What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Closed] Red circle white X by the clock

9 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Trying to help a friend whose computer is running very slow and with many pop-ups I ran super Antispyware and found 66 and removed them that helped some but not all there is still a red circle with a x in it that sends pop ups warning of things found and wanting me to download their cure here is the log file please let me know what to do.

Logfile of HijackThis v1.99.1
Scan saved at 5:20:18 PM, on 10/23/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\system32\spoolsv.exe
E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
E:\WINDOWS\System32\CTsvcCDA.EXE
E:\Program Files\Symantec AntiVirus\DefWatch.exe
E:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
E:\WINDOWS\System32\nvsvc32.exe
E:\WINDOWS\System32\svchost.exe
E:\Program Files\Symantec AntiVirus\Rtvscan.exe
E:\WINDOWS\System32\MsPMSPSv.exe
E:\WINDOWS\system32\fxssvc.exe
E:\Program Files\Creative\ShareDLL\CtNotify.exe
E:\Program Files\Creative\ShareDLL\MediaDet.Exe
E:\PROGRA~1\SYMANT~1\VPTray.exe
E:\Program Files\Trend Micro\Tmas\Tmas.exe
E:\PROGRA~1\Webshots\webshots.scr
E:\WINDOWS\System32\wbem\wmiapsrv.exe
E:\WINDOWS\explorer.exe
E:\Documents and Settings\Jack\Desktop\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=…6Ojg5&lid=2
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - E:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: (no name) - {B528C6CC-AA98-4753-8980-A6B97A220A63} - E:\WINDOWS\system32\ddcyyya.dll (file missing)
O2 - BHO: (no name) - {CB6B9F94-6AB9-45C5-8CA0-874DDCC87844} - (no file)
O4 - HKLM\..\Run: [Disc Detector] E:\Program Files\Creative\ShareDLL\CtNotify.exe
O4 - HKLM\..\Run: [CTStartup] E:\Program Files\Creative\SBAudigy\Program\CTEaxSpl.EXE /run
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE E:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE E:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SSC_UserPrompt] E:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [ccApp] "E:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] E:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [ctfmon] C:\WINDOWS\system32\dlg\ctfmon.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [gjadchyv] regsvr32 /u "E:\Documents and Settings\All Users.WINDOWS\Application Data\gjadchyv.dll"
O4 - HKCU\..\Run: [SUPERAntiSpyware] E:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Startup: Webshots.lnk = E:\Program Files\Webshots\Launcher.exe
O4 - Global Startup: Trend Micro Anti-Spyware.lnk = E:\Program Files\Trend Micro\Tmas\Tmas.exe
O8 - Extra context menu item: &D&ownload &with BitComet - res://E:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://E:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://E:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://E:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - E:\Program Files\BitComet\tools\BitCometBHO_1.1.7.4.dll (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .qt: E:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1120753701497
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O20 - Winlogon Notify: !SASWinLogon - E:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: fccyywt - fccyywt.dll (file missing)
O20 - Winlogon Notify: NavLogon - E:\WINDOWS\system32\NavLogon.dll
O20 - Winlogon Notify: qomkhhh - qomkhhh.dll (file missing)
O20 - Winlogon Notify: vtsqo - E:\WINDOWS\system32\vtsqo.dll (file missing)
O20 - Winlogon Notify: WgaLogon - E:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - E:\WINDOWS\system32\WPDShServiceObj.dll
O21 - SSODL: ocgrep - {C17BC25F-C2A3-4255-B6A3-F55F5E4DB597} - E:\WINDOWS\ocgrep.dll
O21 - SSODL: msmhost - {70F240A2-6AB8-4CEA-AFB8-13C82B3DCAEF} - E:\WINDOWS\msmhost.dll (file missing)
O21 - SSODL: msmdev - {7E557490-061F-4142-8988-1C0B438DF7C6} - E:\WINDOWS\msmdev.dll (file missing)
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - E:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - E:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - E:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Windows lsass Service (lsass) - Unknown owner - E:\WINDOWS\lsass.exe (file missing)
O23 - Service: Workstation Service Library (Microsoft Locator Service) - Unknown owner - E:\WINDOWS\wkssvc.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - E:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SAVRoam (SavRoam) - symantec - E:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - E:\Program Files\Symantec AntiVirus\Rtvscan.exe

Thanks in advance
Post #2
1Techwreck,

Welcome, lets do a few things.

Download VundoFix to your desktop
  • Double-click VundoFix.exe to run it.
  • Click the Scan for Vundo button.
  • Once it's done scanning, click the Remove Vundo button.
  • You will receive a prompt asking if you want to remove the files, click YES
  • Once you click yes, your desktop will go blank as it starts removing Vundo.
  • When completed, it will prompt that it will reboot your computer, click OK.
  • Please post the contents of C:\vundofix.txt and a new HiJackThis log in a reply to this thread.
Note: It is possible that VundoFix encountered a file it could not remove. In this case, VundoFix will run on reboot, simply follow the above instructions starting from "Click the Scan for Vundo button" when VundoFix appears upon rebooting.





Download ComboFix from Here or Here to your Desktop.
  • Double click combofix.exe and follow the prompts.
  • When finished, it shall produce a log for you. Post the Combofix log and a HiJackthis log in your next reply
Note: Do not mouseclick combofix's window while its running. That may cause it to stall


Before you post a new HJT log, do this first.
E:\Documents and Settings\Jack\Desktop\hijackthis\HijackThis.exe <–<—Go here and right click on the HJT Icon, (looks like a red stick of dynamite with a plunger) and rename it to Scanner.exe.


I need to see …
1. Vundofix log
2. Combofix log
3. New HJT log with it renamed please
Post #3
Sorry for the delay I was unable to get back to you sooner.
Here are the log files you had requested It has helped somewhat the home page has been redirected to Ultimatecleaner 2007 but the pop ups seem to have stopped for now.

Thanks for your help
1techwreck


VundoFix V6.5.11

Checking Java version…

Java version is 1.5.0.3
Old versions of java are exploitable and should be removed.

Java version is 1.5.0.6
Old versions of java are exploitable and should be removed.

Scan started at 3:25:32 PM 10/30/2007

Listing files found while scanning….

E:\WINDOWS\system32\ddcyyya.dll
E:\WINDOWS\system32\fccyywt.dll

Beginning removal…

Performing Repairs to the registry.
Done!

ComboFix 07-10-29.1** - Jack 2007-10-30 15:47:44.1 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.602 [GMT -4:00]
Running from: E:\Documents and Settings\[removed]\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

E:\Documents and Settings\Jack\Application Data\macromedia\Flash Player\#SharedObjects\8KD5JD4N\www.broadcaster.com
E:\Documents and Settings\Jack\Application Data\macromedia\Flash Player\#SharedObjects\8KD5JD4N\www.broadcaster.com\played_list.sol
E:\Documents and Settings\Jack\Application Data\macromedia\Flash Player\#SharedObjects\8KD5JD4N\www.broadcaster.com\video_queue.sol
E:\Documents and Settings\Jack\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com
E:\Documents and Settings\Jack\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com\settings.sol
E:\Documents and Settings\Jack\Desktop\Error Cleaner.url
E:\Documents and Settings\Jack\Desktop\Privacy Protector.url
E:\Documents and Settings\Jack\Desktop\Spyware&Malware Protection.url
E:\Documents and Settings\Jack\Favorites\Error Cleaner.url
E:\Documents and Settings\Jack\Favorites\Privacy Protector.url
E:\Documents and Settings\Jack\Favorites\Spyware&Malware Protection.url
E:\WINDOWS\dat.txt
E:\WINDOWS\main_uninstaller.exe
E:\WINDOWS\rs.txt
E:\WINDOWS\system32\.exe
E:\WINDOWS\system32\nvrssk.dll
E:\WINDOWS\system32\nvrssl.dll
E:\WINDOWS\system32\winsys.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
——-\rdriv


((((((((((((((((((((((((( Files Created from 2007-09-28 to 2007-10-30 )))))))))))))))))))))))))))))))
.

2007-10-30 15:45 51,200 –a—— E:\WINDOWS\NirCmd.exe
2007-10-30 15:25 d——– E:\VundoFix Backups
2007-10-23 15:41 d——– E:\Program Files\SUPERAntiSpyware
2007-10-23 15:41 d——– E:\Documents and Settings\Jack\Application Data\SUPERAntiSpyware.com
2007-10-23 15:41 d——– E:\Documents and Settings\All Users.WINDOWS\Application Data\SUPERAntiSpyware.com
2007-10-22 15:32 d——– E:\Program Files\wxdiioeg
2007-10-22 15:25 321,536 –a—— E:\WINDOWS\ocgrep.dll
2007-10-22 15:25 294,912 –a—— E:\WINDOWS\bxsbang.dll
2007-10-22 15:25 108,032 –a—— E:\WINDOWS\kthemup.exe
2007-10-09 13:26 582,656 ——— E:\WINDOWS\system32\dllcache\rpcrt4.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-08-30 23:35 ——— d—–w E:\Program Files\Virtual Earth 3D
2007-08-30 23:09 ——— d—–w E:\Program Files\Microsoft Streets & Trips
2007-08-30 23:09 ——— d—–w E:\Program Files\Microsoft Location Finder
2007-08-21 06:15 683,520 —-a-w E:\WINDOWS\system32\inetcomm.dll
2007-08-21 06:15 683,520 ——w E:\WINDOWS\system32\dllcache\inetcomm.dll
2007-08-20 10:04 824,832 —-a-w E:\WINDOWS\system32\dllcache\wininet.dll
2007-08-20 10:04 671,232 —-a-w E:\WINDOWS\system32\dllcache\mstime.dll
2007-08-20 10:04 63,488 ——w E:\WINDOWS\system32\dllcache\icardie.dll
2007-08-20 10:04 6,058,496 ——w E:\WINDOWS\system32\dllcache\ieframe.dll
2007-08-20 10:04 52,224 ——w E:\WINDOWS\system32\dllcache\msfeedsbs.dll
2007-08-20 10:04 477,696 —-a-w E:\WINDOWS\system32\dllcache\mshtmled.dll
2007-08-20 10:04 459,264 ——w E:\WINDOWS\system32\dllcache\msfeeds.dll
2007-08-20 10:04 44,544 ——w E:\WINDOWS\system32\dllcache\iernonce.dll
2007-08-20 10:04 384,512 ——w E:\WINDOWS\system32\dllcache\iedkcs32.dll
2007-08-20 10:04 383,488 ——w E:\WINDOWS\system32\dllcache\ieapfltr.dll
2007-08-20 10:04 3,584,512 —-a-w E:\WINDOWS\system32\dllcache\mshtml.dll
2007-08-20 10:04 27,648 —-a-w E:\WINDOWS\system32\dllcache\jsproxy.dll
2007-08-20 10:04 267,776 ——w E:\WINDOWS\system32\dllcache\iertutil.dll
2007-08-20 10:04 232,960 ——w E:\WINDOWS\system32\dllcache\webcheck.dll
2007-08-20 10:04 230,400 ——w E:\WINDOWS\system32\dllcache\ieaksie.dll
2007-08-20 10:04 214,528 —-a-w E:\WINDOWS\system32\dllcache\dxtrans.dll
2007-08-20 10:04 193,024 —-a-w E:\WINDOWS\system32\dllcache\msrating.dll
2007-08-20 10:04 153,088 ——w E:\WINDOWS\system32\dllcache\ieakeng.dll
2007-08-20 10:04 132,608 —-a-w E:\WINDOWS\system32\dllcache\extmgr.dll
2007-08-20 10:04 124,928 ——w E:\WINDOWS\system32\dllcache\advpack.dll
2007-08-20 10:04 105,984 ——w E:\WINDOWS\system32\dllcache\url.dll
2007-08-20 10:04 102,400 ——w E:\WINDOWS\system32\dllcache\occache.dll
2007-08-20 10:04 1,152,000 —-a-w E:\WINDOWS\system32\dllcache\urlmon.dll
2007-08-18 20:38 87,608 —-a-w E:\Documents and Settings\Jack\Application Data\ezpinst.exe
2007-08-18 20:38 47,360 —-a-w E:\Documents and Settings\Jack\Application Data\pcouffin.sys
2007-08-17 10:21 625,152 ——w E:\WINDOWS\system32\dllcache\iexplore.exe
2007-08-17 10:20 63,488 ——w E:\WINDOWS\system32\dllcache\ie4uinit.exe
2007-08-17 10:20 13,824 ——w E:\WINDOWS\system32\dllcache\ieudinit.exe
2007-08-17 07:34 161,792 ——w E:\WINDOWS\system32\dllcache\ieakui.dll
2007-07-30 23:19 92,504 —-a-w E:\WINDOWS\system32\dllcache\cdm.dll
2007-07-30 23:19 92,504 —-a-w E:\WINDOWS\system32\cdm.dll
2007-07-30 23:19 549,720 —-a-w E:\WINDOWS\system32\wuapi.dll
2007-07-30 23:19 549,720 —-a-w E:\WINDOWS\system32\dllcache\wuapi.dll
2007-07-30 23:19 53,080 —-a-w E:\WINDOWS\system32\wuauclt.exe
2007-07-30 23:19 53,080 —-a-w E:\WINDOWS\system32\dllcache\wuauclt.exe
2007-07-30 23:19 43,352 —-a-w E:\WINDOWS\system32\wups2.dll
2007-07-30 23:19 325,976 —-a-w E:\WINDOWS\system32\wucltui.dll
2007-07-30 23:19 325,976 —-a-w E:\WINDOWS\system32\dllcache\wucltui.dll
2007-07-30 23:19 203,096 —-a-w E:\WINDOWS\system32\wuweb.dll
2007-07-30 23:19 203,096 —-a-w E:\WINDOWS\system32\dllcache\wuweb.dll
2007-07-30 23:19 1,712,984 —-a-w E:\WINDOWS\system32\wuaueng.dll
2007-07-30 23:19 1,712,984 —-a-w E:\WINDOWS\system32\dllcache\wuaueng.dll
2007-07-30 23:18 33,624 —-a-w E:\WINDOWS\system32\wups.dll
2007-07-30 23:18 33,624 —-a-w E:\WINDOWS\system32\dllcache\wups.dll
2007-07-12 23:31 765,952 ——w E:\WINDOWS\system32\dllcache\vgx.dll
2007-07-09 13:16 582,656 —-a-w E:\WINDOWS\system32\rpcrt4.dll
2007-06-13 19:16 167,256 —-a-w E:\Program Files\pacificpoker.exe
2007-06-01 03:41 356,352 —-a-w E:\Documents and Settings\Jack\cwshredder.dll
2007-02-06 22:32 1,286,944 —-a-w E:\Program Files\SetupAnyDVD6114.exe
2007-01-27 21:14 1,038,336 —-a-w E:\Documents and Settings\Jack\AnyDialog.dll
2005-05-12 03:36 12,288 —-a-w E:\WINDOWS\Fonts\RandFont.dll
2004-09-09 14:14 9,216 –sha-w E:\Program Files\Common Files\Thumbs.db
2003-08-27 18:19 36,963 —-a-r E:\Program Files\Common Files\SM1updtr.dll
2007-03-04 20:48:46 1,156,726 –sh–w E:\WINDOWS\system32\ihkmp.bak2
2007-02-03 16:08:48 968,485 –sh–w E:\WINDOWS\system32\oqstv.bak2
2007-03-05 20:48:52 1,161,106 –sh–w E:\WINDOWS\system32\ihkmp.bak1
2007-03-05 22:34:34 1,160,360 –sh–w E:\WINDOWS\system32\ihkmp.ini2
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CB6B9F94-6AB9-45C5-8CA0-874DDCC87844}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Disc Detector"="E:\Program Files\Creative\ShareDLL\CtNotify.exe" [2001-04-02 02:00]
"CTStartup"="E:\Program Files\Creative\SBAudigy\Program\CTEaxSpl.exe" [2001-06-04 01:00]
"NvCplDaemon"="E:\WINDOWS\System32\NvCpl.dll" [2004-09-20 15:09]
"NvMediaCenter"="E:\WINDOWS\System32\NvMcTray.dll" [2004-09-20 15:09]
"SSC_UserPrompt"="E:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe" [2004-11-02 16:59]
"ccApp"="E:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2005-06-02 09:21]
"vptray"="E:\PROGRA~1\SYMANT~1\VPTray.exe" [2005-06-23 19:27]
"ctfmon"="C:\WINDOWS\system32\dlg\ctfmon.exe" []
"!AVG Anti-Spyware"="E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-07-06 17:34]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SUPERAntiSpyware"="E:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2007-04-23 15:46]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"DWQueuedReporting"="E:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t

E:\Documents and Settings\Jack\Start Menu\Programs\Startup\
Webshots.lnk - E:\Program Files\Webshots\Launcher.exe [2005-09-17 14:31:59]

E:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\
Trend Micro Anti-Spyware.lnk - E:\Program Files\Trend Micro\Tmas\Tmas.exe [2007-02-27 12:59:21]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
@=

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{03A80B1D-5C6A-42c2-9DFB-81B6005D8023}"= E:\Program Files\Trend Micro\Tmas\sshook.dll [2007-02-27 12:59 77824]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= E:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 13:55 77824]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"ocgrep"= {C17BC25F-C2A3-4255-B6A3-F55F5E4DB597} - E:\WINDOWS\ocgrep.dll [2007-10-22 13:02 321536]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
E:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 E:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\fccyywt]
fccyywt.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\qomkhhh]
qomkhhh.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\vtsqo]
E:\WINDOWS\system32\vtsqo.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\E:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^HP Image Zone Fast Start.lnk]
path=E:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\HP Image Zone Fast Start.lnk
backup=E:\WINDOWS\pss\HP Image Zone Fast Start.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\E:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^iM StartCenter.lnk]
path=E:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\iM StartCenter.lnk
backup=E:\WINDOWS\pss\iM StartCenter.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\E:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^InterVideo WinCinema Manager.lnk]
path=E:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\InterVideo WinCinema Manager.lnk
backup=E:\WINDOWS\pss\InterVideo WinCinema Manager.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\E:^Documents and Settings^Jack^Start Menu^Programs^Startup^Introducing Media Manager.lnk]
path=E:\Documents and Settings\Jack\Start Menu\Programs\Startup\Introducing Media Manager.lnk
backup=E:\WINDOWS\pss\Introducing Media Manager.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\!AVG Anti-Spyware]
"E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
"E:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AIM]
E:\Program Files\AIM\aim.exe -cnetwait.odl

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AnyDVD]
E:\Program Files\SlySoft\AnyDVD\AnyDVD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus Photo R300 Series]
E:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2F1.EXE /P30 "EPSON Stylus Photo R300 Series" /O6 "USB001" /M "Stylus Photo R300"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
E:\Program Files\HP\HP Software Update\HPWuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Jet Detection]
E:\Program Files\Creative\SBAudigy\PROGRAM\ADGJDet.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"E:\Program Files\Messenger\msmsgs.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
nwiz.exe /install

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxioDragToDisc]
"E:\Program Files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SM1BG]
E:\WINDOWS\SM1BG.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
E:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Taskbar]
E:\Program Files\Creative\SBAudigy\Taskbar\CTLTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TaskTray]
E:\Program Files\Creative\SBAudigy\Taskbar\CTLTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg]
E:\WINDOWS\Updreg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
"E:\Program Files\Windows Defender\MSASCui.exe" -hide

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"ccSetMgr"=2 (0x2)
"ccPwdSvc"=3 (0x3)

R1 Cinemsup;Cinemsup;E:\WINDOWS\system32\drivers\Cinemsup.sys
R1 DVDVRRdr_xp;DVDVRRdr_xp;E:\WINDOWS\system32\drivers\DVDVRRdr_xp.sys
R1 UDFReadr;UDFReadr;E:\WINDOWS\system32\drivers\UDFReadr.sys
R3 emu10kx;Creative EMU10K1/EMU10K2 Audio Driver (WDM);E:\WINDOWS\system32\drivers\e10kx2k.sys
R3 EraserUtilDrv10733;EraserUtilDrv10733;\??\E:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilDrv10733.sys
S2 lsass;Windows lsass Service;"E:\WINDOWS\lsass.exe"
S2 Microsoft Locator Service;Workstation Service Library;"E:\WINDOWS\wkssvc.exe"
S3 EraserUtilDrv10614;EraserUtilDrv10614;\??\E:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilDrv10614.sys
S3 EraserUtilDrv10615;EraserUtilDrv10615;\??\E:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilDrv10615.sys
S3 p2pgasvc;Peer Networking Group Authentication;E:\WINDOWS\system32\svchost.exe -k p2psvc
S3 p2pimsvc;Peer Networking Identity Manager;E:\WINDOWS\system32\svchost.exe -k p2psvc
S3 p2psvc;Peer Networking;E:\WINDOWS\system32\svchost.exe -k p2psvc
S3 PNRPSvc;Peer Name Resolution Protocol;E:\WINDOWS\system32\svchost.exe -k p2psvc
S3 UBFWNet;Unibrain 1394 FireNet Adapter NT Driver;E:\WINDOWS\system32\DRIVERS\ubfwnet.sys

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
p2psvc p2psvc p2pimsvc p2pgasvc PNRPSvc

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1fc6a3c2-4641-11da-9643-00496e5560cf}]
AutoRun\command - D:\Help!.exe
open\command - D:\Help!.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{982c0930-69ed-11db-9708-00c0f030df6b}]
AutoRun\command - D:\PortableRoboForm.exe
RoboForm2Go\command - D:\PortableRoboForm.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c844fb2f-4dca-11dc-9752-00496e5560cf}]
Auto\command - boot.exe
AutoRun\command - E:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL boot.exe

.
**************************************************************************

catchme 0.3.1239 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-10-30 15:56:20
Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes …

scanning hidden autostart entries …

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Disc Detector = E:\Program Files\Creative\ShareDLL\CtNotify.exe?X???????????????? C?????Disc Detector?B???A???????A?p ????B???@?$?@?? C?????U?@?????????@?B???A???????A?? ????B???@?????P???$?@?? ????????A~??????????@???????????????????B?????? ????????????????????????????B
CTStartup = E:\Program Files\Creative\SBAudigy\Program\CTEaxSpl.EXE /run????????????x??????s$????\?w? ?w???????w???w4???????.??w4???????4???TA?s4????????&2???A~??A~????????\???\???????$???U?A~??A~\???\????????a`???????B~\???\??????s????\??????s\????&2?A??s?&2???B~???

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-10-30 15:57:56 - machine was rebooted
.
— E O F —


Logfile of HijackThis v1.99.1
Scan saved at 3:59:34 PM, on 10/30/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\system32\spoolsv.exe
E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
E:\WINDOWS\System32\CTsvcCDA.EXE
E:\Program Files\Symantec AntiVirus\DefWatch.exe
E:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
E:\WINDOWS\System32\nvsvc32.exe
E:\WINDOWS\System32\svchost.exe
E:\Program Files\Symantec AntiVirus\Rtvscan.exe
E:\WINDOWS\System32\MsPMSPSv.exe
E:\WINDOWS\system32\fxssvc.exe
E:\WINDOWS\system32\wuauclt.exe
E:\WINDOWS\Explorer.EXE
E:\Program Files\Creative\ShareDLL\CtNotify.exe
E:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
E:\Program Files\Common Files\Symantec Shared\ccApp.exe
E:\PROGRA~1\SYMANT~1\VPTray.exe
E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
E:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
E:\Program Files\Trend Micro\Tmas\Tmas.exe
E:\Program Files\Creative\ShareDLL\MediaDet.Exe
E:\PROGRA~1\Webshots\webshots.scr
E:\WINDOWS\system32\notepad.exe
E:\WINDOWS\System32\wbem\wmiapsrv.exe
E:\WINDOWS\system32\NOTEPAD.EXE
E:\Documents and Settings\Jack\Desktop\hijackthis\scanner.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=…6Ojg5&lid=2
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - E:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: (no name) - {CB6B9F94-6AB9-45C5-8CA0-874DDCC87844} - (no file)
O4 - HKLM\..\Run: [Disc Detector] E:\Program Files\Creative\ShareDLL\CtNotify.exe
O4 - HKLM\..\Run: [CTStartup] E:\Program Files\Creative\SBAudigy\Program\CTEaxSpl.EXE /run
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE E:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE E:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SSC_UserPrompt] E:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [ccApp] "E:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] E:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [ctfmon] C:\WINDOWS\system32\dlg\ctfmon.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [SUPERAntiSpyware] E:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Startup: Webshots.lnk = E:\Program Files\Webshots\Launcher.exe
O4 - Global Startup: Trend Micro Anti-Spyware.lnk = E:\Program Files\Trend Micro\Tmas\Tmas.exe
O8 - Extra context menu item: &D&ownload &with BitComet - res://E:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://E:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://E:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://E:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - E:\Program Files\BitComet\tools\BitCometBHO_1.1.7.4.dll (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .qt: E:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1120753701497
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O20 - Winlogon Notify: !SASWinLogon - E:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: fccyywt - fccyywt.dll (file missing)
O20 - Winlogon Notify: NavLogon - E:\WINDOWS\system32\NavLogon.dll
O20 - Winlogon Notify: qomkhhh - qomkhhh.dll (file missing)
O20 - Winlogon Notify: vtsqo - E:\WINDOWS\system32\vtsqo.dll (file missing)
O20 - Winlogon Notify: WgaLogon - E:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - E:\WINDOWS\system32\WPDShServiceObj.dll
O21 - SSODL: ocgrep - {C17BC25F-C2A3-4255-B6A3-F55F5E4DB597} - E:\WINDOWS\ocgrep.dll
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - E:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - E:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - E:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Windows lsass Service (lsass) - Unknown owner - E:\WINDOWS\lsass.exe (file missing)
O23 - Service: Workstation Service Library (Microsoft Locator Service) - Unknown owner - E:\WINDOWS\wkssvc.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - E:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SAVRoam (SavRoam) - symantec - E:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - E:\Program Files\Symantec AntiVirus\Rtvscan.exe
Post #4
Before we proceed, run just option 1 for smitfraud.


Please download SmitfraudFix
Extract the content (a folder named SmitfraudFix) to your Desktop.

Open the SmitfraudFix folder and double-click smitfraudfix.cmd
Select option #1 - Search by typing 1 and press "Enter"; a text file will appear, which lists infected files (if present).
Please copy/paste the content of that report into your next reply.
Post #5
Run Option 1 for Smitfaud , post the log and then do this


Open Notepad and copy all the text inside the quote box by highlighting it all and pressing CTRL C on your keyboard, then paste it into Notepad

File::
E:\WINDOWS\ocgrep.dll
E:\WINDOWS\bxsbang.dll
E:\WINDOWS\kthemup.exe
E:\WINDOWS\system32\ihkmp.bak2
E:\WINDOWS\system32\oqstv.bak2
E:\WINDOWS\system32\ihkmp.bak1
E:\WINDOWS\system32\ihkmp.ini2

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CB6B9F94-6AB9-45C5-8CA0-874DDCC87844}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"ocgrep"= {C17BC25F-C2A3-4255-B6A3-F55F5E4DB597} - E:\WINDOWS\ocgrep.dll [2007-10-22 13:02 321536]

[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\fccyywt]
fccyywt.dll

[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\qomkhhh]
qomkhhh.dll

[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\vtsqo]
E:\WINDOWS\system32\vtsqo.dll


Save this as CFScript to your desktop.

Then drag the CFScript into ComboFix.exe as you see in the screenshot below.

[external image: Posted Image]


This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThis log.
Post #6
Here are the new logs that you requested.

Thanks again for your help!

1techwreck

SmitFraudFix v2.246

Scan done at 15:40:36.60, Wed 10/31/2007
Run from E:\Documents and Settings\Jack\Desktop\SmitfraudFix\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is FAT32
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» Process

E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\system32\spoolsv.exe
E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
E:\WINDOWS\System32\CTsvcCDA.EXE
E:\Program Files\Symantec AntiVirus\DefWatch.exe
E:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
E:\WINDOWS\System32\nvsvc32.exe
E:\WINDOWS\System32\svchost.exe
E:\Program Files\Symantec AntiVirus\Rtvscan.exe
E:\WINDOWS\System32\MsPMSPSv.exe
E:\WINDOWS\system32\fxssvc.exe
E:\WINDOWS\Explorer.EXE
E:\Program Files\Creative\ShareDLL\CtNotify.exe
E:\PROGRA~1\SYMANT~1\VPTray.exe
E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
E:\Program Files\Creative\ShareDLL\MediaDet.Exe
E:\Program Files\Trend Micro\Tmas\Tmas.exe
E:\WINDOWS\System32\wbem\wmiapsrv.exe
E:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
E:\Program Files\Internet Explorer\iexplore.exe
E:\WINDOWS\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» E:\


»»»»»»»»»»»»»»»»»»»»»»»» E:\WINDOWS

E:\WINDOWS\bxsbang.dll FOUND !
E:\WINDOWS\kthemup.exe FOUND !
E:\WINDOWS\ocgrep.dll FOUND !

»»»»»»»»»»»»»»»»»»»»»»»» E:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» E:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» E:\WINDOWS\system32


»»»»»»»»»»»»»»»»»»»»»»»» E:\WINDOWS\system32\LogFiles


»»»»»»»»»»»»»»»»»»»»»»»» E:\Documents and Settings\Jack


»»»»»»»»»»»»»»»»»»»»»»»» E:\Documents and Settings\Jack\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Start Menu


»»»»»»»»»»»»»»»»»»»»»»»» E:\DOCUME~1\JACK\FAVORI~1


»»»»»»»»»»»»»»»»»»»»»»»» Desktop


»»»»»»»»»»»»»»»»»»»»»»»» E:\Program Files


»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys


»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"


»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Rustock



»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Intel 21140-Based PCI Fast Ethernet Adapter (Generic) - Packet Scheduler Miniport
DNS Server Search Order: 65.127.163.6
DNS Server Search Order: 204.145.237.14

HKLM\SYSTEM\CCS\Services\Tcpip\..\{3156AEF9-0509-4E8B-A127-35403EB7EF68}: DhcpNameServer=[removed] [removed]
HKLM\SYSTEM\CS1\Services\Tcpip\..\{3156AEF9-0509-4E8B-A127-35403EB7EF68}: DhcpNameServer=[removed] [removed]
HKLM\SYSTEM\CS2\Services\Tcpip\..\{3156AEF9-0509-4E8B-A127-35403EB7EF68}: DhcpNameServer=[removed] [removed]
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=[removed] [removed]
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=[removed] [removed]
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=[removed] [removed]


»»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection


»»»»»»»»»»»»»»»»»»»»»»»» End

ComboFix 07-10-29.1** - Jack 2007-10-31 15:45:13.2 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.581 [GMT -4:00]
Running from: E:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: E:\Documents and Settings\Jack\Desktop\CFScript.txt
* Created a new restore point
.

((((((((((((((((((((((((( Files Created from 2007-09-28 to 2007-10-31 )))))))))))))))))))))))))))))))
.

2007-10-31 15:40 2,496 –a—— E:\WINDOWS\system32\tmp.reg
2007-10-30 16:37 d——– E:\Program Files\Virtual Earth 3D
2007-10-30 15:45 51,200 –a—— E:\WINDOWS\NirCmd.exe
2007-10-30 15:25 d——– E:\VundoFix Backups
2007-10-23 15:41 d——– E:\Program Files\SUPERAntiSpyware
2007-10-23 15:41 d——– E:\Documents and Settings\Jack\Application Data\SUPERAntiSpyware.com
2007-10-23 15:41 d——– E:\Documents and Settings\All Users.WINDOWS\Application Data\SUPERAntiSpyware.com
2007-10-22 15:32 d——– E:\Program Files\wxdiioeg
2007-10-22 15:25 321,536 –a—— E:\WINDOWS\ocgrep.dll
2007-10-22 15:25 294,912 –a—— E:\WINDOWS\bxsbang.dll
2007-10-22 15:25 108,032 –a—— E:\WINDOWS\kthemup.exe
2007-10-09 13:26 582,656 ——— E:\WINDOWS\system32\dllcache\rpcrt4.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-08-30 23:09 ——— d—–w E:\Program Files\Microsoft Streets & Trips
2007-08-30 23:09 ——— d—–w E:\Program Files\Microsoft Location Finder
2007-08-21 06:15 683,520 —-a-w E:\WINDOWS\system32\inetcomm.dll
2007-08-21 06:15 683,520 ——w E:\WINDOWS\system32\dllcache\inetcomm.dll
2007-08-20 10:04 824,832 —-a-w E:\WINDOWS\system32\dllcache\wininet.dll
2007-08-20 10:04 671,232 —-a-w E:\WINDOWS\system32\dllcache\mstime.dll
2007-08-20 10:04 63,488 ——w E:\WINDOWS\system32\dllcache\icardie.dll
2007-08-20 10:04 6,058,496 ——w E:\WINDOWS\system32\dllcache\ieframe.dll
2007-08-20 10:04 52,224 ——w E:\WINDOWS\system32\dllcache\msfeedsbs.dll
2007-08-20 10:04 477,696 —-a-w E:\WINDOWS\system32\dllcache\mshtmled.dll
2007-08-20 10:04 459,264 ——w E:\WINDOWS\system32\dllcache\msfeeds.dll
2007-08-20 10:04 44,544 ——w E:\WINDOWS\system32\dllcache\iernonce.dll
2007-08-20 10:04 384,512 ——w E:\WINDOWS\system32\dllcache\iedkcs32.dll
2007-08-20 10:04 383,488 ——w E:\WINDOWS\system32\dllcache\ieapfltr.dll
2007-08-20 10:04 3,584,512 —-a-w E:\WINDOWS\system32\dllcache\mshtml.dll
2007-08-20 10:04 27,648 —-a-w E:\WINDOWS\system32\dllcache\jsproxy.dll
2007-08-20 10:04 267,776 ——w E:\WINDOWS\system32\dllcache\iertutil.dll
2007-08-20 10:04 232,960 ——w E:\WINDOWS\system32\dllcache\webcheck.dll
2007-08-20 10:04 230,400 ——w E:\WINDOWS\system32\dllcache\ieaksie.dll
2007-08-20 10:04 214,528 —-a-w E:\WINDOWS\system32\dllcache\dxtrans.dll
2007-08-20 10:04 193,024 —-a-w E:\WINDOWS\system32\dllcache\msrating.dll
2007-08-20 10:04 153,088 ——w E:\WINDOWS\system32\dllcache\ieakeng.dll
2007-08-20 10:04 132,608 —-a-w E:\WINDOWS\system32\dllcache\extmgr.dll
2007-08-20 10:04 124,928 ——w E:\WINDOWS\system32\dllcache\advpack.dll
2007-08-20 10:04 105,984 ——w E:\WINDOWS\system32\dllcache\url.dll
2007-08-20 10:04 102,400 ——w E:\WINDOWS\system32\dllcache\occache.dll
2007-08-20 10:04 1,152,000 —-a-w E:\WINDOWS\system32\dllcache\urlmon.dll
2007-08-18 20:38 87,608 —-a-w E:\Documents and Settings\Jack\Application Data\ezpinst.exe
2007-08-18 20:38 47,360 —-a-w E:\Documents and Settings\Jack\Application Data\pcouffin.sys
2007-08-17 10:21 625,152 ——w E:\WINDOWS\system32\dllcache\iexplore.exe
2007-08-17 10:20 63,488 ——w E:\WINDOWS\system32\dllcache\ie4uinit.exe
2007-08-17 10:20 13,824 ——w E:\WINDOWS\system32\dllcache\ieudinit.exe
2007-08-17 07:34 161,792 ——w E:\WINDOWS\system32\dllcache\ieakui.dll
2007-07-30 23:19 92,504 —-a-w E:\WINDOWS\system32\dllcache\cdm.dll
2007-07-30 23:19 92,504 —-a-w E:\WINDOWS\system32\cdm.dll
2007-07-30 23:19 549,720 —-a-w E:\WINDOWS\system32\wuapi.dll
2007-07-30 23:19 549,720 —-a-w E:\WINDOWS\system32\dllcache\wuapi.dll
2007-07-30 23:19 53,080 —-a-w E:\WINDOWS\system32\wuauclt.exe
2007-07-30 23:19 53,080 —-a-w E:\WINDOWS\system32\dllcache\wuauclt.exe
2007-07-30 23:19 43,352 —-a-w E:\WINDOWS\system32\wups2.dll
2007-07-30 23:19 325,976 —-a-w E:\WINDOWS\system32\wucltui.dll
2007-07-30 23:19 325,976 —-a-w E:\WINDOWS\system32\dllcache\wucltui.dll
2007-07-30 23:19 203,096 —-a-w E:\WINDOWS\system32\wuweb.dll
2007-07-30 23:19 203,096 —-a-w E:\WINDOWS\system32\dllcache\wuweb.dll
2007-07-30 23:19 1,712,984 —-a-w E:\WINDOWS\system32\wuaueng.dll
2007-07-30 23:19 1,712,984 —-a-w E:\WINDOWS\system32\dllcache\wuaueng.dll
2007-07-30 23:18 33,624 —-a-w E:\WINDOWS\system32\wups.dll
2007-07-30 23:18 33,624 —-a-w E:\WINDOWS\system32\dllcache\wups.dll
2007-07-12 23:31 765,952 ——w E:\WINDOWS\system32\dllcache\vgx.dll
2007-07-09 13:16 582,656 —-a-w E:\WINDOWS\system32\rpcrt4.dll
2007-06-13 19:16 167,256 —-a-w E:\Program Files\pacificpoker.exe
2007-06-01 03:41 356,352 —-a-w E:\Documents and Settings\Jack\cwshredder.dll
2007-02-06 22:32 1,286,944 —-a-w E:\Program Files\SetupAnyDVD6114.exe
2007-01-27 21:14 1,038,336 —-a-w E:\Documents and Settings\Jack\AnyDialog.dll
2005-05-12 03:36 12,288 —-a-w E:\WINDOWS\Fonts\RandFont.dll
2004-09-09 14:14 9,216 –sha-w E:\Program Files\Common Files\Thumbs.db
2003-08-27 18:19 36,963 —-a-r E:\Program Files\Common Files\SM1updtr.dll
2007-03-04 20:48:46 1,156,726 –sh–w E:\WINDOWS\system32\ihkmp.bak2
2007-02-03 16:08:48 968,485 –sh–w E:\WINDOWS\system32\oqstv.bak2
2007-03-05 20:48:52 1,161,106 –sh–w E:\WINDOWS\system32\ihkmp.bak1
2007-03-05 22:34:34 1,160,360 –sh–w E:\WINDOWS\system32\ihkmp.ini2
.

((((((((((((((((((((((((((((( snapshot@2007-10-30_15.57.04.50 )))))))))))))))))))))))))))))))))))))))))
.
+ 2007-10-30 20:37:16 889,864 —-a-w E:\WINDOWS\assembly\GAC_32\Microsoft.MapPoint.GraphicsAPI\2.0.710.11001__31bf3856ad364e35\Microsoft.MapPoint.GraphicsAPI.dll
+ 2007-10-30 20:37:16 33,808 —-a-w E:\WINDOWS\assembly\GAC_MSIL\GeoCommunityCommon\2.0.0.0__31bf3856ad364e35\GeoCommunityCommon.dll
+ 2007-10-30 20:37:14 173,064 —-a-w E:\WINDOWS\assembly\GAC_MSIL\Microsoft.MapPoint.Data.CompactMapFile\2.0.710.11001__31bf3856ad364e35\Microsoft.MapPoint.Data.CompactMapFile.dll
+ 2007-10-30 20:37:14 128,008 —-a-w E:\WINDOWS\assembly\GAC_MSIL\Microsoft.MapPoint.Data.VirtualEarthTileDataSource\2.0.710.11001__31bf3856ad364e35\Microsoft.MapPoint.Data.VirtualEarthTileDataSource.dll
+ 2007-10-30 20:37:14 386,056 —-a-w E:\WINDOWS\assembly\GAC_MSIL\Microsoft.MapPoint.Data\2.0.710.11001__31bf3856ad364e35\Microsoft.MapPoint.Data.dll
+ 2007-10-30 20:37:16 70,664 —-a-w E:\WINDOWS\assembly\GAC_MSIL\Microsoft.MapPoint.GeoCommunities.COM\2.0.710.11001__31bf3856ad364e35\Microsoft.MapPoint.GeoCommunities.COM.dll
+ 2007-10-30 20:37:14 721,928 —-a-w E:\WINDOWS\assembly\GAC_MSIL\Microsoft.MapPoint.GeoCommunities\2.0.710.11001__31bf3856ad364e35\Microsoft.MapPoint.GeoCommunities.dll
+ 2007-10-30 20:37:14 214,024 —-a-w E:\WINDOWS\assembly\GAC_MSIL\Microsoft.MapPoint.Geometry\2.0.710.11001__31bf3856ad364e35\Microsoft.MapPoint.Geometry.dll
+ 2007-10-30 20:37:14 537,608 —-a-w E:\WINDOWS\assembly\GAC_MSIL\Microsoft.MapPoint.Graphics3D\2.0.710.11001__31bf3856ad364e35\Microsoft.MapPoint.Graphics3D.dll
+ 2007-10-30 20:37:14 148,488 —-a-w E:\WINDOWS\assembly\GAC_MSIL\Microsoft.MapPoint.MapControl3D\2.0.710.11001__31bf3856ad364e35\Microsoft.MapPoint.MapControl3D.dll
+ 2007-10-30 20:37:16 250,888 —-a-w E:\WINDOWS\assembly\GAC_MSIL\Microsoft.MapPoint.Modeling\2.0.710.11001__31bf3856ad364e35\Microsoft.MapPoint.Modeling.dll
+ 2007-10-30 20:37:14 148,488 —-a-w E:\WINDOWS\assembly\GAC_MSIL\Microsoft.MapPoint.Rendering3D.Utility\2.0.710.11001__31bf3856ad364e35\Microsoft.MapPoint.Rendering3D.Utility.dll
+ 2007-10-30 20:37:14 254,984 —-a-w E:\WINDOWS\assembly\GAC_MSIL\Microsoft.MapPoint.Rendering3D.WorldMemoryDataSource\2.0.710.11001__31bf3856ad364e35\Microsoft.MapPoint.Rendering3D.WorldMemoryDataSource.dll
+ 2007-10-30 20:37:14 721,928 —-a-w E:\WINDOWS\assembly\GAC_MSIL\Microsoft.MapPoint.Rendering3D\2.0.710.11001__31bf3856ad364e35\Microsoft.MapPoint.Rendering3D.dll
+ 2007-10-30 20:37:14 103,432 —-a-w E:\WINDOWS\assembly\GAC_MSIL\Microsoft.MapPoint.Utility\2.0.710.11001__31bf3856ad364e35\Microsoft.MapPoint.Utility.dll
+ 2007-10-30 20:37:14 62,472 —-a-w E:\WINDOWS\assembly\GAC_MSIL\Microsoft.MapPoint.UtilityPartialTrust\2.0.710.11001__31bf3856ad364e35\Microsoft.MapPoint.UtilityPartialTrust.dll
+ 2007-10-30 20:37:16 209,928 —-a-w E:\WINDOWS\assembly\GAC_MSIL\Microsoft.WindowsLive.Id.Client\2.0.710.11001__31bf3856ad364e35\Microsoft.WindowsLive.Id.Client.dll
- 2007-09-04 00:19:50 2,441,216 —-a-w E:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.JScript\3aa2f3b167b178ac1f196f129e9ea6b8\Microsoft.JScript.ni.dll
+ 2007-10-30 20:38:22 2,441,216 —-a-w E:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.JScript\3aa2f3b167b178ac1f196f129e9ea6b8\Microsoft.JScript.ni.dll
+ 2007-10-30 20:38:04 1,454,080 —-a-w E:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.MapPoint.#\268d0d2f72832097bd3c4adcced82e74\Microsoft.MapPoint.Data.ni.dll
+ 2007-10-30 20:38:14 1,601,536 —-a-w E:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.MapPoint.#\2d0507bb9a9d34d7ecac326c3a790b74\Microsoft.MapPoint.GraphicsAPI.ni.dll
+ 2007-10-30 20:38:36 1,536,000 —-a-w E:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.MapPoint.#\3bd97777fe237b37a6025260bd2a9dc8\Microsoft.MapPoint.Modeling.ni.dll
+ 2007-10-30 20:37:26 356,352 —-a-w E:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.MapPoint.#\5c711de6d0990851b54c46314fb32259\Microsoft.MapPoint.MapControl3D.ni.dll
+ 2007-10-30 20:38:10 2,510,848 —-a-w E:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.MapPoint.#\6c8d052bf93c22257de691718d015e10\Microsoft.MapPoint.Graphics3D.ni.dll
+ 2007-10-30 20:38:26 716,800 —-a-w E:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.MapPoint.#\779d9a2097969b6bb41083d38ed6730f\Microsoft.MapPoint.Data.VirtualEarthTileDataSource.ni.dll
+ 2007-10-30 20:38:32 1,622,016 —-a-w E:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.MapPoint.#\8bd810b4f3cc73444d369579ec1a7409\Microsoft.MapPoint.Rendering3D.WorldMemoryDataSource.ni.dll
+ 2007-10-30 20:38:26 475,136 —-a-w E:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.MapPoint.#\8f297c79b6f1e892729dfb1d404cf866\Microsoft.MapPoint.Data.CompactMapFile.ni.dll
+ 2007-10-30 20:37:54 823,296 —-a-w E:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.MapPoint.#\a7516e8dd30e4bd102f7765c8d8c8def\Microsoft.MapPoint.Geometry.ni.dll
+ 2007-10-30 20:37:58 585,728 —-a-w E:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.MapPoint.#\bd774a6105cab8583bb2f0f5d0fe53af\Microsoft.MapPoint.Rendering3D.Utility.ni.dll
+ 2007-10-30 20:37:56 237,568 —-a-w E:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.MapPoint.#\bfce210f04e15b0fb5c4286ef2696ec2\Microsoft.MapPoint.UtilityPartialTrust.ni.dll
+ 2007-10-30 20:37:42 3,084,288 —-a-w E:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.MapPoint.#\d6065b50a3f0dae170ac91b72d24c486\Microsoft.MapPoint.Rendering3D.ni.dll
+ 2007-10-30 20:38:12 331,776 —-a-w E:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.MapPoint.#\e723da8a6c0b19bfb102459fb3bc4886\Microsoft.MapPoint.Utility.ni.dll
- 2007-09-04 00:19:42 17,920 —-a-w E:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualC\ae6ce7475578342e0d4ce6e1e4168759\Microsoft.VisualC.ni.dll
+ 2007-10-30 20:38:16 17,920 —-a-w E:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualC\ae6ce7475578342e0d4ce6e1e4168759\Microsoft.VisualC.ni.dll
- 2007-09-04 00:19:50 77,824 —-a-w E:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.Vsa\70e9fc74111ea64aa28279c37d26e76d\Microsoft.Vsa.ni.dll
+ 2007-10-30 20:38:24 77,824 —-a-w E:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.Vsa\70e9fc74111ea64aa28279c37d26e76d\Microsoft.Vsa.ni.dll
- 2007-09-04 00:19:46 163,840 —-a-w E:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Configuratio#\a094ce0a978dc2e28d92521ecf313527\System.Configuration.Install.ni.dll
+ 2007-10-30 20:38:18 163,840 —-a-w E:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Configuratio#\a094ce0a978dc2e28d92521ecf313527\System.Configuration.Install.ni.dll
- 2007-09-04 00:19:24 2,695,168 —-a-w E:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Data.SqlXml\cf701dc11f109d120b62a613bdc71bd2\System.Data.SqlXml.ni.dll
+ 2007-10-30 20:37:48 2,695,168 —-a-w E:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Data.SqlXml\cf701dc11f109d120b62a613bdc71bd2\System.Data.SqlXml.ni.dll
- 2007-09-04 00:19:44 1,064,960 —-a-w E:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Management\4a8b52a0c2ff55804a33cf2d78af517f\System.Management.ni.dll
+ 2007-10-30 20:38:18 1,064,960 —-a-w E:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Management\4a8b52a0c2ff55804a33cf2d78af517f\System.Management.ni.dll
- 2007-09-04 00:19:28 339,968 —-a-w E:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Runtime.Seri#\7315d8926a7b24449c8328d564d926ee\System.Runtime.Serialization.Formatters.Soap.ni.dll
+ 2007-10-30 20:37:50 339,968 —-a-w E:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Runtime.Seri#\7315d8926a7b24449c8328d564d926ee\System.Runtime.Serialization.Formatters.Soap.ni.dll
+ 2007-03-13 14:57:12 163,328 —-a-w E:\WINDOWS\erdnt\subs\F3M\ERDNT.EXE
- 2007-04-16 21:30:06 2,332,368 —-a-w E:\WINDOWS\system32\D3DX9_29.DLL
+ 2007-10-11 23:18:34 2,332,368 —-a-w E:\WINDOWS\system32\D3DX9_29.DLL
- 2007-04-16 21:30:06 61,136 —-a-w E:\WINDOWS\system32\xinput9_1_0.dll
+ 2007-10-11 23:18:34 61,136 —-a-w E:\WINDOWS\system32\xinput9_1_0.dll
.
– Snapshot reset to current date –
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CB6B9F94-6AB9-45C5-8CA0-874DDCC87844}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Disc Detector"="E:\Program Files\Creative\ShareDLL\CtNotify.exe" [2001-04-02 02:00]
"CTStartup"="E:\Program Files\Creative\SBAudigy\Program\CTEaxSpl.exe" [2001-06-04 01:00]
"NvCplDaemon"="E:\WINDOWS\System32\NvCpl.dll" [2004-09-20 15:09]
"NvMediaCenter"="E:\WINDOWS\System32\NvMcTray.dll" [2004-09-20 15:09]
"SSC_UserPrompt"="E:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe" [2004-11-02 16:59]
"ccApp"="E:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2005-06-02 09:21]
"vptray"="E:\PROGRA~1\SYMANT~1\VPTray.exe" [2005-06-23 19:27]
"ctfmon"="C:\WINDOWS\system32\dlg\ctfmon.exe" []
"!AVG Anti-Spyware"="E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-07-06 17:34]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SUPERAntiSpyware"="E:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2007-10-31 14:01]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"DWQueuedReporting"="E:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t

E:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\
Trend Micro Anti-Spyware.lnk - E:\Program Files\Trend Micro\Tmas\Tmas.exe [2007-02-27 12:59:21]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
@=

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{03A80B1D-5C6A-42c2-9DFB-81B6005D8023}"= E:\Program Files\Trend Micro\Tmas\sshook.dll [2007-02-27 12:59 77824]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= E:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 13:55 77824]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"ocgrep"= {C17BC25F-C2A3-4255-B6A3-F55F5E4DB597} - E:\WINDOWS\ocgrep.dll [2007-10-22 13:02 321536]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
E:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 E:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\fccyywt]
fccyywt.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\qomkhhh]
qomkhhh.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\vtsqo]
E:\WINDOWS\system32\vtsqo.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\E:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^HP Image Zone Fast Start.lnk]
path=E:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\HP Image Zone Fast Start.lnk
backup=E:\WINDOWS\pss\HP Image Zone Fast Start.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\E:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^iM StartCenter.lnk]
path=E:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\iM StartCenter.lnk
backup=E:\WINDOWS\pss\iM StartCenter.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\E:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^InterVideo WinCinema Manager.lnk]
path=E:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\InterVideo WinCinema Manager.lnk
backup=E:\WINDOWS\pss\InterVideo WinCinema Manager.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\E:^Documents and Settings^Jack^Start Menu^Programs^Startup^Introducing Media Manager.lnk]
path=E:\Documents and Settings\Jack\Start Menu\Programs\Startup\Introducing Media Manager.lnk
backup=E:\WINDOWS\pss\Introducing Media Manager.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\!AVG Anti-Spyware]
"E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
"E:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AIM]
E:\Program Files\AIM\aim.exe -cnetwait.odl

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AnyDVD]
E:\Program Files\SlySoft\AnyDVD\AnyDVD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus Photo R300 Series]
E:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2F1.EXE /P30 "EPSON Stylus Photo R300 Series" /O6 "USB001" /M "Stylus Photo R300"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
E:\Program Files\HP\HP Software Update\HPWuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Jet Detection]
E:\Program Files\Creative\SBAudigy\PROGRAM\ADGJDet.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"E:\Program Files\Messenger\msmsgs.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
nwiz.exe /install

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxioDragToDisc]
"E:\Program Files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SM1BG]
E:\WINDOWS\SM1BG.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
E:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Taskbar]
E:\Program Files\Creative\SBAudigy\Taskbar\CTLTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TaskTray]
E:\Program Files\Creative\SBAudigy\Taskbar\CTLTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg]
E:\WINDOWS\Updreg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
"E:\Program Files\Windows Defender\MSASCui.exe" -hide

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"ccSetMgr"=2 (0x2)
"ccPwdSvc"=3 (0x3)

R1 Cinemsup;Cinemsup;E:\WINDOWS\system32\drivers\Cinemsup.sys
R1 DVDVRRdr_xp;DVDVRRdr_xp;E:\WINDOWS\system32\drivers\DVDVRRdr_xp.sys
R1 UDFReadr;UDFReadr;E:\WINDOWS\system32\drivers\UDFReadr.sys
R3 emu10kx;Creative EMU10K1/EMU10K2 Audio Driver (WDM);E:\WINDOWS\system32\drivers\e10kx2k.sys
S2 lsass;Windows lsass Service;"E:\WINDOWS\lsass.exe"
S2 Microsoft Locator Service;Workstation Service Library;"E:\WINDOWS\wkssvc.exe"
S3 EraserUtilDrv10614;EraserUtilDrv10614;\??\E:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilDrv10614.sys
S3 EraserUtilDrv10615;EraserUtilDrv10615;\??\E:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilDrv10615.sys
S3 p2pgasvc;Peer Networking Group Authentication;E:\WINDOWS\system32\svchost.exe -k p2psvc
S3 p2pimsvc;Peer Networking Identity Manager;E:\WINDOWS\system32\svchost.exe -k p2psvc
S3 p2psvc;Peer Networking;E:\WINDOWS\system32\svchost.exe -k p2psvc
S3 PNRPSvc;Peer Name Resolution Protocol;E:\WINDOWS\system32\svchost.exe -k p2psvc
S3 UBFWNet;Unibrain 1394 FireNet Adapter NT Driver;E:\WINDOWS\system32\DRIVERS\ubfwnet.sys

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
p2psvc p2psvc p2pimsvc p2pgasvc PNRPSvc

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1fc6a3c2-4641-11da-9643-00496e5560cf}]
AutoRun\command - D:\Help!.exe
open\command - D:\Help!.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{982c0930-69ed-11db-9708-00c0f030df6b}]
AutoRun\command - D:\PortableRoboForm.exe
RoboForm2Go\command - D:\PortableRoboForm.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c844fb2f-4dca-11dc-9752-00496e5560cf}]
Auto\command - boot.exe
AutoRun\command - E:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL boot.exe

.
**************************************************************************

catchme 0.3.1239 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-10-31 15:47:20
Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes …

scanning hidden autostart entries …

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Disc Detector = E:\Program Files\Creative\ShareDLL\CtNotify.exe?X???????????????? C?????Disc Detector?B???A???????A?p ????B???@?$?@?? C?????U?@?????????@?B???A???????A?? ????B???@?????P???$?@?? ????????A~??????????@?+?????????????????B?????? ????????????????????????????B
CTStartup = E:\Program Files\Creative\SBAudigy\Program\CTEaxSpl.EXE /run????????????x??????s$????\?w? ?w???????w???w4???????.??w4???????4???TA?s4????????&2???A~??A~????????\???\???????$???U?A~??A~\???\???????0?`???????B~\???\??????s????\??????s\????&2?A??s?&2???B~???

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-10-31 15:48:02
E:\ComboFix2.txt … 2007-10-30 15:57
.
— E O F —

Logfile of HijackThis v1.99.1
Scan saved at 3:49:53 PM, on 10/31/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\system32\spoolsv.exe
E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
E:\WINDOWS\System32\CTsvcCDA.EXE
E:\Program Files\Symantec AntiVirus\DefWatch.exe
E:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
E:\WINDOWS\System32\nvsvc32.exe
E:\WINDOWS\System32\svchost.exe
E:\Program Files\Symantec AntiVirus\Rtvscan.exe
E:\WINDOWS\System32\MsPMSPSv.exe
E:\WINDOWS\system32\fxssvc.exe
E:\Program Files\Creative\ShareDLL\CtNotify.exe
E:\PROGRA~1\SYMANT~1\VPTray.exe
E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
E:\Program Files\Creative\ShareDLL\MediaDet.Exe
E:\Program Files\Trend Micro\Tmas\Tmas.exe
E:\WINDOWS\System32\wbem\wmiapsrv.exe
E:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
E:\WINDOWS\explorer.exe
E:\Documents and Settings\Jack\Desktop\hijackthis\scanner.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=…6Ojg5&lid=2
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - E:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: (no name) - {CB6B9F94-6AB9-45C5-8CA0-874DDCC87844} - (no file)
O4 - HKLM\..\Run: [Disc Detector] E:\Program Files\Creative\ShareDLL\CtNotify.exe
O4 - HKLM\..\Run: [CTStartup] E:\Program Files\Creative\SBAudigy\Program\CTEaxSpl.EXE /run
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE E:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE E:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SSC_UserPrompt] E:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [ccApp] "E:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] E:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [ctfmon] C:\WINDOWS\system32\dlg\ctfmon.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [SUPERAntiSpyware] E:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Global Startup: Trend Micro Anti-Spyware.lnk = E:\Program Files\Trend Micro\Tmas\Tmas.exe
O8 - Extra context menu item: &D&ownload &with BitComet - res://E:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://E:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://E:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://E:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - E:\Program Files\BitComet\tools\BitCometBHO_1.1.7.4.dll (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .qt: E:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1120753701497
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O20 - Winlogon Notify: !SASWinLogon - E:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: fccyywt - fccyywt.dll (file missing)
O20 - Winlogon Notify: NavLogon - E:\WINDOWS\system32\NavLogon.dll
O20 - Winlogon Notify: qomkhhh - qomkhhh.dll (file missing)
O20 - Winlogon Notify: vtsqo - E:\WINDOWS\system32\vtsqo.dll (file missing)
O20 - Winlogon Notify: WgaLogon - E:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - E:\WINDOWS\system32\WPDShServiceObj.dll
O21 - SSODL: ocgrep - {C17BC25F-C2A3-4255-B6A3-F55F5E4DB597} - E:\WINDOWS\ocgrep.dll
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - E:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - E:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - E:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Windows lsass Service (lsass) - Unknown owner - E:\WINDOWS\lsass.exe (file missing)
O23 - Service: Workstation Service Library (Microsoft Locator Service) - Unknown owner - E:\WINDOWS\wkssvc.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - E:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SAVRoam (SavRoam) - symantec - E:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - E:\Program Files\Symantec AntiVirus\Rtvscan.exe
Post #7
Hey,

Thanks for the logs, lets move on.

You should print out these instructions, or copy them to a Notepad file for reading while in Safe Mode, because you will not be able to connect to the Internet to read from this site.

Download SmitfraudFix
Extract the content (a folder named SmitfraudFix) to your Desktop.


Download AVG Anti-Spyware Free to your desktop.
  • Once you have downloaded AVG Anti-Spyware Free, locate the icon on the desktop and double-click it to launch the set up program.
  • Once the setup is complete you will need run Ewido and update the definition files.
  • On the main screen select the icon Update then select the Update now link.
  • Next select the Start Update button, the update will start and a progress bar will show the updates being installed.
  • Once the update has completed select the Scanner icon at the top of the screen, then select the Settings tab.
  • Once in the Settings screen click on Recommended actions and then select Quarantine <– Dont forget this
  • Under Reports
  • Select Automatically generate report after every scan
  • Un-Select Only if threats were found
  • Close AVG Anti-Spyware Free <– Do not run the scan yet.


Boot your computer into Safemode
  • Go to Start> Shut Off your Computer> Restart
  • As the computer starts to boot-up, Tap the F8 KEY somewhat rapidly.
  • This will bring up a menu.
  • Use the Up and Down Arrow Keys to scroll up to SAFEMODE
  • Then press the Enter on your Keyboard
Tutorial if you need it How to boot into Safemode



  • Once in Safe Mode, open the SmitfraudFix folder again and double-click smitfraudfix.cmd
  • Select option #2 - Clean by typing 2 and press "Enter" to delete infected files.
  • You will be prompted : "Registry cleaning - Do you want to clean the registry ?"; answer "Yes" by typing Y and press "Enter" in order to remove the Desktop background and clean registry keys associated with the infection.
  • The tool will now check if wininet.dll is infected. You may be prompted to replace the infected file (if found); answer "Yes" by typing Y and press "Enter".
  • The tool may need to restart your computer to finish the cleaning process; if it doesn't, please restart into normal Windows.
  • A text file will appear onscreen, with results from the cleaning process; please copy/paste the content of that report into your next reply along with a new HijackThis log.
The report can also be found at the root of the system drive, usually at C:\rapport.txt







  • Launch AVG Anti-Spyware Free by double-clicking the icon on your desktop.
  • Select the Scanner icon at the top and then the Scan tab then click on Complete System Scan.
  • AVG will now begin the scanning process, be patient this may take a little time.
  • Once the scan is complete do the following:
  • If you have any infections you will prompted, then select Apply all actions
  • Next select the Reports icon at the top.
  • Select the Save report as button in the lower left hand of the screen and save it to a text file on your system
  • make sure to remember where you saved that file, this is important
  • Close AVG Anti-Spyware Free
IMPORTANT: Do not open any other windows or programs while AVG is scanning, it may interfere with the scanning process:


Reboot normally.

  • Open the SmitfraudFix folder and double-click smitfraudfix.cmd
  • Select option #3 - Delete Trusted zone by typing 3 and press Enter
  • Answer Yes to the question "Restore Trusted Zone ?" by typing Y and hit Enter.
Note, if you use SpywareBlaster and/or IE-SPYAD, it will be necessary to re-install the protection both afford. For SpywareBlaster, run the program and re-protect all items. For IE-SPYAD, run the batch file and reinstall the protection.



Please download ATF Cleaner by Atribune to your desktop.
  • This program is for XP and Windows 2000 only
  • Double-click ATF-Cleaner.exe to run the program.
  • Under Main choose: Select All
  • Click the Empty Selected button.
Your system may start up slower after running ATF Cleaner, this is expected but will be back to normal after the first or second boot up


Open HijackThis > Do a System Scan Only, close your browser and all open windows including this one, the only program or window you should have open is HijackThis, check the following entries and click on Fix Checked.

Some of these may be gone, not to worry

O2 - BHO: (no name) - {CB6B9F94-6AB9-45C5-8CA0-874DDCC87844} - (no file)

O20 - Winlogon Notify: fccyywt - fccyywt.dll (file missing)
O20 - Winlogon Notify: qomkhhh - qomkhhh.dll (file missing)
O20 - Winlogon Notify: vtsqo - E:\WINDOWS\system32\vtsqo.dll (file missing)

O21 - SSODL: ocgrep - {C17BC25F-C2A3-4255-B6A3-F55F5E4DB597} - E:\WINDOWS\ocgrep.dll


Post the log from Smitfraud fix, the AVG Spyware log and a New HJT log please
Post #8
Ken,

Here are the latest logs I had a little trouble with the AVG log after the scan it said there was'nt a log file so I rescanned and when I went to save it that time I found the missing log so I have posted both.

Thanks again for your help with this problem

1techwreck

SmitFraudFix v2.246

Scan done at 17:53:49.03, Thu 11/01/2007
Run from E:\Documents and Settings\Jack\Desktop\SmitfraudFix\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is FAT32
Fix run in safe mode

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Killing process


»»»»»»»»»»»»»»»»»»»»»»»» hosts

127.0.0.1 localhost

»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

S!Ri's WS2Fix: LSP not Found.


»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files

E:\WINDOWS\bxsbang.dll Deleted
bxsbang not found.
E:\WINDOWS\kthemup.exe Deleted
E:\WINDOWS\ocgrep.dll Deleted
Deleting [HKEY_CLASSES_ROOT\CLSID\{C17BC25F-C2A3-4255-B6A3-F55F5E4DB597}]

»»»»»»»»»»»»»»»»»»»»»»»» DNS

HKLM\SYSTEM\CCS\Services\Tcpip\..\{3156AEF9-0509-4E8B-A127-35403EB7EF68}: DhcpNameServer=[removed] [removed]
HKLM\SYSTEM\CS1\Services\Tcpip\..\{3156AEF9-0509-4E8B-A127-35403EB7EF68}: DhcpNameServer=[removed] [removed]
HKLM\SYSTEM\CS2\Services\Tcpip\..\{3156AEF9-0509-4E8B-A127-35403EB7EF68}: DhcpNameServer=[removed] [removed]
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=[removed] [removed]
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=[removed] [removed]
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=[removed] [removed]


»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» End

———————————————————
AVG Anti-Spyware - Scan Report
———————————————————

+ Created at: 6:58:15 PM 11/1/2007

+ Scan result:



E:\Program Files\pacificpoker.exe -> Adware.Casino : Cleaned with backup (quarantined).
E:\Documents and Settings\Skipper\Start Menu\Programs\Power Scan -> Adware.PowerScan : Cleaned with backup (quarantined).
E:\Documents and Settings\Skipper\Start Menu\Programs\Power Scan\Power Scan.lnk -> Adware.PowerScan : Cleaned with backup (quarantined).
E:\Documents and Settings\Jack\Desktop\Private\Clone.DVD.3+KeyGen\CloneDVDSetup.exe -> Backdoor.PoisonIvy.j : Cleaned with backup (quarantined).
E:\Documents and Settings\Jack\Cookies\jack@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
E:\Documents and Settings\Jack\Cookies\jack@adbrite[2].txt -> TrackingCookie.Adbrite : Cleaned.
E:\Documents and Settings\Jack\Cookies\jack@adbrite[3].txt -> TrackingCookie.Adbrite : Cleaned.
E:\Documents and Settings\Jack\Cookies\[removed][1].txt -> TrackingCookie.Adbrite : Cleaned.
E:\Documents and Settings\Jack\Cookies\[removed][3].txt -> TrackingCookie.Adbrite : Cleaned.
E:\Documents and Settings\Jack\Cookies\jack@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned.
:mozilla.28:E:\Documents and Settings\Jack\Desktop\Private\Firefox_Portable\FirefoxPortable\Data\profile\cookies.txt -> TrackingCookie.Doubleclick : Cleaned.
E:\Documents and Settings\Jack\Cookies\jack@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned.
E:\Documents and Settings\Jack\Cookies\jack@questionmarket[2].txt -> TrackingCookie.Questionmarket : Cleaned.
:mozilla.27:E:\Documents and Settings\Jack\Desktop\Private\Firefox_Portable\FirefoxPortable\Data\profile\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.29:E:\Documents and Settings\Jack\Desktop\Private\Firefox_Portable\FirefoxPortable\Data\profile\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.36:E:\Documents and Settings\Jack\Desktop\Private\Firefox_Portable\FirefoxPortable\Data\profile\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
E:\Documents and Settings\Jack\Cookies\[removed][1].txt -> TrackingCookie.Tacoda : Cleaned.
E:\Documents and Settings\Jack\Cookies\jack@tacoda[1].txt -> TrackingCookie.Tacoda : Cleaned.
E:\Documents and Settings\Jack\Cookies\jack@tacoda[2].txt -> TrackingCookie.Tacoda : Cleaned.
E:\Documents and Settings\Jack\Cookies\jack@tribalfusion[2].txt -> TrackingCookie.Tribalfusion : Cleaned.
E:\Documents and Settings\Jack\Cookies\jack@zedo[2].txt -> TrackingCookie.Zedo : Cleaned.


::Report end

scanned second time here is second log

———————————————————
AVG Anti-Spyware - Scan Report
———————————————————

+ Created at: 6:58:15 PM 11/1/2007

+ Scan result:



E:\Program Files\pacificpoker.exe -> Adware.Casino : Cleaned with backup (quarantined).
E:\Documents and Settings\Skipper\Start Menu\Programs\Power Scan -> Adware.PowerScan : Cleaned with backup (quarantined).
E:\Documents and Settings\Skipper\Start Menu\Programs\Power Scan\Power Scan.lnk -> Adware.PowerScan : Cleaned with backup (quarantined).
E:\Documents and Settings\Jack\Desktop\Private\Clone.DVD.3+KeyGen\CloneDVDSetup.exe -> Backdoor.PoisonIvy.j : Cleaned with backup (quarantined).
E:\Documents and Settings\Jack\Cookies\jack@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
E:\Documents and Settings\Jack\Cookies\jack@adbrite[2].txt -> TrackingCookie.Adbrite : Cleaned.
E:\Documents and Settings\Jack\Cookies\jack@adbrite[3].txt -> TrackingCookie.Adbrite : Cleaned.
E:\Documents and Settings\Jack\Cookies\[removed][1].txt -> TrackingCookie.Adbrite : Cleaned.
E:\Documents and Settings\Jack\Cookies\[removed][3].txt -> TrackingCookie.Adbrite : Cleaned.
E:\Documents and Settings\Jack\Cookies\jack@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned.
:mozilla.28:E:\Documents and Settings\Jack\Desktop\Private\Firefox_Portable\FirefoxPortable\Data\profile\cookies.txt -> TrackingCookie.Doubleclick : Cleaned.
E:\Documents and Settings\Jack\Cookies\jack@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned.
E:\Documents and Settings\Jack\Cookies\jack@questionmarket[2].txt -> TrackingCookie.Questionmarket : Cleaned.
:mozilla.27:E:\Documents and Settings\Jack\Desktop\Private\Firefox_Portable\FirefoxPortable\Data\profile\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.29:E:\Documents and Settings\Jack\Desktop\Private\Firefox_Portable\FirefoxPortable\Data\profile\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.36:E:\Documents and Settings\Jack\Desktop\Private\Firefox_Portable\FirefoxPortable\Data\profile\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
E:\Documents and Settings\Jack\Cookies\[removed][1].txt -> TrackingCookie.Tacoda : Cleaned.
E:\Documents and Settings\Jack\Cookies\jack@tacoda[1].txt -> TrackingCookie.Tacoda : Cleaned.
E:\Documents and Settings\Jack\Cookies\jack@tacoda[2].txt -> TrackingCookie.Tacoda : Cleaned.
E:\Documents and Settings\Jack\Cookies\jack@tribalfusion[2].txt -> TrackingCookie.Tribalfusion : Cleaned.
E:\Documents and Settings\Jack\Cookies\jack@zedo[2].txt -> TrackingCookie.Zedo : Cleaned.


::Report end

Logfile of HijackThis v1.99.1
Scan saved at 7:55:23 PM, on 11/1/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\system32\spoolsv.exe
E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
E:\WINDOWS\System32\CTsvcCDA.EXE
E:\Program Files\Symantec AntiVirus\DefWatch.exe
E:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
E:\WINDOWS\System32\nvsvc32.exe
E:\WINDOWS\System32\svchost.exe
E:\Program Files\Symantec AntiVirus\Rtvscan.exe
E:\WINDOWS\System32\MsPMSPSv.exe
E:\WINDOWS\system32\fxssvc.exe
E:\WINDOWS\Explorer.EXE
E:\WINDOWS\system32\wuauclt.exe
E:\Program Files\Creative\ShareDLL\CtNotify.exe
E:\PROGRA~1\SYMANT~1\VPTray.exe
E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
E:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
E:\Program Files\Creative\ShareDLL\MediaDet.Exe
E:\Program Files\Trend Micro\Tmas\Tmas.exe
E:\WINDOWS\System32\wbem\wmiapsrv.exe
E:\Documents and Settings\Jack\Desktop\hijackthis\scanner.exe

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - E:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [Disc Detector] E:\Program Files\Creative\ShareDLL\CtNotify.exe
O4 - HKLM\..\Run: [CTStartup] E:\Program Files\Creative\SBAudigy\Program\CTEaxSpl.EXE /run
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE E:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE E:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SSC_UserPrompt] E:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [ccApp] "E:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] E:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [ctfmon] C:\WINDOWS\system32\dlg\ctfmon.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [SUPERAntiSpyware] E:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Global Startup: Trend Micro Anti-Spyware.lnk = E:\Program Files\Trend Micro\Tmas\Tmas.exe
O8 - Extra context menu item: &D&ownload &with BitComet - res://E:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://E:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://E:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://E:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - E:\Program Files\BitComet\tools\BitCometBHO_1.1.7.4.dll (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .qt: E:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1120753701497
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O20 - Winlogon Notify: !SASWinLogon - E:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: NavLogon - E:\WINDOWS\system32\NavLogon.dll
O20 - Winlogon Notify: WgaLogon - E:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - E:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - E:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - E:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - E:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Windows lsass Service (lsass) - Unknown owner - E:\WINDOWS\lsass.exe (file missing)
O23 - Service: Workstation Service Library (Microsoft Locator Service) - Unknown owner - E:\WINDOWS\wkssvc.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - E:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SAVRoam (SavRoam) - symantec - E:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - E:\Program Files\Symantec AntiVirus\Rtvscan.exe
Post #9

You have had many infections on this computer, I am scratching my head trying to figure out how this thing can even start up. Let me tell ya, there are things going around that leave no recourse but to format and do a clean install, thats really a pain in the neck, a lot of this stuff, even after its cleaned from your system leaves some damage behind, I am saying this because if you want to keep and enjoy your computer your going to have to clean up your surfing habits in the future.


We removed Vundo and Smitfraud, your still infected with the SDbot worm. :(

Download SDFix and save it to your Desktop.

Double click SDFix.exe and it will extract the files to %systemdrive%
(Drive that contains the Windows Directory, typically C:\SDFix)

Please then reboot your computer in Safe Mode by doing the following :
  • Restart your computer
  • After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
  • Instead of Windows loading as normal, the Advanced Options Menu should appear;
  • Select the first option, to run Windows in Safe Mode, then press Enter.
  • Choose your usual account.
  • Open the extracted SDFix folder and double click RunThis.bat to start the script.
  • Type Y to begin the cleanup process.
  • It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
  • Press any Key and it will restart the PC.
  • When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
  • Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt
    (Report.txt will also be copied to Clipboard ready for posting back on the forum).
  • Finally paste the contents of the Report.txt back on the forum with a new HijackThis log
Post #10
Ken,
This computer is running much better now I have run SDfix and here are the new logs

Thanks again,

1techwreck


SDFix: Version 1.113

Run by [removed] on Fri 11/02/2007 at 03:21 PM

Microsoft Windows XP [Version 5.1.2600]

Running From: E:\SDFix

Safe Mode:
Checking Services:

Name:
lsass

ImagePath:
"E:\WINDOWS\lsass.exe"

lsass - Deleted



Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting…


Normal Mode:
Checking Files:

Trojan Files Found:

E:\WINDOWS\SYSTEM32\YAYVWVT.DLL - Deleted
E:\WINDOWS\SYSTEM32\DQTDWNCR.DLL - Deleted
E:\WINDOWS\system32\TFTP2548 - Deleted
E:\WINDOWS\system32\TFTP620 - Deleted
E:\WINDOWS\system32\TFTP440 - Deleted
E:\WINDOWS\system32\TFTP2704 - Deleted
E:\WINDOWS\system32\TFTP3008 - Deleted
E:\WINDOWS\system32\TFTP2636 - Deleted
E:\WINDOWS\system32\TFTP2648 - Deleted
E:\WINDOWS\system32\TFTP2652 - Deleted
E:\WINDOWS\system32\TFTP2692 - Deleted
E:\WINDOWS\system32\TFTP3172 - Deleted
E:\WINDOWS\system32\TFTP3720 - Deleted
E:\WINDOWS\system32\TFTP3732 - Deleted
E:\WINDOWS\system32\TFTP2516 - Deleted
E:\WINDOWS\system32\TFTP2620 - Deleted
E:\WINDOWS\system32\TFTP1348 - Deleted
E:\WINDOWS\system32\TFTP340 - Deleted
E:\WINDOWS\system32\TFTP4016 - Deleted



Removing Temp Files…

ADS Check:

E:\WINDOWS
No streams found.

E:\WINDOWS\system32
No streams found.

E:\WINDOWS\system32\svchost.exe
No streams found.

E:\WINDOWS\system32\ntoskrnl.exe
No streams found.



Final Check:

catchme 0.3.1253 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-02 15:31:05
Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes …

scanning hidden services …

scanning hidden autostart entries …

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Disc Detector = E:\Program Files\Creative\ShareDLL\CtNotify.exe?X???????????????? C?????Disc Detector?B???A???????A?p ????B???@?$?@?? C?????U?@?????????@?B???A???????A?? ????B???@?????P???$?@?? ????????A~??????????@???????????????????B?????? ????????????????????????????B
CTStartup = E:\Program Files\Creative\SBAudigy\Program\CTEaxSpl.EXE /run????????????x??????s$????\?w? ?w???????w???w4???????.??w4???????4???TA?s4????????&2???A~??A~????????\???\???????$???U?A~??A~\???\????????E`???????B~\???\??????s????\??????s\????&2?A??s?&2???B~???

scanning hidden files …

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Remaining Services:
——————



Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"E:\\Program Files\\TVUPlayer\\TVUPlayer.exe"="E:\\Program Files\\TVUPlayer\\TVUPlayer.exe:*:Enabled:TVUPlayer Component"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

Remaining Files:
—————

File Backups: - E:\SDFix\backups\backups.zip

Files with Hidden Attributes:

Fri 23 Feb 2007 996,642 ..SH. — "E:\WINDOWS\system32\ihkmp.tmp"
Sun 4 Mar 2007 1,156,726 ..SH. — "E:\WINDOWS\system32\ihkmp.bak2"
Sat 3 Feb 2007 968,485 ..SH. — "E:\WINDOWS\system32\oqstv.bak2"
Mon 5 Mar 2007 1,161,106 ..SH. — "E:\WINDOWS\system32\ihkmp.bak1"
Wed 27 Oct 2004 48 ..SH. — "E:\Documents and Settings\All Users\DRM\v2ks.sec.bak"
Wed 27 Oct 2004 400 ..SH. — "E:\Documents and Settings\All Users\DRM\v2ks.bla.bak"
Wed 6 Oct 2004 4,348 ..SH. — "E:\Documents and Settings\All Users\DRM\DRMv1.bak"
Wed 27 Jul 2005 4,348 A.SH. — "E:\Documents and Settings\All Users.WINDOWS\DRM\DRMv1.bak"
Wed 28 Mar 2007 0 A.SH. — "E:\Documents and Settings\All Users.WINDOWS\DRM\Cache\Indiv02.tmp"
Sat 7 Dec 2002 234,413,712 A..H. — "E:\Documents and Settings\Skipper\My Documents\My Music\MP3\PC Game - Madden NFL ™ 2002 (Full Game).exe"
Thu 14 Nov 2002 8,934,400 A..H. — "E:\Documents and Settings\Skipper\My Documents\My Music\MP3\RealOnePlayerGold.exe"
Sat 23 Nov 2002 31,966,771 A..H. — "E:\Documents and Settings\Skipper\My Documents\My Music\MP3\Norton Ghost v7.0 Enterprise Edition.exe"
Sun 3 Nov 2002 16,678,912 A..H. — "E:\Documents and Settings\Skipper\My Documents\My Music\MP3\DVD Copy Plus 4.0 - Includes Crack for 4.0.exe"
Fri 24 Jun 2005 4,484 A.SH. — "E:\Documents and Settings\Jack\Application Data\Roxio\Dragon\DiscInfoCache\SAMSUNG__CD-ROM_SC-152L___C100_310_DICV018_DRGV205002F.TMP"
Sat 8 Sep 2007 4,408 A.SH. — "E:\Documents and Settings\Jack\Application Data\Roxio\Dragon\DiscInfoCache\SONY_____DVD_RW_DW-D26A___JYS3_300_DICV018_DRGV205002F.TMP"

Finished!

Logfile of HijackThis v1.99.1
Scan saved at 3:32:57 PM, on 11/2/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\system32\spoolsv.exe
E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
E:\WINDOWS\System32\CTsvcCDA.EXE
E:\Program Files\Symantec AntiVirus\DefWatch.exe
E:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
E:\WINDOWS\System32\nvsvc32.exe
E:\WINDOWS\System32\svchost.exe
E:\Program Files\Symantec AntiVirus\Rtvscan.exe
E:\WINDOWS\System32\MsPMSPSv.exe
E:\WINDOWS\system32\fxssvc.exe
E:\WINDOWS\Explorer.EXE
E:\WINDOWS\system32\wuauclt.exe
E:\WINDOWS\system32\notepad.exe
E:\Program Files\Creative\ShareDLL\CtNotify.exe
E:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
E:\Program Files\Common Files\Symantec Shared\ccApp.exe
E:\PROGRA~1\SYMANT~1\VPTray.exe
E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
E:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
E:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
E:\Program Files\Creative\ShareDLL\MediaDet.Exe
E:\Program Files\Trend Micro\Tmas\Tmas.exe
E:\Documents and Settings\Jack\Desktop\hijackthis\scanner.exe

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - E:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [Disc Detector] E:\Program Files\Creative\ShareDLL\CtNotify.exe
O4 - HKLM\..\Run: [CTStartup] E:\Program Files\Creative\SBAudigy\Program\CTEaxSpl.EXE /run
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE E:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE E:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SSC_UserPrompt] E:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [ccApp] "E:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] E:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [ctfmon] C:\WINDOWS\system32\dlg\ctfmon.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "E:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [SUPERAntiSpyware] E:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Global Startup: Trend Micro Anti-Spyware.lnk = E:\Program Files\Trend Micro\Tmas\Tmas.exe
O8 - Extra context menu item: &D&ownload &with BitComet - res://E:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://E:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://E:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://E:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - E:\Program Files\BitComet\tools\BitCometBHO_1.1.7.4.dll (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .qt: E:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1120753701497
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O20 - Winlogon Notify: !SASWinLogon - E:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: NavLogon - E:\WINDOWS\system32\NavLogon.dll
O20 - Winlogon Notify: WgaLogon - E:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - E:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - E:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - E:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - E:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Workstation Service Library (Microsoft Locator Service) - Unknown owner - E:\WINDOWS\wkssvc.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - E:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SAVRoam (SavRoam) - symantec - E:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - E:\Program Files\Symantec AntiVirus\Rtvscan.exe
Post #11
A bit more to do.
  • Go to Start> Run and type in services.msc then press Enter
  • Scroll down to Workstation Service Library
  • Double Click that service to open it.
  • Click on Stop Service.
  • Then change the Startup Type to Disabled.
  • OK your way out of the program.
  • Open HJT > Misc Tools > Delete an NT Service
  • Type in Microsoft Locator Service
  • Then click on OK, it will ask you to reboot, do so.


Open HijackThis > Do a System Scan Only, close your browser and all open windows including this one, the only program or window you should have open is HijackThis, check the following entries and click on Fix Checked.

O4 - HKLM\..\Run: [ctfmon] C:\WINDOWS\system32\dlg\ctfmon.exe


We need to make sure all hidden files are showing :
  • Click Start.
  • Open My Computer.
  • Select the Tools menu and click Folder Options.
  • Select the View tab.
  • Under the Hidden files and folders heading select Show hidden files and folders.
  • Uncheck the Hide file extensions for known types option.
  • Uncheck the Hide protected operating system files (recommended) option.
  • Click Yes to confirm.
  • Click OK.
Once your system is clean, we suggest that you reverse this to keep critical windows files from accidently being deleted.


Delete both these files.
E:\WINDOWS\wkssvc.exe
C:\WINDOWS\system32\dlg\ctfmon.exe <– Be careful with this one, the one is C:\windows\system32 is legit, do not delete that one.

Post a new HJT log please
Post #12
Ken,

Here is the latest HJT log

Thanks again for all your help

1techwreck

Logfile of HijackThis v1.99.1
Scan saved at 4:08:51 PM, on 11/6/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\system32\spoolsv.exe
E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
E:\WINDOWS\System32\CTsvcCDA.EXE
E:\Program Files\Symantec AntiVirus\DefWatch.exe
E:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
E:\WINDOWS\System32\nvsvc32.exe
E:\WINDOWS\System32\svchost.exe
E:\Program Files\Symantec AntiVirus\Rtvscan.exe
E:\WINDOWS\System32\MsPMSPSv.exe
E:\WINDOWS\system32\fxssvc.exe
E:\WINDOWS\Explorer.EXE
E:\Program Files\Creative\ShareDLL\CtNotify.exe
E:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
E:\Program Files\Common Files\Symantec Shared\ccApp.exe
E:\PROGRA~1\SYMANT~1\VPTray.exe
E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
E:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
E:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
E:\Program Files\Creative\ShareDLL\MediaDet.Exe
E:\WINDOWS\system32\wuauclt.exe
E:\Program Files\Trend Micro\Tmas\Tmas.exe
E:\Documents and Settings\Jack\Desktop\repair\hijackthis\scanner.exe

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - E:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [Disc Detector] E:\Program Files\Creative\ShareDLL\CtNotify.exe
O4 - HKLM\..\Run: [CTStartup] E:\Program Files\Creative\SBAudigy\Program\CTEaxSpl.EXE /run
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE E:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE E:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SSC_UserPrompt] E:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [ccApp] "E:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] E:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "E:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [SUPERAntiSpyware] E:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Global Startup: Trend Micro Anti-Spyware.lnk = E:\Program Files\Trend Micro\Tmas\Tmas.exe
O8 - Extra context menu item: &D&ownload &with BitComet - res://E:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://E:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://E:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://E:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - E:\Program Files\BitComet\tools\BitCometBHO_1.1.7.4.dll (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .qt: E:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1120753701497
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O20 - Winlogon Notify: !SASWinLogon - E:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: NavLogon - E:\WINDOWS\system32\NavLogon.dll
O20 - Winlogon Notify: WgaLogon - E:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - E:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - E:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - E:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - E:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - E:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SAVRoam (SavRoam) - symantec - E:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - E:\Program Files\Symantec AntiVirus\Rtvscan.exe
Post #13
Log looks good :thumbup:

Let update your Java as it may be letting this bad stuff in.
  • Your Java is out of date and leaving your system vulnerable.
  • Go to your Add-Remove Programs in the Control Panel and uninstall any previous versions of Java (J2SE Runtime Environment)
  • It should have an icon next to it:
    [external image: Posted Image]
    Select it and click Remove.
  • Reboot your system.
  • Then go to the Sun Microsystems and install the update
  • Java Runtime Environment Version 6 Update 3 <–This is what you need to download and install.
  • If you chose the online installation, it will prompt you to run the program.
  • If you chose the offline installation, you will be prompted to save the file and you can run it from wherever you saved it.
  • Then after install you can verify your installation here Sun Java Verify
I like to to do the offline installation and save the setup file in case I may need it in the future

How is your system behaving now????

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI