-02 18:21
C:\ComboFix2.txt … 2007-10-02 15:31
C:\ComboFix3.txt … 2007-10-02 14:04
.
— E O F —





Logfile of HijackThis v1.99.1
Scan saved at 18:23:06, on 2007-10-02
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program\Alwil Software\Avast4\aswUpdSv.exe
C:\Program\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program\ALWILS~1\Avast4\ashDisp.exe
C:\Program\Razer\razerhid.exe
C:\Program\Java\jre1.5.0_11\bin\jusched.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Program\DAEMON Tools\daemon.exe
C:\Program\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program\MSN Messenger\MsnMsgr.Exe
C:\Program\Hamachi\hamachi.exe
C:\Program\Razer\razertra.exe
C:\Program\Razer\razerofa.exe
C:\Program\ATI Technologies\ATI.ACE\cli.exe
C:\Program\ATI Technologies\ATI.ACE\cli.exe
C:\Program\MSN Messenger\usnsvc.exe
C:\Program\Mozilla Firefox\firefox.exe
C:\Program\Java\jre1.5.0_11\bin\jucheck.exe
C:\Program\Internet Explorer\iexplore.exe
C:\Program\Delade filer\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program\Alwil Software\Avast4\ashMaiSv.exe
C:\Program\Alwil Software\Avast4\ashWebSv.exe
C:\Program\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Documents and Settings\Olof\Skrivbord\Hijackthis\iseeu.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.worldcybergames.com/5th/beyondthegame.wma
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program\Delade filer\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [avast!] C:\Program\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [razer] C:\Program\Razer\razerhid.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program\Java\jre1.5.0_11\bin\jusched.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [ATICCC] "C:\Program\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [THGuard] "C:\Program\TrojanHunter 5.0\THGuard.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program\Delade filer\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [igndlm.exe] C:\Program\Download Manager\DLM.exe /windowsstart /startifwork
O4 - Startup: PowerReg Scheduler V3.exe
O4 - Startup: PowerReg Scheduler.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Hamachi.lnk = C:\Program\Hamachi\hamachi.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: Download all with Free Download Manager - file://C:\Program\Free Download Manager\dlall.htm
O8 - Extra context menu item: Download selected with Free Download Manager - file://C:\Program\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Download web site with Free Download Manager - file://C:\Program\Free Download Manager\dlpage.htm
O8 - Extra context menu item: Download with Free Download Manager - file://C:\Program\Free Download Manager\dllink.htm
O8 - Extra context menu item: E&xportera till Microsoft Excel - res://C:\Program\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java-konsol - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=48835
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (CDownloadCtrl Object) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.6.108.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{733DF7E4-F82E-4EC0-ABFE-45300DA5A11D}: NameServer = 192.168.0.1
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program\Delade filer\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
Post #10
Hi

Delete the Combofix icon from your Desktop, then navigate to and delete the following folders, if they are present.

C:\Combofix
C:\Qoobox

I would advise updating Adobe Reader, as the latest version clears up any vulnerabilities of previous versions.
First uninstall the version you have on your computer then download and install Adobe Reader 8.1.

Delete the older versions of Java and download the newest.
Please follow these steps to remove older version Java components.
  • Close any programmes you may have running, ESPECIALLY your web browser
  • Click Start > Control Panel.
  • Click Add/Remove Programs.
  • Check any item with Java Runtime Environment (JRE or J2SE) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove all versions of Java.
  • Reboot your computer once all Java components are removed.
Then download the latest version of Java Runtime Environment (JRE) (4th one down the list), which is JRE6u2, and click Yes at the page warning, then accept the Licence Agreement before downloading the Offline file.

This is my usual speech for when you are clean, which you appear to be.

Please follow these simple steps in order to keep your computer clean and secure:
Disable and Enable System Restore.

It's also a good idea to Flush your System Restore points after ridding yourself of malware:
  • Click Start | Help and Support | Undo changes to your computer with System Restore.
  • Click Create A Restore Point then click Next. Give it a name it and then click Create, then Close.
  • Close the Help and Support Center box.
  • Click Start | Run and type Cleanmgr
  • Select (C: ) then click OK.
  • Click the More Options tab.
  • Click Clean Up in the System Restore Section.
This will remove all previous restore points except the newly created one.

Here are some free programs I recommend, although you will not need them all. Spybot S&D and Winpatrol are definites though.

Spybot Search and Destroy
Download it from here . Just choose a mirror and off you go.
Find here the tutorial on how to use Spybot properly here

Install Spyware Guard
Download it from here
Find here the tutorial on how to use Spyware Guard here

Install SpyWare Blaster
Download it from here
Find here the tutorial on how to use Spyware Blaster here

Install WinPatrol
Download it from here
Here you can find information about how WinPatrol works here


Make sure your Windows is ALWAYS up to date!

An unpatched Windows is vulnerable and even with the "best" Antivirus and Firewall installed, malware will find its way through.
So visit http://windowsupdate.microsoft.com/ to download and install the latest updates.


Update your Antivirus programs and other security products regularly to avoid new threats that could infect your system.

Please check out Tony Klein's article "How did I get infected in the first place?"


Follow this list and your potential for being infected again will reduce dramatically.

Glad I was able to help.
Post #12
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI