What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] ISMPack6 and others hijack

15 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hi, I've deleted a few others by running ad aware but my hijack this log still shows a few suspect characters. Any help would be greatly appreciated. Logfile of HijackThis v1.99.1 Scan saved at 8:39:37 AM, on 10/30/2007 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: F:\WINDOWS\System32\smss.exe F:\WINDOWS\system32\winlogon.exe F:\WINDOWS\system32\services.exe F:\WINDOWS\system32\lsass.exe F:\WINDOWS\system32\svchost.exe F:\WINDOWS\System32\svchost.exe F:\WINDOWS\Explorer.EXE F:\WINDOWS\system32\spoolsv.exe F:\WINDOWS\System32\svchost.exe F:\WINDOWS\plite731.exe F:\Program Files\ISM2\ISMPack6.exe F:\QUICKENW\QWDLLS.EXE F:\WINDOWS\System32\wuauclt.exe F:\WINDOWS\System32\wuauclt.exe I:\Program Files\hijackthis\HijackThis.exe O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - F:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - F:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar1.02.5000.1021\en-us\msntb.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - f:\program files\google\googletoolbar3.dll O4 - HKLM\..\Run: [Net-It Launcher] F:\WINDOWS\System32\NILaunch.exe O4 - HKLM\..\Run: [mmtask] F:\Program Files\MUSICMATCH\Musicmatch Jukebox\mmtask.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "F:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "F:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [plite731] F:\WINDOWS\plite731.exe O4 - HKLM\..\RunOnce: [RemoveInstallPath] cmd.exe F:\WINDOWS\system32\cmd.exe /c rmdir /S /Q "F:\PROGRA~1\WinAble" > nul O4 - HKCU\..\Run: [msnmsgr] "F:\Program Files\MSN Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [swg] F:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [AdobeUpdater] F:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe O4 - HKCU\..\Run: [ISMPack6] "F:\Program Files\ISM2\ISMPack6.exe" O4 - Global Startup: Quicken Startup.lnk = F:\QUICKENW\QWDLLS.EXE O4 - Global Startup: Microsoft Office.lnk = F:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: E&xport to Microsoft Excel - res://F:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\MSMSGS.EXE O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\MSMSGS.EXE O15 - Trusted Zone: *.whataboutadog.com O15 - Trusted Zone: *.whataboutarabit.com O17 - HKLM\System\CCS\Services\Tcpip\..\{A480D802-76BA-4198-B221-77DEE53A4A27}: NameServer = 216.144.187.71,204.186.0.201 O23 - Service: Google Updater Service (gusvc) - Google - F:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - F:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
Post #2 last edited
kelbel,

Welcome to the forum, let me tell ya, you have a real mess going on , :( One of the reason your so heavily infected is because your Operating System is very outdated and letting this stuff in, after we are done you need to install all the latest windows updates including Service Pack 2. Don't do that yet, you need a clean system or else it will give you problems.

You have a downloader trojan called Downloader.Agent.awf or Downloader.Agent.ayy. This trojan replaces legitimate files that are common on most computers with an infected file. It then moves the legitimate file to a "bak" or backup folder. Please follow the directions below to run FindAWF so we can identify the files that have been infected and the backups then restore them.
1.
Please download FindAWF and save it to your desktop

* Double-click FindAWF.exe to start the tool.
* Select option #1 - Scan for bak folders by typing 1 and press 'Enter'
* When the tool has completed, a report will open up in notepad. Please post the results of the awf.txt here.
**Do not run any other option unless directed to do so.**

It also looks like you posted your HJT log in Safemode, we always need to see the log in normal windows please
Post #3
Thanks for the reply. I tried to clean-up a few things while I was waiting but I wasn't too successful. Anyway, I have to download programs to my laptop and transfer them over to my infected desktop, so the hijack this log was run on my desktop in normal mode, saved to a thumb drive and posted from my laptop. My desktop is running so poorly that I can not even get to whatthetech. Here is the awf you requested Find AWF report by noahdfear ©2006 Version 1.40 The current date is: Fri 11/02/2007 The current time is: 14:00:37.30 bak folders found ~~~~~~~~~~~ Directory of F:\WINDOWS\SYSTEM32\BAK 02/05/1998 03:16 PM 24,576 NILaunch.exe 1 File(s) 24,576 bytes Directory of F:\PROGRA~1\QUICKT~1\BAK 09/18/2004 07:50 AM 98,304 qttask.exe 1 File(s) 98,304 bytes Directory of F:\PROGRA~1\MSNMES~1\BAK 0 File(s) 0 bytes Directory of F:\PROGRA~1\MUSICM~1\MUSICM~1\BAK 10/08/2004 08:49 AM 131,072 mm_tray.exe 10/08/2004 08:49 AM 53,248 mmtask.exe 2 File(s) 184,320 bytes Directory of F:\PROGRA~1\COMMON~1\REAL\UPDATE~1\BAK 01/02/2005 11:11 AM 180,269 realsched.exe 1 File(s) 180,269 bytes Directory of F:\PROGRA~1\JAVA\JRE16~1.0_0\BIN\BAK 03/14/2007 03:43 AM 83,608 jusched.exe 1 File(s) 83,608 bytes Directory of F:\PROGRA~1\GOOGLE\GOOGLE~1\121128~1.546\BAK 01/24/2007 07:15 PM 171,448 GoogleToolbarNotifier.exe 1 File(s) 171,448 bytes Directory of F:\PROGRA~1\ADOBE\READER~1.0\READER\BAK 05/11/2007 03:06 AM 40,048 Reader_sl.exe 1 File(s) 40,048 bytes Duplicate files of bak directory contents ~~~~~~~~~~~~~~~~~~~~~~~ 24080 Sep 22 2007 "F:\WINDOWS\system32\NILaunch.exe" 24576 Feb 5 1998 "F:\WINDOWS\system32\bak\NILaunch.exe" 98304 Sep 18 2004 "F:\Program Files\QuickTime\bak\qttask.exe" 131072 Oct 8 2004 "F:\Program Files\MUSICMATCH\Musicmatch Jukebox\bak\mm_tray.exe" 24080 Sep 22 2007 "F:\Program Files\MUSICMATCH\Musicmatch Jukebox\mmtask.exe" 53248 Oct 8 2004 "F:\Program Files\MUSICMATCH\Musicmatch Jukebox\bak\mmtask.exe" 180269 Jan 2 2005 "F:\Program Files\Common Files\Real\Update_OB\bak\realsched.exe" 77824 Mar 18 2007 "F:\Program Files\Java\jre1.6.0\bin\jusched.exe" 24080 Sep 22 2007 "F:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" 83608 Mar 14 2007 "F:\Program Files\Java\jre1.6.0_01\bin\bak\jusched.exe" 52272 Jan 24 2007 "F:\Program Files\Google\googletoolbar3user.exe" 24080 Sep 22 2007 "F:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" 138168 Jan 24 2007 "F:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe" 171448 Jan 24 2007 "F:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\bak\GoogleToolbarNotifier.exe" 24080 Sep 22 2007 "F:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" 40048 May 11 2007 "F:\Program Files\Adobe\Reader 8.0\Reader\bak\Reader_sl.exe" end of report and a new hjt log Logfile of HijackThis v1.99.1 Scan saved at 2:58:10 PM, on 11/2/2007 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: F:\WINDOWS\System32\smss.exe F:\WINDOWS\system32\winlogon.exe F:\WINDOWS\system32\services.exe F:\WINDOWS\system32\lsass.exe F:\WINDOWS\system32\svchost.exe F:\WINDOWS\System32\svchost.exe F:\WINDOWS\system32\spoolsv.exe F:\WINDOWS\Explorer.EXE F:\WINDOWS\System32\svchost.exe F:\Program Files\QdrPack\QdrPack9.exe F:\QUICKENW\QWDLLS.EXE F:\WINDOWS\System32\wuauclt.exe F:\WINDOWS\System32\wuauclt.exe I:\Program Files\hijackthis\HijackThis.exe O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - F:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - F:\Program Files\MSN Apps\ST1.03.0000.1005\en-xu\stmain.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - f:\program files\google\googletoolbar3.dll O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - F:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar1.02.5000.1021\en-us\msntb.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - F:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - F:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar1.02.5000.1021\en-us\msntb.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - f:\program files\google\googletoolbar3.dll O4 - HKLM\..\Run: [Net-It Launcher] F:\WINDOWS\System32\NILaunch.exe O4 - HKLM\..\Run: [mmtask] F:\Program Files\MUSICMATCH\Musicmatch Jukebox\mmtask.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "F:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "F:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKCU\..\Run: [msnmsgr] "F:\Program Files\MSN Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [swg] F:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [AdobeUpdater] F:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe O4 - HKCU\..\Run: [QdrPack9] "F:\Program Files\QdrPack\QdrPack9.exe" O4 - Global Startup: Quicken Startup.lnk = F:\QUICKENW\QWDLLS.EXE O4 - Global Startup: Microsoft Office.lnk = F:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: E&xport to Microsoft Excel - res://F:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\MSMSGS.EXE O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\MSMSGS.EXE O15 - Trusted Zone: *.whataboutadog.com O15 - Trusted Zone: *.whataboutarabit.com O17 - HKLM\System\CCS\Services\Tcpip\..\{A480D802-76BA-4198-B221-77DEE53A4A27}: NameServer = 216.144.187.71,204.186.0.201 O20 - Winlogon Notify: qnvjkoto - qnvjkoto.dll (file missing) O23 - Service: Google Updater Service (gusvc) - Google - F:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - F:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
Post #4
Lets do this.

Double-click FindAWF.exe to start the tool.

* Select option #2 - Restore files from bak folders by typing 2 and press 'Enter'
* A text file will open up. Please copy/paste the following bolded text into the text file:

"F:\WINDOWS\system32\bak\NILaunch.exe"
"F:\Program Files\QuickTime\bak\qttask.exe"
"F:\Program Files\MUSICMATCH\Musicmatch Jukebox\bak\mm_tray.exe"
"F:\Program Files\MUSICMATCH\Musicmatch Jukebox\bak\mmtask.exe"
"F:\Program Files\Common Files\Real\Update_OB\bak\realsched.exe"
"F:\Program Files\Java\jre1.6.0_01\bin\bak\jusched.exe"
"F:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\bak\GoogleToolbarNotifier.exe"
"F:\Program Files\Adobe\Reader 8.0\Reader\bak\Reader_sl.exe"

* Close the .txt file and click 'Yes' to save the changes.
* When the tool has completed, a report will open up in notepad.

Please post the results of the awf.txt here.


Download: DelDomains and save it to the desktop.
  • Close all open windows and your browser
  • Right Click DelDomains.inf and select > Install
  • Reboot your computer
Internet Explorer is needed to run this properly.



Download ComboFix from Here or Here to your Desktop.
  • Double click combofix.exe and follow the prompts.
  • When finished, it shall produce a log for you. Post the Combofix log and a HiJackthis log in your next reply
Note: Do not mouseclick combofix's window while its running. That may cause it to stall

Let me see the AWF log , the Combofix log and a New HJT log please
Post #5
Ok, I walked away during the combo fix scan for infected files and when i came back my screen was black and wouldn't respond, so i rebooted. When i rebooted I was taken to the advanced bios set screen? The logs are below:

Logfile of HijackThis v1.99.1
Scan saved at 8:53:35 AM, on 11/3/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
F:\WINDOWS\System32\smss.exe
F:\WINDOWS\system32\winlogon.exe
F:\WINDOWS\system32\services.exe
F:\WINDOWS\system32\lsass.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\System32\svchost.exe
F:\WINDOWS\Explorer.EXE
F:\WINDOWS\system32\spoolsv.exe
F:\WINDOWS\System32\svchost.exe
F:\WINDOWS\System32\NILaunch.exe
F:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
F:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
F:\Program Files\QdrPack\QdrPack9.exe
F:\QUICKENW\QWDLLS.EXE
F:\WINDOWS\System32\wuauclt.exe
F:\WINDOWS\system32\notepad.exe
F:\Program Files\Java\jre1.6.0_01\bin\jucheck.exe
I:\Program Files\hijackthis\HijackThis.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Editor plugin - {2B59A30B-E773-4c5f-BD26-080B7D3AB3F8} - ramtask.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - F:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - F:\Program Files\MSN Apps\ST1.03.0000.1005\en-xu\stmain.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - f:\program files\google\googletoolbar3.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - F:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar1.02.5000.1021\en-us\msntb.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - F:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - F:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar1.02.5000.1021\en-us\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - f:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [Net-It Launcher] F:\WINDOWS\System32\NILaunch.exe
O4 - HKLM\..\Run: [mmtask] F:\Program Files\MUSICMATCH\Musicmatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "F:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "F:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [msnmsgr] "F:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [swg] F:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [AdobeUpdater] F:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe
O4 - HKCU\..\Run: [QdrPack9] "F:\Program Files\QdrPack\QdrPack9.exe"
O4 - Global Startup: Quicken Startup.lnk = F:\QUICKENW\QWDLLS.EXE
O4 - Global Startup: Microsoft Office.lnk = F:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://F:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\MSMSGS.EXE
O10 - Broken Internet access because of LSP provider 'winsock2.dll' missing
O17 - HKLM\System\CCS\Services\Tcpip\..\{A480D802-76BA-4198-B221-77DEE53A4A27}: NameServer = 216.144.187.71,204.186.0.201
O20 - Winlogon Notify: qnvjkoto - qnvjkoto.dll (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - F:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - F:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

—————————————————————————————————————————————————————————————————————————

ComboFix 07-11-01.1** - Kelly 2007-11-03 8:36:43.1 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.1.1252.1.1033.18.31 [GMT -5:00]
Running from: F:\Documents and Settings\[removed]\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

F:\Documents and Settings\All Users\Start Menu\Live Safety Center.lnk
F:\Documents and Settings\All Users\Start Menu\Online Security Guide.lnk
F:\Documents and Settings\Kelly\Application Data\macromedia\Flash Player\#SharedObjects\USDBRP97\www.broadcaster.com
F:\Documents and Settings\Kelly\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com
F:\Documents and Settings\Kelly\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com\settings.sol
F:\Documents and Settings\Kelly\Favorites\Online Security Guide.lnk
F:\Documents and Settings\NetworkService\Application Data\NetMon
F:\Documents and Settings\NetworkService\Application Data\NetMon\domains.txt
F:\Documents and Settings\NetworkService\Application Data\NetMon\log.txt
F:\Program Files\ISM2
F:\Program Files\ISM2\cringupd.exe
F:\Program Files\Temporary
F:\Program Files\WinBudget
F:\WINDOWS\system32\a13
F:\WINDOWS\system32\cssrss.exe
F:\WINDOWS\system32\drivers\core.cache.dsk
F:\WINDOWS\system32\e2
F:\WINDOWS\system32\g1
F:\WINDOWS\system32\help.txt
F:\WINDOWS\system32\i8
F:\WINDOWS\system32\i8\taldrvr11.exe
F:\WINDOWS\system32\nso12k.sys
F:\WINDOWS\system32\pac.txt
F:\WINDOWS\system32\qnvjkoto.dllbox
F:\WINDOWS\system32\x22

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
——-\LEGACY_CORE
——-\LEGACY_DOMAINSERVICE
——-\LEGACY_DRIVER
——-\Driver


((((((((((((((((((((((((( Files Created from 2007-10-03 to 2007-11-03 )))))))))))))))))))))))))))))))
.

2007-11-03 08:35 51,200 –a—— F:\WINDOWS\NirCmd.exe
2007-11-02 17:33 10,240 –a—— F:\WINDOWS\system32\winsock2.dll
2007-11-02 17:33 1 –a—— F:\WINDOWS\system32\rc.dat
2007-11-02 17:33 1 –a—— F:\WINDOWS\system32\ps1.dat
2007-11-02 17:33 1 –a—— F:\WINDOWS\system32\cs.dat
2007-11-02 17:33 1 –a—— F:\WINDOWS\system32\cookie1.dat
2007-11-02 17:24 52,736 –a—— F:\WINDOWS\system32\ramtask.dll
2007-11-01 19:48 dr-h—– F:\$VAULT$.AVG
2007-11-01 18:36 d——– F:\Documents and Settings\Kelly\Application Data\AVG7
2007-11-01 18:32 d——– F:\Documents and Settings\LocalService\Application Data\AVG7
2007-11-01 18:31 499,712 –a—— F:\WINDOWS\system32\msvcp71.dll
2007-11-01 18:31 348,160 –a—— F:\WINDOWS\system32\msvcr71.dll
2007-11-01 18:30 d——– F:\Documents and Settings\All Users\Application Data\avg7
2007-11-01 17:03 d——– F:\Documents and Settings\All Users\Application Data\Grisoft
2007-11-01 15:03 d——– F:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2007-11-01 15:02 d——– F:\Documents and Settings\Kelly\Application Data\SUPERAntiSpyware.com
2007-11-01 13:48 1,842 –a—— F:\WINDOWS\system32\tmp.reg
2007-10-31 06:15 340,032 –a—— F:\WINDOWS\system32\addewpxn.dll
2007-10-31 06:14 412,917 —hs—- F:\WINDOWS\system32\fgjlm.bak2
2007-10-30 11:55 d——– F:\Program Files\QdrPack
2007-10-29 22:00 6,465 —hs—- F:\WINDOWS\system32\fgjlm.bak1
2007-10-29 21:51 d——– F:\WINDOWS\system32\Mz02r
2007-10-29 21:51 d–hs—- F:\WINDOWS\Sm9obnNvbg
2007-10-29 21:51 294,668 –a—— F:\WINDOWS\frexup2.exe
2007-10-29 21:51 41 –a—— F:\WINDOWS\plite731_uninstaller_.bat
2007-10-29 16:37 d–hs—- F:\FOUND.008
2007-10-05 09:41 d–hs—- F:\FOUND.007

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-09-28 16:08 156,992 —-a-w F:\WINDOWS\system32\DivXCodecVersionChecker.exe
2007-09-28 16:07 524,288 —-a-w F:\WINDOWS\system32\DivXsm.exe
2007-09-28 16:07 43,528 ——w F:\WINDOWS\system32\drivers\PxHelp20.sys
2007-09-28 16:07 3,596,288 —-a-w F:\WINDOWS\system32\qt-dx331.dll
2007-09-28 16:07 200,704 —-a-w F:\WINDOWS\system32\ssldivx.dll
2007-09-28 16:07 129,784 ——w F:\WINDOWS\system32\pxafs.dll
2007-09-28 16:07 120,056 ——w F:\WINDOWS\system32\pxcpyi64.exe
2007-09-28 16:07 118,520 ——w F:\WINDOWS\system32\pxinsi64.exe
2007-09-28 16:07 1,044,480 —-a-w F:\WINDOWS\system32\libdivx.dll
2007-09-28 16:05 823,296 —-a-w F:\WINDOWS\system32\divx_xx0c.dll
2007-09-28 16:05 823,296 —-a-w F:\WINDOWS\system32\divx_xx07.dll
2007-09-28 16:05 81,920 —-a-w F:\WINDOWS\system32\dpl100.dll
2007-09-28 16:05 802,816 —-a-w F:\WINDOWS\system32\divx_xx11.dll
2007-09-28 16:05 739,840 —-a-w F:\WINDOWS\system32\DivX.dll
2007-09-28 16:05 593,920 —-a-w F:\WINDOWS\system32\dpuGUI11.dll
2007-09-28 16:05 57,344 —-a-w F:\WINDOWS\system32\dpv11.dll
2007-09-28 16:05 53,248 —-a-w F:\WINDOWS\system32\dpuGUI10.dll
2007-09-28 16:05 344,064 —-a-w F:\WINDOWS\system32\dpus11.dll
2007-09-28 16:05 294,912 —-a-w F:\WINDOWS\system32\dpu11.dll
2007-09-28 16:05 294,912 —-a-w F:\WINDOWS\system32\dpu10.dll
2007-09-28 16:05 196,608 —-a-w F:\WINDOWS\system32\dtu100.dll
2007-09-28 16:05 12,288 —-a-w F:\WINDOWS\system32\DivXWMPExtType.dll
2004-01-28 17:45 68,688 —-a-w F:\Documents and Settings\Kelly\Application Data\GDIPFONTCACHEV1.DAT
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2B59A30B-E773-4c5f-BD26-080B7D3AB3F8}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Net-It Launcher"="F:\WINDOWS\System32\NILaunch.exe" [1998-02-05 15:16]
"mmtask"="F:\Program Files\MUSICMATCH\Musicmatch Jukebox\mmtask.exe" [2004-10-08 08:49]
"SunJavaUpdateSched"="F:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43]
"Adobe Reader Speed Launcher"="F:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="F:\Program Files\MSN Messenger\msnmsgr.exe" []
"swg"="F:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2007-01-24 19:15]
"AdobeUpdater"="F:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [2007-03-01 10:37]
"QdrPack9"="F:\Program Files\QdrPack\QdrPack9.exe" [2007-10-30 10:49]

F:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Quicken Startup.lnk - F:\QUICKENW\QWDLLS.EXE [2002-05-21 12:39:31]
Microsoft Office.lnk - F:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\qnvjkoto]
qnvjkoto.dll

R3 WUSB54GPV4SRV;Linksys Home Wireless-G USB Adaptor Driver;F:\WINDOWS\System32\DRIVERS\rt2500usb.sys
S3 USB-100;Linksys EtherFast 10/100 Compact USB Network Adapter;F:\WINDOWS\System32\DRIVERS\USB100M.SYS

.
**************************************************************************

catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-03 08:46:00
Windows 5.1.2600 Service Pack 1 FAT NTAPI

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-11-03 8:49:17 - machine was rebooted
.
— E O F —
——————————————————————————————————————————————————————————————————————————


Find AWF report by noahdfear ©2006
Version 1.40
Option 2 run successfully

The current date is: Sat 11/03/2007
The current time is: 8:24:34.18


bak folders found
~~~~~~~~~~~


Directory of F:\WINDOWS\SYSTEM32\BAK

02/05/1998 03:16 PM 24,576 NILaunch.exe
1 File(s) 24,576 bytes

Directory of F:\PROGRA~1\QUICKT~1\BAK

09/18/2004 07:50 AM 98,304 qttask.exe
1 File(s) 98,304 bytes

Directory of F:\PROGRA~1\MSNMES~1\BAK

0 File(s) 0 bytes

Directory of F:\PROGRA~1\MUSICM~1\MUSICM~1\BAK

10/08/2004 08:49 AM 131,072 mm_tray.exe
10/08/2004 08:49 AM 53,248 mmtask.exe
2 File(s) 184,320 bytes

Directory of F:\PROGRA~1\COMMON~1\REAL\UPDATE~1\BAK

01/02/2005 11:11 AM 180,269 realsched.exe
1 File(s) 180,269 bytes

Directory of F:\PROGRA~1\JAVA\JRE16~1.0_0\BIN\BAK

03/14/2007 03:43 AM 83,608 jusched.exe
1 File(s) 83,608 bytes

Directory of F:\PROGRA~1\GOOGLE\GOOGLE~1\121128~1.546\BAK

01/24/2007 07:15 PM 171,448 GoogleToolbarNotifier.exe
1 File(s) 171,448 bytes

Directory of F:\PROGRA~1\ADOBE\READER~1.0\READER\BAK

05/11/2007 03:06 AM 40,048 Reader_sl.exe
1 File(s) 40,048 bytes


Duplicate files of bak directory contents
~~~~~~~~~~~~~~~~~~~~~~~

24576 Feb 5 1998 "F:\WINDOWS\system32\NILaunch.exe"
24576 Feb 5 1998 "F:\WINDOWS\system32\bak\NILaunch.exe"
98304 Sep 18 2004 "F:\Program Files\QuickTime\qttask.exe"
98304 Sep 18 2004 "F:\Program Files\QuickTime\bak\qttask.exe"
131072 Oct 8 2004 "F:\Program Files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe"
131072 Oct 8 2004 "F:\Program Files\MUSICMATCH\Musicmatch Jukebox\bak\mm_tray.exe"
53248 Oct 8 2004 "F:\Program Files\MUSICMATCH\Musicmatch Jukebox\mmtask.exe"
53248 Oct 8 2004 "F:\Program Files\MUSICMATCH\Musicmatch Jukebox\bak\mmtask.exe"
180269 Jan 2 2005 "F:\Program Files\Common Files\Real\Update_OB\realsched.exe"
180269 Jan 2 2005 "F:\Program Files\Common Files\Real\Update_OB\bak\realsched.exe"
77824 Mar 18 2007 "F:\Program Files\Java\jre1.6.0\bin\jusched.exe"
83608 Mar 14 2007 "F:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
83608 Mar 14 2007 "F:\Program Files\Java\jre1.6.0_01\bin\bak\jusched.exe"
52272 Jan 24 2007 "F:\Program Files\Google\googletoolbar3user.exe"
171448 Jan 24 2007 "F:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe"
138168 Jan 24 2007 "F:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe"
171448 Jan 24 2007 "F:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\bak\GoogleToolbarNotifier.exe"
40048 May 11 2007 "F:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
40048 May 11 2007 "F:\Program Files\Adobe\Reader 8.0\Reader\bak\Reader_sl.exe"


end of report
Post #6
Moving along.

Double-click FindAWF.exe to start the tool.

* Select option #3 - Remove bak folders by typing 3 and press 'Enter'
* A text file will open up. Please copy/paste the following bolded text into the text file:

F:\WINDOWS\system32\bak
F:\Program Files\QuickTime\bak
F:\Program Files\MUSICMATCH\Musicmatch Jukebox\bak
F:\Program Files\Common Files\Real\Update_OB\bak
F:\Program Files\Java\jre1.6.0_01\bin\bak
F:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\bak
F:\Program Files\Adobe\Reader 8.0\Reader\bak

* Close the .txt file and click 'Yes' to save the changes.
* When the tool has completed, a report will open up in notepad.

Please post the results of the awf.txt in your next reply



Open Notepad and copy all the text inside the quote box by highlighting it all and pressing CTRL C on your keyboard, then paste it into Notepad

Files::
F:\WINDOWS\frexup2.exe
F:\WINDOWS\plite731_uninstaller_.bat
F:\WINDOWS\system32\addewpxn.dll
F:\WINDOWS\system32\fgjlm.bak2
F:\WINDOWS\system32\fgjlm.bak1


Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2B59A30B-E773-4c5f-BD26-080B7D3AB3F8}]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\qnvjkoto]
qnvjkoto.dll



Save this as CFScript to your desktop.

Then drag the CFScript into ComboFix.exe as you see in the screenshot below.

[external image: Posted Image]

This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply
together with a new HijackThis log.

Let me see the AWF log , the Combofix log and a new HJT log please
Post #7
Thanks again, Here are the requested files


Find AWF report by noahdfear ©2006
Version 1.40
Option 3 run successfully

The current date is: Sun 11/04/2007
The current time is: 7:54:40.32


bak folders found
~~~~~~~~~~~


Directory of F:\PROGRA~1\MSNMES~1\BAK

0 File(s) 0 bytes


Duplicate files of bak directory contents
~~~~~~~~~~~~~~~~~~~~~~~



end of report


ComboFix 07-11-01.1** - Kelly 2007-11-04 8:04:51.2 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.1.1252.1.1033.18.33 [GMT -5:00]
Running from: F:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: F:\Documents and Settings\Kelly\Desktop\CFScript .txt
* Created a new restore point
.

((((((((((((((((((((((((( Files Created from 2007-10-04 to 2007-11-04 )))))))))))))))))))))))))))))))
.

2007-11-03 08:35 51,200 –a—— F:\WINDOWS\NirCmd.exe
2007-11-02 17:33 10,240 –a—— F:\WINDOWS\system32\winsock2.dll
2007-11-02 17:33 1 –a—— F:\WINDOWS\system32\rc.dat
2007-11-02 17:33 1 –a—— F:\WINDOWS\system32\ps1.dat
2007-11-02 17:33 1 –a—— F:\WINDOWS\system32\cs.dat
2007-11-02 17:33 1 –a—— F:\WINDOWS\system32\cookie1.dat
2007-11-02 17:24 52,736 –a—— F:\WINDOWS\system32\ramtask.dll
2007-11-01 19:48 dr-h—– F:\$VAULT$.AVG
2007-11-01 18:36 d——– F:\Documents and Settings\Kelly\Application Data\AVG7
2007-11-01 18:32 d——– F:\Documents and Settings\LocalService\Application Data\AVG7
2007-11-01 18:31 499,712 –a—— F:\WINDOWS\system32\msvcp71.dll
2007-11-01 18:31 348,160 –a—— F:\WINDOWS\system32\msvcr71.dll
2007-11-01 18:30 d——– F:\Documents and Settings\All Users\Application Data\avg7
2007-11-01 17:03 d——– F:\Documents and Settings\All Users\Application Data\Grisoft
2007-11-01 15:03 d——– F:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2007-11-01 15:02 d——– F:\Documents and Settings\Kelly\Application Data\SUPERAntiSpyware.com
2007-11-01 13:48 1,842 –a—— F:\WINDOWS\system32\tmp.reg
2007-10-31 06:15 340,032 –a—— F:\WINDOWS\system32\addewpxn.dll
2007-10-31 06:14 412,917 —hs—- F:\WINDOWS\system32\fgjlm.bak2
2007-10-30 11:55 d——– F:\Program Files\QdrPack
2007-10-29 22:00 6,465 —hs—- F:\WINDOWS\system32\fgjlm.bak1
2007-10-29 21:51 d——– F:\WINDOWS\system32\Mz02r
2007-10-29 21:51 d–hs—- F:\WINDOWS\Sm9obnNvbg
2007-10-29 21:51 294,668 –a—— F:\WINDOWS\frexup2.exe
2007-10-29 21:51 41 –a—— F:\WINDOWS\plite731_uninstaller_.bat

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-09-28 16:08 156,992 —-a-w F:\WINDOWS\system32\DivXCodecVersionChecker.exe
2007-09-28 16:07 524,288 —-a-w F:\WINDOWS\system32\DivXsm.exe
2007-09-28 16:07 43,528 ——w F:\WINDOWS\system32\drivers\PxHelp20.sys
2007-09-28 16:07 3,596,288 —-a-w F:\WINDOWS\system32\qt-dx331.dll
2007-09-28 16:07 200,704 —-a-w F:\WINDOWS\system32\ssldivx.dll
2007-09-28 16:07 129,784 ——w F:\WINDOWS\system32\pxafs.dll
2007-09-28 16:07 120,056 ——w F:\WINDOWS\system32\pxcpyi64.exe
2007-09-28 16:07 118,520 ——w F:\WINDOWS\system32\pxinsi64.exe
2007-09-28 16:07 1,044,480 —-a-w F:\WINDOWS\system32\libdivx.dll
2007-09-28 16:05 823,296 —-a-w F:\WINDOWS\system32\divx_xx0c.dll
2007-09-28 16:05 823,296 —-a-w F:\WINDOWS\system32\divx_xx07.dll
2007-09-28 16:05 81,920 —-a-w F:\WINDOWS\system32\dpl100.dll
2007-09-28 16:05 802,816 —-a-w F:\WINDOWS\system32\divx_xx11.dll
2007-09-28 16:05 739,840 —-a-w F:\WINDOWS\system32\DivX.dll
2007-09-28 16:05 593,920 —-a-w F:\WINDOWS\system32\dpuGUI11.dll
2007-09-28 16:05 57,344 —-a-w F:\WINDOWS\system32\dpv11.dll
2007-09-28 16:05 53,248 —-a-w F:\WINDOWS\system32\dpuGUI10.dll
2007-09-28 16:05 344,064 —-a-w F:\WINDOWS\system32\dpus11.dll
2007-09-28 16:05 294,912 —-a-w F:\WINDOWS\system32\dpu11.dll
2007-09-28 16:05 294,912 —-a-w F:\WINDOWS\system32\dpu10.dll
2007-09-28 16:05 196,608 —-a-w F:\WINDOWS\system32\dtu100.dll
2007-09-28 16:05 12,288 —-a-w F:\WINDOWS\system32\DivXWMPExtType.dll
2004-01-28 17:45 68,688 —-a-w F:\Documents and Settings\Kelly\Application Data\GDIPFONTCACHEV1.DAT
.

((((((((((((((((((((((((((((( snapshot@2007-11-03_ 8.46.51.42 )))))))))))))))))))))))))))))))))))))))))
.
+ 2007-03-13 15:57:12 163,328 —-a-w F:\WINDOWS\erdnt\subs\F3M\ERDNT.EXE
+ 2002-08-29 11:40:56 443,392 —-a-w F:\WINDOWS\system32\fxsapi.dll
+ 2002-08-29 11:41:24 130,048 —-a-w F:\WINDOWS\system32\fxsclnt.exe
+ 2002-08-29 11:40:56 271,360 —-a-w F:\WINDOWS\system32\fxscomex.dll
+ 2002-08-29 11:41:24 216,064 —-a-w F:\WINDOWS\system32\fxscover.exe
+ 2002-08-29 11:40:56 24,064 —-a-w F:\WINDOWS\system32\fxsdrv.dll
+ 2002-08-29 11:40:56 20,992 —-a-w F:\WINDOWS\system32\fxsext32.dll
+ 2002-08-29 11:40:56 7,168 —-a-w F:\WINDOWS\system32\fxsperf.dll
+ 2002-08-29 11:39:56 6,656 —-a-w F:\WINDOWS\system32\fxsres.dll
+ 2002-08-29 11:40:56 559,616 —-a-w F:\WINDOWS\system32\fxsst.dll
+ 2002-08-29 11:41:24 250,368 —-a-w F:\WINDOWS\system32\fxssvc.exe
+ 2002-08-29 11:40:56 236,032 —-a-w F:\WINDOWS\system32\fxst30.dll
+ 2002-08-29 11:40:56 391,168 —-a-w F:\WINDOWS\system32\fxstiff.dll
+ 2002-08-29 11:40:56 149,504 —-a-w F:\WINDOWS\system32\fxsui.dll
+ 2002-08-29 11:40:56 185,856 —-a-w F:\WINDOWS\system32\fxswzrd.dll
+ 2002-08-29 11:40:56 395,264 —-a-w F:\WINDOWS\system32\fxsxp32.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Net-It Launcher"="F:\WINDOWS\System32\NILaunch.exe" [1998-02-05 15:16]
"mmtask"="F:\Program Files\MUSICMATCH\Musicmatch Jukebox\mmtask.exe" [2004-10-08 08:49]
"SunJavaUpdateSched"="F:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43]
"Adobe Reader Speed Launcher"="F:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="F:\Program Files\MSN Messenger\msnmsgr.exe" []
"swg"="F:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2007-01-24 19:15]
"AdobeUpdater"="F:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [2007-03-01 10:37]
"QdrPack9"="F:\Program Files\QdrPack\QdrPack9.exe" [2007-10-30 10:49]

F:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Quicken Startup.lnk - F:\QUICKENW\QWDLLS.EXE [2002-05-21 12:39:31]
Microsoft Office.lnk - F:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04]

R3 WUSB54GPV4SRV;Linksys Home Wireless-G USB Adaptor Driver;F:\WINDOWS\System32\DRIVERS\rt2500usb.sys
S3 USB-100;Linksys EtherFast 10/100 Compact USB Network Adapter;F:\WINDOWS\System32\DRIVERS\USB100M.SYS

.
**************************************************************************

catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-04 08:07:14
Windows 5.1.2600 Service Pack 1 FAT NTAPI

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-11-04 8:08:32
F:\ComboFix2.txt … 2007-11-03 08:49
.
— E O F —


Logfile of HijackThis v1.99.1
Scan saved at 8:15:56 AM, on 11/4/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
F:\WINDOWS\System32\smss.exe
F:\WINDOWS\system32\winlogon.exe
F:\WINDOWS\system32\services.exe
F:\WINDOWS\system32\lsass.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\System32\svchost.exe
F:\WINDOWS\system32\spoolsv.exe
F:\WINDOWS\System32\svchost.exe
F:\WINDOWS\System32\NILaunch.exe
F:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
F:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
F:\Program Files\QdrPack\QdrPack9.exe
F:\QUICKENW\QWDLLS.EXE
F:\WINDOWS\System32\wuauclt.exe
F:\Program Files\Java\jre1.6.0_01\bin\jucheck.exe
F:\WINDOWS\explorer.exe
F:\Program Files\internet explorer\iexplore.exe
I:\Program Files\hijackthis\HijackThis.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - F:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - F:\Program Files\MSN Apps\ST1.03.0000.1005\en-xu\stmain.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - f:\program files\google\googletoolbar3.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - F:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar1.02.5000.1021\en-us\msntb.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - F:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - F:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar1.02.5000.1021\en-us\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - f:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [Net-It Launcher] F:\WINDOWS\System32\NILaunch.exe
O4 - HKLM\..\Run: [mmtask] F:\Program Files\MUSICMATCH\Musicmatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "F:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "F:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [msnmsgr] "F:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [swg] F:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [AdobeUpdater] F:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe
O4 - HKCU\..\Run: [QdrPack9] "F:\Program Files\QdrPack\QdrPack9.exe"
O4 - Global Startup: Quicken Startup.lnk = F:\QUICKENW\QWDLLS.EXE
O4 - Global Startup: Microsoft Office.lnk = F:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://F:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\MSMSGS.EXE
O10 - Broken Internet access because of LSP provider 'winsock2.dll' missing
O17 - HKLM\System\CCS\Services\Tcpip\..\{A480D802-76BA-4198-B221-77DEE53A4A27}: NameServer = 216.144.187.71,204.186.0.201
O23 - Service: Google Updater Service (gusvc) - Google - F:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - F:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
Post #8
Good Morning,

The issue with FindAWF is resolved but you have other issues on this computer. :wacko: You have a malicious file in your winsock, thats the chain of files that make up your internet connection so we need to remove that file, removing it with HJT will break that connection and you will lose access so we need to run this tool.


Winsockxpfix
Your malware infection is playing around with your internet connection, I want you to download this program to your desktop and in the event of running LSPfix you lose your connection, run this tool to repair it. Do not run this tool unless you need it

  • Please download LSPFix
  • Disconnect from the internet.
  • Go to where you downloaded LSPFix and run the LSPFix.exe by double clicking on it.
  • Check the I know what I'm doing box.
  • In the Keep box you should see one or more instances of winsock2.dll
  • Select every instance of winsock2.dll and move each one to the Remove box by clicking the >> button.
  • When you are done click Finish.
LSP Tutorial <– If you need it.



Combofix did not remove those bad files, so do this.

1. Please download The Avenger by Swandog46 to your Desktop.
  • Click on Avenger.zip to open the file
  • Extract avenger.exe to your desktop
2. Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (Ctrl+C):

Files to Delete:
F:\WINDOWS\frexup2.exe
F:\WINDOWS\plite731_uninstaller_.bat
F:\WINDOWS\system32\addewpxn.dll
F:\WINDOWS\system32\fgjlm.bak2
F:\WINDOWS\system32\fgjlm.bak1

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

3. Now, start The Avenger program by clicking on its icon on your desktop.
  • Under "Script file to execute" choose "Input Script Manually".
  • Now click on the Magnifying Glass icon which will open a new window titled "View/edit script"
  • Paste the text copied to clipboard into this window by pressing (Ctrl+V).
  • Click Done
  • Now click on the Green Light to begin execution of the script
  • Answer "Yes" twice when prompted.
4. The Avenger will automatically do the following:
  • It will Restart your computer. ( In cases where the code to execute contains "Drivers to Unload", The Avenger will actually restart your system twice.)
  • On reboot, it will briefly open a black command window on your desktop, this is normal.
  • After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
  • The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.
5. Please copy/paste the content of c:\avenger.txt into your reply along with a fresh HJT log by using Add/Reply

Post the Avenger log and a New HJT log please
Post #9
Arrrg, my computer is worse than ever with spywrare. I don't know what happened but after I ran Avenger a bunch of spywarew warnings kept popping up. When the computer rebooted I got a message that mmtask.exe could not be located and I clicked ok, did I reinstall this mess by clicking ok? Anyway here are the logs. I'm back on my laptop due to all the re-directs. I will out of town next week so if you reply after 6am tomorrow I will not be able to work on my desktop, but I'll be back Friday night. Maybe I can talk my wife to get involved but I doubt it. Sorry for the inconvenience. Logfile of The Avenger version 1, by Swandog46 Running from registry key: \Registry\Machine\System\CurrentControlSet\Services\ihhugwys ******************* Script file located at: \??\F:\Program Files\ycswlcro.txt Script file opened successfully. Script file read successfully Backups directory opened successfully at F:\Avenger ******************* Beginning to process script file: File F:\WINDOWS\frexup2.exe deleted successfully. File F:\WINDOWS\plite731_uninstaller_.bat deleted successfully. File F:\WINDOWS\system32\addewpxn.dll deleted successfully. File F:\WINDOWS\system32\fgjlm.bak2 deleted successfully. File F:\WINDOWS\system32\fgjlm.bak1 deleted successfully. Completed script processing. ******************* Finished! Terminate. Logfile of HijackThis v1.99.1 Scan saved at 7:21:47 PM, on 11/4/2007 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: F:\WINDOWS\System32\smss.exe F:\WINDOWS\system32\winlogon.exe F:\WINDOWS\system32\services.exe F:\WINDOWS\system32\lsass.exe F:\WINDOWS\system32\svchost.exe F:\WINDOWS\System32\svchost.exe F:\WINDOWS\Explorer.EXE F:\WINDOWS\system32\spoolsv.exe F:\WINDOWS\System32\svchost.exe F:\WINDOWS\System32\NILaunch.exe F:\Program Files\Java\jre1.6.0_01\bin\jusched.exe F:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe F:\Program Files\QdrPack\QdrPack9.exe F:\QUICKENW\QWDLLS.EXE F:\WINDOWS\system32\notepad.exe F:\WINDOWS\System32\wuauclt.exe F:\Program Files\Java\jre1.6.0_01\bin\jucheck.exe F:\WINDOWS\System32\vvgeowbv.exe I:\Program Files\hijackthis\HijackThis.exe F2 - REG:system.ini: UserInit=F:\WINDOWS\System32\vvgeowbv.exe,F:\WINDOWS\system32\userinit.exe O2 - BHO: (no name) - {00000000-d9e3-4bc6-a0bd-3d0ca4be5271} - (no file) O2 - BHO: (no name) - {00000012-890e-4aac-afd9-eff6954a34dd} - (no file) O2 - BHO: (no name) - {029e02f0-a0e5-4b19-b958-7bf2db29fb13} - (no file) O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {06dfedaa-6196-11d5-bfc8-00508b4a487d} - (no file) O2 - BHO: (no name) - {12F02779-6D88-4958-8AD3-83C12D86ADC7} - (no file) O2 - BHO: (no name) - {1adbcce8-cf84-441e-9b38-afc7a19c06a4} - (no file) O2 - BHO: (no name) - {2d7cb618-cc1c-4126-a7e3-f5b12d3bcf71} - (no file) O2 - BHO: (no name) - {51641ef3-8a7a-4d84-8659-b0911e947cc8} - (no file) O2 - BHO: (no name) - {53C330D6-A4AB-419B-B45D-FD4411C1FEF4} - (no file) O2 - BHO: (no name) - {54645654-2225-4455-44A1-9F4543D34546} - (no file) O2 - BHO: (no name) - {669695bc-a811-4a9d-8cdf-ba8c795f261e} - (no file) O2 - BHO: (no name) - {6abc861a-31e7-4d91-b43b-d3c98f22a5c0} - (no file) O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - F:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - F:\Program Files\MSN Apps\ST1.03.0000.1005\en-xu\stmain.dll O2 - BHO: (no name) - {944864a5-3916-46e2-96a9-a2e84f3f1208} - (no file) O2 - BHO: (no name) - {a4a435cf-3583-11d4-91bd-0048546a1450} - (no file) O2 - BHO: aivskurq.msdn_hlp - {A6E432B4-D4C2-43B3-BF55-C364F8F7362A} - F:\WINDOWS\system32\aivskurq.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - f:\program files\google\googletoolbar3.dll O2 - BHO: (no name) - {b8875bfe-b021-11d4-bfa8-00508b8e9bd3} - (no file) O2 - BHO: (no name) - {bb936323-19fa-4521-ba29-eca6a121bc78} - (no file) O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - F:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar1.02.5000.1021\en-us\msntb.dll O2 - BHO: (no name) - {c2680e10-1655-4a0e-87f8-4259325a84b7} - (no file) O2 - BHO: (no name) - {c4ca6559-2cf1-48b6-96b2-8340a06fd129} - (no file) O2 - BHO: (no name) - {c5af2622-8c75-4dfb-9693-23ab7686a456} - (no file) O2 - BHO: (no name) - {ca1d1b05-9c66-11d5-a009-000103c1e50b} - (no file) O2 - BHO: (no name) - {d8efadf1-9009-11d6-8c73-608c5dc19089} - (no file) O2 - BHO: (no name) - {e9147a0a-a866-4214-b47c-da821891240f} - (no file) O2 - BHO: (no name) - {e9306072-417e-43e3-81d5-369490beef7c} - (no file) O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - F:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - F:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar1.02.5000.1021\en-us\msntb.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - f:\program files\google\googletoolbar3.dll O4 - HKLM\..\Run: [Net-It Launcher] F:\WINDOWS\System32\NILaunch.exe O4 - HKLM\..\Run: [mmtask] F:\Program Files\MUSICMATCH\Musicmatch Jukebox\mmtask.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "F:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "F:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKCU\..\Run: [msnmsgr] "F:\Program Files\MSN Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [swg] F:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [AdobeUpdater] F:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe O4 - HKCU\..\Run: [QdrPack9] "F:\Program Files\QdrPack\QdrPack9.exe" O4 - Global Startup: Quicken Startup.lnk = F:\QUICKENW\QWDLLS.EXE O4 - Global Startup: Microsoft Office.lnk = F:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: E&xport to Microsoft Excel - res://F:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\MSMSGS.EXE O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\MSMSGS.EXE O17 - HKLM\System\CCS\Services\Tcpip\..\{A480D802-76BA-4198-B221-77DEE53A4A27}: NameServer = 216.144.187.71,204.186.0.201 O23 - Service: Google Updater Service (gusvc) - Google - F:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - F:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
Post #10
Sometimes this garbage is hard to remove, you had some major infections on this computer. Do this please

Open HijackThis > Do a System Scan Only, close your browser and all open windows including this one, the only program or window you should have open is HijackThis, check the following entries and click on Fix Checked.

F2 - REG:system.ini: UserInit=F:\WINDOWS\System32\vvgeowbv.exe,F:\WINDOWS\system32\userinit.exe

O2 - BHO: (no name) - {00000000-d9e3-4bc6-a0bd-3d0ca4be5271} - (no file)
O2 - BHO: (no name) - {00000012-890e-4aac-afd9-eff6954a34dd} - (no file)
O2 - BHO: (no name) - {029e02f0-a0e5-4b19-b958-7bf2db29fb13} - (no file)
O2 - BHO: (no name) - {06dfedaa-6196-11d5-bfc8-00508b4a487d} - (no file)
O2 - BHO: (no name) - {12F02779-6D88-4958-8AD3-83C12D86ADC7} - (no file)
O2 - BHO: (no name) - {1adbcce8-cf84-441e-9b38-afc7a19c06a4} - (no file)
O2 - BHO: (no name) - {2d7cb618-cc1c-4126-a7e3-f5b12d3bcf71} - (no file)
O2 - BHO: (no name) - {51641ef3-8a7a-4d84-8659-b0911e947cc8} - (no file)
O2 - BHO: (no name) - {53C330D6-A4AB-419B-B45D-FD4411C1FEF4} - (no file)
O2 - BHO: (no name) - {54645654-2225-4455-44A1-9F4543D34546} - (no file)
O2 - BHO: (no name) - {669695bc-a811-4a9d-8cdf-ba8c795f261e} - (no file)
O2 - BHO: (no name) - {6abc861a-31e7-4d91-b43b-d3c98f22a5c0} - (no file)
O2 - BHO: (no name) - {944864a5-3916-46e2-96a9-a2e84f3f1208} - (no file)
O2 - BHO: (no name) - {a4a435cf-3583-11d4-91bd-0048546a1450} - (no file)
O2 - BHO: aivskurq.msdn_hlp - {A6E432B4-D4C2-43B3-BF55-C364F8F7362A} - F:\WINDOWS\system32\aivskurq.dll
O2 - BHO: (no name) - {c2680e10-1655-4a0e-87f8-4259325a84b7} - (no file)
O2 - BHO: (no name) - {c4ca6559-2cf1-48b6-96b2-8340a06fd129} - (no file)
O2 - BHO: (no name) - {c5af2622-8c75-4dfb-9693-23ab7686a456} - (no file)
O2 - BHO: (no name) - {ca1d1b05-9c66-11d5-a009-000103c1e50b} - (no file)
O2 - BHO: (no name) - {d8efadf1-9009-11d6-8c73-608c5dc19089} - (no file)
O2 - BHO: (no name) - {e9147a0a-a866-4214-b47c-da821891240f} - (no file)
O2 - BHO: (no name) - {e9306072-417e-43e3-81d5-369490beef7c} - (no file)

We need to make sure all hidden files are showing :
  • Click Start.
  • Open My Computer.
  • Select the Tools menu and click Folder Options.
  • Select the View tab.
  • Under the Hidden files and folders heading select Show hidden files and folders.
  • Uncheck the Hide file extensions for known types option.
  • Uncheck the Hide protected operating system files (recommended) option.
  • Click Yes to confirm.
  • Click OK.
Once your system is clean, we suggest that you reverse this to keep critical windows files from accidently being deleted.


Delete the files in Red
F:\WINDOWS\system32\aivskurq.dll
F:\WINDOWS\System32\vvgeowbv.exe



Please download and install AVG Anti-Spyware Free to your desktop.
  • Once you have downloaded AVG Anti-Spyware 7.5, locate the icon on the desktop and double-click it to launch the set up program.
  • Once the setup is complete you will need run AVG and update the definition files.
  • On the main screen select the icon Update then select the Update now link.
  • Next select the Start Update button, the update will start and a progress bar will show the updates being installed.
  • Once the update has completed select the Scanner icon at the top of the screen, then select the Settings tab.
  • Once in the Settings screen click on Recommended actions and then select Quarantine <– Dont forget this
  • Under Reports
  • Select Automatically generate report after every scan
  • Un-Select Only if threats were found <– Don't forget this
  • Close AVG Anti-Spyware Free <– Do not run the scan yet.
Boot your computer into Safemode
  • Go to Start> Shut Off your Computer> Restart
  • As the computer starts to boot-up, Tap the F8 KEY somewhat rapidly.
  • This will bring up a menu.
  • Use the Up and Down Arrow Keys to scroll up to SAFEMODE
  • Then press the Enter on your Keyboard
Tutorial if you need it How to boot into Safemode


IMPORTANT: Do not open any other windows or programs while ewido is scanning, it may interfere with the scanning process:
  • Launch AVG Anti-Spyware Free by double-clicking the icon on your desktop.
  • Select the Scanner icon at the top and then the Scan tab then click on Complete System Scan.
  • AVG will now begin the scanning process, be patient this may take a little time.
  • Once the scan is complete do the following:
  • If you have any infections you will prompted, then select Apply all actions
  • Next select the Reports icon at the top.
  • Select the Save report as button in the lower left hand of the screen and save it to a text file on your system <–Don't forget this
  • make sure to remember where you saved that file, this is important, I need to see that log.
  • Close AVG Anti-Spyware Free

I:\Program Files\hijackthis\HijackThis.exe <—Go here and right click on the HJT Icon, (looks like a red stick of dynamite with a plunger) and rename it to Scanner.exe.



Let me see the AVG log and a New HJT log renamed please
Post #11
Sorry Ken, I had AVG Antispy set-up exactly how you described but it would not generate a report. I scanned twice and for some reason it would not generate a report. The antispy found about 34 threats the first time and 8 on the second scan. I have attached a screenshot from the quarentine tab, if that helps. Here is the HJT log. I'm heading out in a couple of hours so I'll pick this back up on Friday. Thanks for all the help so far. Logfile of HijackThis v1.99.1 Scan saved at 5:03:17 AM, on 11/5/2007 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: F:\WINDOWS\System32\smss.exe F:\WINDOWS\system32\winlogon.exe F:\WINDOWS\system32\services.exe F:\WINDOWS\system32\lsass.exe F:\WINDOWS\system32\svchost.exe F:\WINDOWS\System32\svchost.exe F:\WINDOWS\system32\spoolsv.exe F:\WINDOWS\Explorer.EXE F:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe F:\WINDOWS\System32\svchost.exe F:\WINDOWS\System32\NILaunch.exe F:\Program Files\Java\jre1.6.0_01\bin\jusched.exe F:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe F:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe F:\Program Files\QdrPack\QdrPack9.exe F:\QUICKENW\QWDLLS.EXE F:\WINDOWS\System32\wuauclt.exe F:\Program Files\Java\jre1.6.0_01\bin\jucheck.exe I:\Program Files\hijackthis\Scanner.exe O2 - BHO: (no name) - {00000000-d9e3-4bc6-a0bd-3d0ca4be5271} - (no file) O2 - BHO: (no name) - {00000012-890e-4aac-afd9-eff6954a34dd} - (no file) O2 - BHO: (no name) - {029e02f0-a0e5-4b19-b958-7bf2db29fb13} - (no file) O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {06dfedaa-6196-11d5-bfc8-00508b4a487d} - (no file) O2 - BHO: (no name) - {12F02779-6D88-4958-8AD3-83C12D86ADC7} - (no file) O2 - BHO: (no name) - {2d7cb618-cc1c-4126-a7e3-f5b12d3bcf71} - (no file) O2 - BHO: (no name) - {51641ef3-8a7a-4d84-8659-b0911e947cc8} - (no file) O2 - BHO: (no name) - {53C330D6-A4AB-419B-B45D-FD4411C1FEF4} - (no file) O2 - BHO: (no name) - {54645654-2225-4455-44A1-9F4543D34546} - (no file) O2 - BHO: (no name) - {669695bc-a811-4a9d-8cdf-ba8c795f261e} - (no file) O2 - BHO: (no name) - {6abc861a-31e7-4d91-b43b-d3c98f22a5c0} - (no file) O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - F:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - F:\Program Files\MSN Apps\ST1.03.0000.1005\en-xu\stmain.dll O2 - BHO: (no name) - {a4a435cf-3583-11d4-91bd-0048546a1450} - (no file) O2 - BHO: aivskurq.msdn_hlp - {A6E432B4-D4C2-43B3-BF55-C364F8F7362A} - F:\WINDOWS\system32\aivskurq.dll (file missing) O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - f:\program files\google\googletoolbar3.dll O2 - BHO: (no name) - {b8875bfe-b021-11d4-bfa8-00508b8e9bd3} - (no file) O2 - BHO: (no name) - {bb936323-19fa-4521-ba29-eca6a121bc78} - (no file) O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - F:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar1.02.5000.1021\en-us\msntb.dll O2 - BHO: (no name) - {c2680e10-1655-4a0e-87f8-4259325a84b7} - (no file) O2 - BHO: (no name) - {c4ca6559-2cf1-48b6-96b2-8340a06fd129} - (no file) O2 - BHO: (no name) - {ca1d1b05-9c66-11d5-a009-000103c1e50b} - (no file) O2 - BHO: (no name) - {d8efadf1-9009-11d6-8c73-608c5dc19089} - (no file) O2 - BHO: (no name) - {e9147a0a-a866-4214-b47c-da821891240f} - (no file) O2 - BHO: (no name) - {e9306072-417e-43e3-81d5-369490beef7c} - (no file) O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - F:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - F:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar1.02.5000.1021\en-us\msntb.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - f:\program files\google\googletoolbar3.dll O4 - HKLM\..\Run: [Net-It Launcher] F:\WINDOWS\System32\NILaunch.exe O4 - HKLM\..\Run: [mmtask] F:\Program Files\MUSICMATCH\Musicmatch Jukebox\mmtask.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "F:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "F:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [!AVG Anti-Spyware] "F:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKCU\..\Run: [msnmsgr] "F:\Program Files\MSN Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [swg] F:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [AdobeUpdater] F:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe O4 - HKCU\..\Run: [QdrPack9] "F:\Program Files\QdrPack\QdrPack9.exe" O4 - Global Startup: Quicken Startup.lnk = F:\QUICKENW\QWDLLS.EXE O4 - Global Startup: Microsoft Office.lnk = F:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: E&xport to Microsoft Excel - res://F:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\MSMSGS.EXE O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\MSMSGS.EXE O17 - HKLM\System\CCS\Services\Tcpip\..\{A480D802-76BA-4198-B221-77DEE53A4A27}: NameServer = 216.144.187.71,204.186.0.201 O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - F:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: Google Updater Service (gusvc) - Google - F:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - F:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

Attachments:

Post #12
Do this please, no hurry, I will keep this thread open for you .

F:\Program Files\QdrPack <–Is this a program you use and know to be safe??


Open Up AVG Anti Spyware and on the main page make sure the Resident Shield is disabled as it may prevent the removal of these entries


Boot to Safemode and remove these with HJT.

O2 - BHO: (no name) - {00000000-d9e3-4bc6-a0bd-3d0ca4be5271} - (no file)
O2 - BHO: (no name) - {00000012-890e-4aac-afd9-eff6954a34dd} - (no file)
O2 - BHO: (no name) - {029e02f0-a0e5-4b19-b958-7bf2db29fb13} - (no file)
O2 - BHO: (no name) - {06dfedaa-6196-11d5-bfc8-00508b4a487d} - (no file)
O2 - BHO: (no name) - {12F02779-6D88-4958-8AD3-83C12D86ADC7} - (no file)
O2 - BHO: (no name) - {2d7cb618-cc1c-4126-a7e3-f5b12d3bcf71} - (no file)
O2 - BHO: (no name) - {51641ef3-8a7a-4d84-8659-b0911e947cc8} - (no file)
O2 - BHO: (no name) - {53C330D6-A4AB-419B-B45D-FD4411C1FEF4} - (no file)
O2 - BHO: (no name) - {54645654-2225-4455-44A1-9F4543D34546} - (no file)
O2 - BHO: (no name) - {669695bc-a811-4a9d-8cdf-ba8c795f261e} - (no file)
O2 - BHO: (no name) - {6abc861a-31e7-4d91-b43b-d3c98f22a5c0} - (no file)
O2 - BHO: (no name) - {a4a435cf-3583-11d4-91bd-0048546a1450} - (no file)
O2 - BHO: aivskurq.msdn_hlp - {A6E432B4-D4C2-43B3-BF55-C364F8F7362A} - F:\WINDOWS\system32\aivskurq.dll (file missing)
O2 - BHO: (no name) - {b8875bfe-b021-11d4-bfa8-00508b8e9bd3} - (no file)
O2 - BHO: (no name) - {bb936323-19fa-4521-ba29-eca6a121bc78} - (no file)
O2 - BHO: (no name) - {c2680e10-1655-4a0e-87f8-4259325a84b7} - (no file)
O2 - BHO: (no name) - {c4ca6559-2cf1-48b6-96b2-8340a06fd129} - (no file)
O2 - BHO: (no name) - {ca1d1b05-9c66-11d5-a009-000103c1e50b} - (no file)
O2 - BHO: (no name) - {d8efadf1-9009-11d6-8c73-608c5dc19089} - (no file)
O2 - BHO: (no name) - {e9147a0a-a866-4214-b47c-da821891240f} - (no file)
O2 - BHO: (no name) - {e9306072-417e-43e3-81d5-369490beef7c} - (no file)



Delete Combofix and download a new copy and run it again as its updated on a regular basis.
Download ComboFix from Here or Here to your Desktop.
  • Double click combofix.exe and follow the prompts.
  • When finished, it shall produce a log for you. Post the Combofix log and a HiJackthis log in your next reply
Note: Do not mouseclick combofix's window while its running. That may cause it to stall



Run Panda's ActiveScan from here and perform a full system scan.
  • Once you are on the Panda site click the "Scan your PC" button
  • A new window will open…click the big "Check Now" button
  • Enter your Country
  • Enter your State/Province
  • Enter your e-mail address and click send
  • Select either Home User or Company
  • Click the big Scan Now button
  • If it wants to install an ActiveX component allow it
  • It will start downloading the files it requires for the scan (Note: It will take a couple minutes)
  • If you are on a slow connection it will take about 15 minuites for the scanner to load.
  • Click on "Local Disks" to start the scan
  • Once scan is done, click "see report" then "save report"
  • Save the log someplace you can find
  • Reboot
  • Post the Panda scan results in your next reply
Let me see the Combofix log, the Panda report and a New HJT log please
Post #13
Ok I'm back here are the requested logs

Logfile of HijackThis v1.99.1
Scan saved at 12:45:36 PM, on 11/9/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
F:\WINDOWS\System32\smss.exe
F:\WINDOWS\system32\winlogon.exe
F:\WINDOWS\system32\services.exe
F:\WINDOWS\system32\lsass.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\System32\svchost.exe
F:\WINDOWS\system32\spoolsv.exe
F:\WINDOWS\Explorer.EXE
F:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
F:\WINDOWS\System32\svchost.exe
F:\WINDOWS\System32\NILaunch.exe
F:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
F:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
F:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
F:\QUICKENW\QWDLLS.EXE
F:\WINDOWS\System32\wuauclt.exe
F:\Program Files\Java\jre1.6.0_01\bin\jucheck.exe
F:\Program Files\internet explorer\iexplore.exe
I:\Program Files\hijackthis\Scanner.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - F:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - F:\Program Files\MSN Apps\ST1.03.0000.1005\en-xu\stmain.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - f:\program files\google\googletoolbar3.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - F:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar1.02.5000.1021\en-us\msntb.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - F:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - F:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar1.02.5000.1021\en-us\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - f:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [Net-It Launcher] F:\WINDOWS\System32\NILaunch.exe
O4 - HKLM\..\Run: [mmtask] F:\Program Files\MUSICMATCH\Musicmatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "F:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "F:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "F:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [msnmsgr] "F:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [swg] F:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [AdobeUpdater] F:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe
O4 - Global Startup: Quicken Startup.lnk = F:\QUICKENW\QWDLLS.EXE
O4 - Global Startup: Microsoft Office.lnk = F:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://F:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{A480D802-76BA-4198-B221-77DEE53A4A27}: NameServer = 216.144.187.71,204.186.0.201
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - F:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Google Updater Service (gusvc) - Google - F:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - F:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

ComboFix 07-11-08.1 - Kelly 2007-11-09 10:37:46.4 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.1.1252.1.1033.18.38 [GMT -5:00]
Running from: F:\Documents and Settings\[removed]\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
—- Previous Run ——-
.
F:\Program Files\3721
F:\Program Files\3721\assist\asbar.dll
F:\Program Files\3721\helper.dll
F:\Program Files\Accoona
F:\Program Files\Accoona\ASearchAssist.dll
F:\Program Files\akl
F:\Program Files\akl\akl.dll
F:\Program Files\akl\akl.exe
F:\Program Files\akl\curlog.htm
F:\Program Files\akl\keylog.txt
F:\Program Files\akl\readme.txt
F:\Program Files\akl\uninstall.exe
F:\Program Files\akl\unsetup.dat
F:\Program Files\akl\unsetup.exe
F:\Program Files\amsys
F:\Program Files\amsys\awmsg.dat
F:\Program Files\amsys\guid.dat
F:\Program Files\amsys\ijl15.dll
F:\Program Files\amsys\mfc42.dll
F:\Program Files\amsys\msvcrt.dll
F:\Program Files\amsys\unins000.dat
F:\Program Files\amsys\unis000.exe
F:\Program Files\amsys\winam.dat
F:\Program Files\e-zshopper
F:\Program Files\e-zshopper\BarLcher.dll
F:\Program Files\QdrPack
F:\Program Files\QdrPack\dicts.gz
F:\Program Files\QdrPack\QdrPack9.exe
F:\Program Files\QdrPack\trgts.gz
F:\WINDOWS\764.exe
F:\WINDOWS\7search.dll
F:\WINDOWS\aconti.exe
F:\WINDOWS\adbar.dll
F:\WINDOWS\cbinst$.exe
F:\WINDOWS\daxtime.dll
F:\WINDOWS\dp0.dll
F:\WINDOWS\eventlowg.dll
F:\WINDOWS\fhfmm-Uninstaller.exe
F:\WINDOWS\fhfmm.exe
F:\WINDOWS\flt.dll
F:\WINDOWS\hcwprn.exe
F:\WINDOWS\hotporn.exe
F:\WINDOWS\ie_32.exe
F:\WINDOWS\iexplorr23.dll
F:\WINDOWS\jd2002.dll
F:\WINDOWS\kkcomp$.exe
F:\WINDOWS\kkcomp.dll
F:\WINDOWS\kkcomp.exe
F:\WINDOWS\kvnab$.exe
F:\WINDOWS\kvnab.dll
F:\WINDOWS\kvnab.exe
F:\WINDOWS\liqad$.exe
F:\WINDOWS\liqad.dll
F:\WINDOWS\liqad.exe
F:\WINDOWS\liqui-Uninstaller.exe
F:\WINDOWS\liqui.dll
F:\WINDOWS\liqui.exe
F:\WINDOWS\ngd.dll
F:\WINDOWS\pbar.dll
F:\WINDOWS\pbsysie.dll
F:\WINDOWS\settn.dll
F:\WINDOWS\spredirect.dll
F:\WINDOWS\system32\drivers\blank.gif
F:\WINDOWS\system32\drivers\box_1.gif
F:\WINDOWS\system32\drivers\box_2.gif
F:\WINDOWS\system32\drivers\box_3.gif
F:\WINDOWS\system32\drivers\button_buynow.gif
F:\WINDOWS\system32\drivers\button_freescan.gif
F:\WINDOWS\system32\drivers\cell_bg.gif
F:\WINDOWS\system32\drivers\cell_footer.gif
F:\WINDOWS\system32\drivers\cell_header_block.gif
F:\WINDOWS\system32\drivers\cell_header_remove.gif
F:\WINDOWS\system32\drivers\cell_header_scan.gif
F:\WINDOWS\system32\drivers\detect.htm
F:\WINDOWS\system32\drivers\download_box.gif
F:\WINDOWS\system32\drivers\download_btn.jpg
F:\WINDOWS\system32\drivers\download_now_btn.gif
F:\WINDOWS\system32\drivers\footer_back.jpg
F:\WINDOWS\system32\drivers\header_1.gif
F:\WINDOWS\system32\drivers\header_2.gif
F:\WINDOWS\system32\drivers\header_3.gif
F:\WINDOWS\system32\drivers\header_4.gif
F:\WINDOWS\system32\drivers\header_red_bg.gif
F:\WINDOWS\system32\drivers\header_red_free_scan.gif
F:\WINDOWS\system32\drivers\header_red_free_scan_bg.gif
F:\WINDOWS\system32\drivers\header_red_protect_your_pc.gif
F:\WINDOWS\system32\drivers\infected.gif
F:\WINDOWS\system32\drivers\main_back.gif
F:\WINDOWS\system32\drivers\perfect_cleaner_box.jpg
F:\WINDOWS\system32\drivers\product_1_header.gif
F:\WINDOWS\system32\drivers\product_1_name_small.gif
F:\WINDOWS\system32\drivers\product_2_header.gif
F:\WINDOWS\system32\drivers\product_2_name_small.gif
F:\WINDOWS\system32\drivers\product_3_header.gif
F:\WINDOWS\system32\drivers\product_3_name_small.gif
F:\WINDOWS\system32\drivers\product_features.gif
F:\WINDOWS\system32\drivers\pt.htm
F:\WINDOWS\system32\drivers\rating.gif
F:\WINDOWS\system32\drivers\s_detect.htm
F:\WINDOWS\system32\drivers\screenshot.jpg
F:\WINDOWS\system32\drivers\sep_hor.gif
F:\WINDOWS\system32\drivers\sep_vert.gif
F:\WINDOWS\system32\drivers\shadow.jpg
F:\WINDOWS\system32\drivers\shadow_bg.gif
F:\WINDOWS\system32\drivers\spacer.gif
F:\WINDOWS\system32\drivers\spy_away_box.jpg
F:\WINDOWS\system32\drivers\star.gif
F:\WINDOWS\system32\drivers\star_gray.gif
F:\WINDOWS\system32\drivers\star_gray_small.gif
F:\WINDOWS\system32\drivers\star_small.gif
F:\WINDOWS\system32\drivers\style.css
F:\WINDOWS\system32\drivers\v.gif
F:\WINDOWS\system32\drivers\warning_icon.gif
F:\WINDOWS\system32\drivers\win_logo.gif
F:\WINDOWS\system32\drivers\x.gif
F:\WINDOWS\system32\ESHOPEE.exe
F:\WINDOWS\system32\msole32.exe
F:\WINDOWS\system32\vxddsk.exe
F:\WINDOWS\system32\wml.exe
F:\WINDOWS\vxddsk.exe
F:\WINDOWS\wbeCheck.exe
F:\WINDOWS\wbeInst$.exe
F:\WINDOWS\wml.exe
F:\WINDOWS\xadbrk.dll
F:\WINDOWS\xadbrk.exe
F:\WINDOWS\xadbrk_.exe
F:\WINDOWS\xxxvideo.exe

.
((((((((((((((((((((((((( Files Created from 2007-10-09 to 2007-11-09 )))))))))))))))))))))))))))))))
.

2007-11-04 21:34 d——– F:\Documents and Settings\Kelly\Application Data\Grisoft
2007-11-04 21:27 10,872 –a—— F:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-11-04 21:17 d–hs—- F:\FOUND.000
2007-11-04 18:41 4 –a—— F:\WINDOWS\system32\stfv.bin
2007-11-04 18:28 d——– F:\WINDOWS\system32\acespy
2007-11-04 18:28 32,512 –a—— F:\WINDOWS\system32\ace16win.dll
2007-11-04 18:07 12 –a—— F:\WINDOWS\system32\dpqaqlqx.bin
2007-11-03 08:35 51,200 –a—— F:\WINDOWS\NirCmd.exe
2007-11-02 17:33 10,240 –a—— F:\WINDOWS\system32\winsock2.dll
2007-11-02 17:33 1 –a—— F:\WINDOWS\system32\rc.dat
2007-11-02 17:33 1 –a—— F:\WINDOWS\system32\ps1.dat
2007-11-02 17:33 1 –a—— F:\WINDOWS\system32\cs.dat
2007-11-02 17:33 1 –a—— F:\WINDOWS\system32\cookie1.dat
2007-11-02 17:24 52,736 –a—— F:\WINDOWS\system32\ramtask.dll
2007-11-01 19:48 dr-h—– F:\$VAULT$.AVG
2007-11-01 18:36 d——– F:\Documents and Settings\Kelly\Application Data\AVG7
2007-11-01 18:32 d——– F:\Documents and Settings\LocalService\Application Data\AVG7
2007-11-01 18:31 499,712 –a—— F:\WINDOWS\system32\msvcp71.dll
2007-11-01 18:31 348,160 –a—— F:\WINDOWS\system32\msvcr71.dll
2007-11-01 18:30 d——– F:\Documents and Settings\All Users\Application Data\avg7
2007-11-01 17:03 d——– F:\Documents and Settings\All Users\Application Data\Grisoft
2007-11-01 15:03 d——– F:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2007-11-01 15:02 d——– F:\Documents and Settings\Kelly\Application Data\SUPERAntiSpyware.com
2007-11-01 13:48 1,842 –a—— F:\WINDOWS\system32\tmp.reg
2007-10-29 21:51 d——– F:\WINDOWS\system32\Mz02r
2007-10-29 21:51 d–hs—- F:\WINDOWS\Sm9obnNvbg

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-09-28 16:08 156,992 —-a-w F:\WINDOWS\system32\DivXCodecVersionChecker.exe
2007-09-28 16:07 524,288 —-a-w F:\WINDOWS\system32\DivXsm.exe
2007-09-28 16:07 43,528 ——w F:\WINDOWS\system32\drivers\PxHelp20.sys
2007-09-28 16:07 3,596,288 —-a-w F:\WINDOWS\system32\qt-dx331.dll
2007-09-28 16:07 200,704 —-a-w F:\WINDOWS\system32\ssldivx.dll
2007-09-28 16:07 129,784 ——w F:\WINDOWS\system32\pxafs.dll
2007-09-28 16:07 120,056 ——w F:\WINDOWS\system32\pxcpyi64.exe
2007-09-28 16:07 118,520 ——w F:\WINDOWS\system32\pxinsi64.exe
2007-09-28 16:07 1,044,480 —-a-w F:\WINDOWS\system32\libdivx.dll
2007-09-28 16:05 823,296 —-a-w F:\WINDOWS\system32\divx_xx0c.dll
2007-09-28 16:05 823,296 —-a-w F:\WINDOWS\system32\divx_xx07.dll
2007-09-28 16:05 81,920 —-a-w F:\WINDOWS\system32\dpl100.dll
2007-09-28 16:05 802,816 —-a-w F:\WINDOWS\system32\divx_xx11.dll
2007-09-28 16:05 739,840 —-a-w F:\WINDOWS\system32\DivX.dll
2007-09-28 16:05 593,920 —-a-w F:\WINDOWS\system32\dpuGUI11.dll
2007-09-28 16:05 57,344 —-a-w F:\WINDOWS\system32\dpv11.dll
2007-09-28 16:05 53,248 —-a-w F:\WINDOWS\system32\dpuGUI10.dll
2007-09-28 16:05 344,064 —-a-w F:\WINDOWS\system32\dpus11.dll
2007-09-28 16:05 294,912 —-a-w F:\WINDOWS\system32\dpu11.dll
2007-09-28 16:05 294,912 —-a-w F:\WINDOWS\system32\dpu10.dll
2007-09-28 16:05 196,608 —-a-w F:\WINDOWS\system32\dtu100.dll
2007-09-28 16:05 12,288 —-a-w F:\WINDOWS\system32\DivXWMPExtType.dll
2004-01-28 17:45 68,688 —-a-w F:\Documents and Settings\Kelly\Application Data\GDIPFONTCACHEV1.DAT
.

((((((((((((((((((((((((((((( snapshot@2007-11-03_ 8.46.51.42 )))))))))))))))))))))))))))))))))))))))))
.
+ 2007-03-13 15:57:12 163,328 —-a-w F:\WINDOWS\erdnt\subs\F3M\ERDNT.EXE
+ 2007-11-04 23:29:04 21,760 —-a-w F:\WINDOWS\system32\acespy\systune.exe
+ 2002-08-29 11:40:56 443,392 —-a-w F:\WINDOWS\system32\fxsapi.dll
+ 2002-08-29 11:41:24 130,048 —-a-w F:\WINDOWS\system32\fxsclnt.exe
+ 2002-08-29 11:40:56 271,360 —-a-w F:\WINDOWS\system32\fxscomex.dll
+ 2002-08-29 11:41:24 216,064 —-a-w F:\WINDOWS\system32\fxscover.exe
+ 2002-08-29 11:40:56 24,064 —-a-w F:\WINDOWS\system32\fxsdrv.dll
+ 2002-08-29 11:40:56 20,992 —-a-w F:\WINDOWS\system32\fxsext32.dll
+ 2002-08-29 11:40:56 7,168 —-a-w F:\WINDOWS\system32\fxsperf.dll
+ 2002-08-29 11:39:56 6,656 —-a-w F:\WINDOWS\system32\fxsres.dll
+ 2002-08-29 11:40:56 559,616 —-a-w F:\WINDOWS\system32\fxsst.dll
+ 2002-08-29 11:41:24 250,368 —-a-w F:\WINDOWS\system32\fxssvc.exe
+ 2002-08-29 11:40:56 236,032 —-a-w F:\WINDOWS\system32\fxst30.dll
+ 2002-08-29 11:40:56 391,168 —-a-w F:\WINDOWS\system32\fxstiff.dll
+ 2002-08-29 11:40:56 149,504 —-a-w F:\WINDOWS\system32\fxsui.dll
+ 2002-08-29 11:40:56 185,856 —-a-w F:\WINDOWS\system32\fxswzrd.dll
+ 2002-08-29 11:40:56 395,264 —-a-w F:\WINDOWS\system32\fxsxp32.dll
- 2007-04-02 19:21:28 139,776 —-a-w F:\WINDOWS\system32\swreg.exe
+ 2007-07-22 23:39:28 279,552 —-a-w F:\WINDOWS\system32\swreg.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Net-It Launcher"="F:\WINDOWS\System32\NILaunch.exe" [1998-02-05 15:16]
"mmtask"="F:\Program Files\MUSICMATCH\Musicmatch Jukebox\mmtask.exe" [2004-10-08 08:49]
"SunJavaUpdateSched"="F:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43]
"Adobe Reader Speed Launcher"="F:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06]
"!AVG Anti-Spyware"="F:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 04:25]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="F:\Program Files\MSN Messenger\msnmsgr.exe" []
"swg"="F:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2007-01-24 19:15]
"AdobeUpdater"="F:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [2007-03-01 10:37]

F:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Quicken Startup.lnk - F:\QUICKENW\QWDLLS.EXE [2002-05-21 12:39:31]
Microsoft Office.lnk - F:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04]

[HKEY_CURRENT_USER\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="F:\\WINDOWS\\System32\\vvgeowbv.exe,F:\\WINDOWS\\system32\\userinit.exe"

R3 WUSB54GPV4SRV;Linksys Home Wireless-G USB Adaptor Driver;F:\WINDOWS\System32\DRIVERS\rt2500usb.sys
S3 USB-100;Linksys EtherFast 10/100 Compact USB Network Adapter;F:\WINDOWS\System32\DRIVERS\USB100M.SYS

.
**************************************************************************

catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-09 10:40:02
Windows 5.1.2600 Service Pack 1 FAT NTAPI

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-11-09 10:41:37
F:\ComboFix2.txt … 2007-11-04 08:08
F:\ComboFix3.txt … 2007-11-03 08:49
.
— E O F —

There were no files found in the Panda scan, so I did not see a report to save.
Post #14
Glad your back, thanks for the logs.

Open Notepad and copy all the text inside the quote box by highlighting it all and pressing CTRL C on your keyboard, then paste it into Notepad

File::
F:\WINDOWS\system32\ace16win.dll
F:\WINDOWS\system32\dpqaqlqx.bin
F:\WINDOWS\system32\winsock2.dll
F:\WINDOWS\system32\rc.dat
F:\WINDOWS\system32\ps1.dat
F:\WINDOWS\system32\cookie1.dat
F:\WINDOWS\system32\ramtask.dll
F:\WINDOWS\System32\vvgeowbv.exe

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="F:\\WINDOWS\\System32\\vvgeowbv.exe,F:\\WINDOWS\\system32\\userinit.exe"


Save this as CFScript to your desktop.

Then drag the CFScript into ComboFix.exe as you see in the screenshot below.

[external image: Posted Image]


This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThis log.
Post #15
Thanks, here are the logs

Logfile of HijackThis v1.99.1
Scan saved at 5:15:46 PM, on 11/9/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
F:\WINDOWS\System32\smss.exe
F:\WINDOWS\system32\winlogon.exe
F:\WINDOWS\system32\services.exe
F:\WINDOWS\system32\lsass.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\System32\svchost.exe
F:\WINDOWS\system32\spoolsv.exe
F:\WINDOWS\Explorer.EXE
F:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
F:\WINDOWS\System32\svchost.exe
F:\WINDOWS\System32\NILaunch.exe
F:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
F:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
F:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
F:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
F:\QUICKENW\QWDLLS.EXE
F:\WINDOWS\System32\wuauclt.exe
F:\WINDOWS\System32\wuauclt.exe
F:\WINDOWS\system32\notepad.exe
F:\Program Files\Java\jre1.6.0_01\bin\jucheck.exe
I:\Program Files\hijackthis\Scanner.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - F:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - F:\Program Files\MSN Apps\ST1.03.0000.1005\en-xu\stmain.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - f:\program files\google\googletoolbar3.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - F:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar1.02.5000.1021\en-us\msntb.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - F:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - F:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar1.02.5000.1021\en-us\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - f:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [Net-It Launcher] F:\WINDOWS\System32\NILaunch.exe
O4 - HKLM\..\Run: [mmtask] F:\Program Files\MUSICMATCH\Musicmatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "F:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "F:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "F:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [msnmsgr] "F:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [swg] F:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [AdobeUpdater] F:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe
O4 - Global Startup: Quicken Startup.lnk = F:\QUICKENW\QWDLLS.EXE
O4 - Global Startup: Microsoft Office.lnk = F:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://F:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{A480D802-76BA-4198-B221-77DEE53A4A27}: NameServer = 216.144.187.71,204.186.0.201
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - F:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Google Updater Service (gusvc) - Google - F:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - F:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

ComboFix 07-11-08.1 - Kelly 2007-11-09 17:04:57.5 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.1.1252.1.1033.18.37 [GMT -5:00]
Running from: F:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: F:\Documents and Settings\Kelly\Desktop\CFscript.txt
* Created a new restore point

FILE
F:\WINDOWS\system32\ace16win.dll
F:\WINDOWS\system32\cookie1.dat
F:\WINDOWS\system32\dpqaqlqx.bin
F:\WINDOWS\system32\ps1.dat
F:\WINDOWS\system32\ramtask.dll
F:\WINDOWS\system32\rc.dat
F:\WINDOWS\System32\vvgeowbv.exe
F:\WINDOWS\system32\winsock2.dll
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

F:\WINDOWS\system32\ace16win.dll
F:\WINDOWS\system32\cookie1.dat
F:\WINDOWS\system32\dpqaqlqx.bin
F:\WINDOWS\system32\ps1.dat
F:\WINDOWS\system32\ramtask.dll
F:\WINDOWS\system32\rc.dat
F:\WINDOWS\system32\winsock2.dll

.
((((((((((((((((((((((((( Files Created from 2007-10-09 to 2007-11-09 )))))))))))))))))))))))))))))))
.

2007-11-09 11:00 d——– F:\WINDOWS\system32\ActiveScan
2007-11-04 21:34 d——– F:\Documents and Settings\Kelly\Application Data\Grisoft
2007-11-04 21:27 10,872 –a—— F:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-11-04 21:17 d–hs—- F:\FOUND.000
2007-11-04 18:41 4 –a—— F:\WINDOWS\system32\stfv.bin
2007-11-04 18:28 d——– F:\WINDOWS\system32\acespy
2007-11-03 08:35 51,200 –a—— F:\WINDOWS\NirCmd.exe
2007-11-02 17:33 1 –a—— F:\WINDOWS\system32\cs.dat
2007-11-01 19:48 dr-h—– F:\$VAULT$.AVG
2007-11-01 18:36 d——– F:\Documents and Settings\Kelly\Application Data\AVG7
2007-11-01 18:32 d——– F:\Documents and Settings\LocalService\Application Data\AVG7
2007-11-01 18:31 499,712 –a—— F:\WINDOWS\system32\msvcp71.dll
2007-11-01 18:31 348,160 –a—— F:\WINDOWS\system32\msvcr71.dll
2007-11-01 18:30 d——– F:\Documents and Settings\All Users\Application Data\avg7
2007-11-01 17:03 d——– F:\Documents and Settings\All Users\Application Data\Grisoft
2007-11-01 15:03 d——– F:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2007-11-01 15:02 d——– F:\Documents and Settings\Kelly\Application Data\SUPERAntiSpyware.com
2007-11-01 13:48 1,842 –a—— F:\WINDOWS\system32\tmp.reg
2007-10-29 21:51 d——– F:\WINDOWS\system32\Mz02r
2007-10-29 21:51 d–hs—- F:\WINDOWS\Sm9obnNvbg

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-09-28 16:08 156,992 —-a-w F:\WINDOWS\system32\DivXCodecVersionChecker.exe
2007-09-28 16:07 524,288 —-a-w F:\WINDOWS\system32\DivXsm.exe
2007-09-28 16:07 43,528 ——w F:\WINDOWS\system32\drivers\PxHelp20.sys
2007-09-28 16:07 3,596,288 —-a-w F:\WINDOWS\system32\qt-dx331.dll
2007-09-28 16:07 200,704 —-a-w F:\WINDOWS\system32\ssldivx.dll
2007-09-28 16:07 129,784 ——w F:\WINDOWS\system32\pxafs.dll
2007-09-28 16:07 120,056 ——w F:\WINDOWS\system32\pxcpyi64.exe
2007-09-28 16:07 118,520 ——w F:\WINDOWS\system32\pxinsi64.exe
2007-09-28 16:07 1,044,480 —-a-w F:\WINDOWS\system32\libdivx.dll
2007-09-28 16:05 823,296 —-a-w F:\WINDOWS\system32\divx_xx0c.dll
2007-09-28 16:05 823,296 —-a-w F:\WINDOWS\system32\divx_xx07.dll
2007-09-28 16:05 81,920 —-a-w F:\WINDOWS\system32\dpl100.dll
2007-09-28 16:05 802,816 —-a-w F:\WINDOWS\system32\divx_xx11.dll
2007-09-28 16:05 739,840 —-a-w F:\WINDOWS\system32\DivX.dll
2007-09-28 16:05 593,920 —-a-w F:\WINDOWS\system32\dpuGUI11.dll
2007-09-28 16:05 57,344 —-a-w F:\WINDOWS\system32\dpv11.dll
2007-09-28 16:05 53,248 —-a-w F:\WINDOWS\system32\dpuGUI10.dll
2007-09-28 16:05 344,064 —-a-w F:\WINDOWS\system32\dpus11.dll
2007-09-28 16:05 294,912 —-a-w F:\WINDOWS\system32\dpu11.dll
2007-09-28 16:05 294,912 —-a-w F:\WINDOWS\system32\dpu10.dll
2007-09-28 16:05 196,608 —-a-w F:\WINDOWS\system32\dtu100.dll
2007-09-28 16:05 12,288 —-a-w F:\WINDOWS\system32\DivXWMPExtType.dll
2004-01-28 17:45 68,688 —-a-w F:\Documents and Settings\Kelly\Application Data\GDIPFONTCACHEV1.DAT
.

((((((((((((((((((((((((((((( snapshot@2007-11-03_ 8.46.51.42 )))))))))))))))))))))))))))))))))))))))))
.
+ 2006-08-24 13:28:54 141,424 —-a-w F:\WINDOWS\Downloaded Program Files\asinst.dll
+ 2007-03-13 15:57:12 163,328 —-a-w F:\WINDOWS\erdnt\subs\F3M\ERDNT.EXE
+ 2007-11-04 23:29:04 21,760 —-a-w F:\WINDOWS\system32\acespy\systune.exe
+ 2007-03-29 14:20:50 110,592 —-a-w F:\WINDOWS\system32\ActiveScan\as.dll
+ 2006-10-05 21:15:26 233,472 —-a-w F:\WINDOWS\system32\ActiveScan\ascontrol.dll
+ 2005-06-03 19:03:18 96,256 —-a-w F:\WINDOWS\system32\ActiveScan\asmdat.dll
+ 2003-08-01 16:00:16 36,864 —-a-w F:\WINDOWS\system32\ActiveScan\certdll.dll
+ 2005-05-20 18:42:44 86,016 —-a-w F:\WINDOWS\system32\ActiveScan\instlsp.dll
+ 2006-02-16 23:20:20 4,608 —-a-w F:\WINDOWS\system32\ActiveScan\memvfile.dll
+ 2005-10-25 23:08:32 348,160 —-a-w F:\WINDOWS\system32\ActiveScan\msvcr71.dll
+ 2004-05-04 20:01:02 139,264 —-a-w F:\WINDOWS\system32\ActiveScan\pavaleas.dll
+ 2006-07-14 18:04:10 45,056 —-a-w F:\WINDOWS\system32\ActiveScan\pavdr.exe
+ 2006-04-10 15:50:02 159,832 —-a-w F:\WINDOWS\system32\ActiveScan\pavexcom.dll
+ 2006-02-14 18:05:38 94,208 —-a-w F:\WINDOWS\system32\ActiveScan\pavinas.dll
+ 2006-02-16 23:35:38 180,224 —-a-w F:\WINDOWS\system32\ActiveScan\pavoe.dll
+ 2006-10-05 21:15:38 122,880 —-a-w F:\WINDOWS\system32\ActiveScan\pavpz.dll
+ 2006-06-30 19:13:38 8,704 —-a-w F:\WINDOWS\system32\ActiveScan\pfdnnt.exe
+ 2004-02-04 19:08:42 49,152 —-a-w F:\WINDOWS\system32\ActiveScan\port32.dll
+ 2006-08-01 18:23:10 69,632 —-a-w F:\WINDOWS\system32\ActiveScan\pscpu.dll
+ 2006-08-23 18:06:08 1,388,544 —-a-w F:\WINDOWS\system32\ActiveScan\pskahk.dll
+ 2006-08-17 16:38:14 10,752 —-a-w F:\WINDOWS\system32\ActiveScan\pskalloc.dll
+ 2006-09-04 16:49:54 61,440 —-a-w F:\WINDOWS\system32\ActiveScan\pskas.dll
+ 2006-08-18 13:46:18 779,264 —-a-w F:\WINDOWS\system32\ActiveScan\pskavs.dll
+ 2007-03-26 19:25:34 417,792 —-a-w F:\WINDOWS\system32\ActiveScan\pskcmp.dll
+ 2006-08-09 15:42:24 90,112 —-a-w F:\WINDOWS\system32\ActiveScan\pskfss.dll
+ 2006-07-19 15:55:58 208,896 —-a-w F:\WINDOWS\system32\ActiveScan\pskhtml.dll
+ 2006-01-20 21:57:00 9,728 —-a-w F:\WINDOWS\system32\ActiveScan\pskmas.dll
+ 2006-05-17 14:50:12 14,336 —-a-w F:\WINDOWS\system32\ActiveScan\pskmdfs.dll
+ 2006-08-16 15:58:12 33,280 —-a-w F:\WINDOWS\system32\ActiveScan\pskpack.dll
+ 2006-06-30 19:42:36 266,240 —-a-w F:\WINDOWS\system32\ActiveScan\pskscs.dll
+ 2006-08-17 19:33:14 62,976 —-a-w F:\WINDOWS\system32\ActiveScan\pskutil.dll
+ 2006-08-08 18:13:10 13,312 —-a-w F:\WINDOWS\system32\ActiveScan\pskvfile.dll
+ 2006-08-18 13:53:08 69,632 —-a-w F:\WINDOWS\system32\ActiveScan\pskvfs.dll
+ 2006-08-18 13:49:50 167,936 —-a-w F:\WINDOWS\system32\ActiveScan\pskvm.dll
+ 2007-04-18 22:16:04 353,840 —-a-w F:\WINDOWS\system32\ActiveScan\psscan.dll
+ 2007-01-22 19:42:48 35,328 —-a-w F:\WINDOWS\system32\ActiveScan\rawvfile.dll
+ 1997-09-18 11:12:32 9,488 —-a-w F:\WINDOWS\system32\ActiveScan\sporder.dll
+ 2006-02-28 22:23:40 69,632 —-a-w F:\WINDOWS\system32\ActiveScan\tcpvfile.dll
+ 2006-08-02 17:39:06 73,728 —-a-w F:\WINDOWS\system32\asuninst.exe
+ 2002-08-29 11:40:56 443,392 —-a-w F:\WINDOWS\system32\fxsapi.dll
+ 2002-08-29 11:41:24 130,048 —-a-w F:\WINDOWS\system32\fxsclnt.exe
+ 2002-08-29 11:40:56 271,360 —-a-w F:\WINDOWS\system32\fxscomex.dll
+ 2002-08-29 11:41:24 216,064 —-a-w F:\WINDOWS\system32\fxscover.exe
+ 2002-08-29 11:40:56 24,064 —-a-w F:\WINDOWS\system32\fxsdrv.dll
+ 2002-08-29 11:40:56 20,992 —-a-w F:\WINDOWS\system32\fxsext32.dll
+ 2002-08-29 11:40:56 7,168 —-a-w F:\WINDOWS\system32\fxsperf.dll
+ 2002-08-29 11:39:56 6,656 —-a-w F:\WINDOWS\system32\fxsres.dll
+ 2002-08-29 11:40:56 559,616 —-a-w F:\WINDOWS\system32\fxsst.dll
+ 2002-08-29 11:41:24 250,368 —-a-w F:\WINDOWS\system32\fxssvc.exe
+ 2002-08-29 11:40:56 236,032 —-a-w F:\WINDOWS\system32\fxst30.dll
+ 2002-08-29 11:40:56 391,168 —-a-w F:\WINDOWS\system32\fxstiff.dll
+ 2002-08-29 11:40:56 149,504 —-a-w F:\WINDOWS\system32\fxsui.dll
+ 2002-08-29 11:40:56 185,856 —-a-w F:\WINDOWS\system32\fxswzrd.dll
+ 2002-08-29 11:40:56 395,264 —-a-w F:\WINDOWS\system32\fxsxp32.dll
- 2007-04-02 19:21:28 139,776 —-a-w F:\WINDOWS\system32\swreg.exe
+ 2007-07-22 23:39:28 279,552 —-a-w F:\WINDOWS\system32\swreg.exe
+ 2003-03-25 23:53:50 11,776 —-a-w F:\WINDOWS\system32\ZPORT4AS.dll
.
– Snapshot reset to current date –
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Net-It Launcher"="F:\WINDOWS\System32\NILaunch.exe" [1998-02-05 15:16]
"mmtask"="F:\Program Files\MUSICMATCH\Musicmatch Jukebox\mmtask.exe" [2004-10-08 08:49]
"SunJavaUpdateSched"="F:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43]
"Adobe Reader Speed Launcher"="F:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06]
"!AVG Anti-Spyware"="F:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 04:25]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="F:\Program Files\MSN Messenger\msnmsgr.exe" []
"swg"="F:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2007-01-24 19:15]
"AdobeUpdater"="F:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [2007-03-01 10:37]

F:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Quicken Startup.lnk - F:\QUICKENW\QWDLLS.EXE [2002-05-21 12:39:31]
Microsoft Office.lnk - F:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=0 (0x0)

R3 WUSB54GPV4SRV;Linksys Home Wireless-G USB Adaptor Driver;F:\WINDOWS\System32\DRIVERS\rt2500usb.sys
S3 USB-100;Linksys EtherFast 10/100 Compact USB Network Adapter;F:\WINDOWS\System32\DRIVERS\USB100M.SYS

.
**************************************************************************

catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-09 17:10:13
Windows 5.1.2600 Service Pack 1 FAT NTAPI

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-11-09 17:12:58 - machine was rebooted
F:\ComboFix3.txt … 2007-11-04 08:08
F:\ComboFix2.txt … 2007-11-09 10:41
.
— E O F —

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI