What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Closed] After removing... I still have

2 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I just removed a particularly nasty spyware program accidentally downloaded on to my computer. I can't recall what it's called, but its a rogue program that not only installs malware, but changes your desktop and hijacks your webpages, not to mention countless popups and false virus scans. It seemed like doomsday for my computer. When I was at the end of my rope, I came across a thread, here on whatthetech, on how to remove the threat. I've already forgotten who made the thread, but thank you very much for you help!

Anyways, after removing the malware, I still have some program hijacking my webpages. I'm afraid that the program might pose a further threat to the security of my computer, so I'm wondering if any one can help me remove this from my computer. Thanks in advance :thumbup:

Here is my hijackthis log:

———————————————————————————————————————————————————-
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:15:43 PM, on 11/3/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Common Files\Logitech\LComMgr\Communications_Helper.exe
C:\Program Files\Common Files\Logitech\LComMgr\LVComSX.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Ares\Ares.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: (no name) - {3B28B033-8C1B-47DE-803D-3CF3AAE2CD20} - (no file)
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE
O4 - HKLM\..\Run: [LogitechGalleryRepair] C:\Program Files\Logitech\ImageStudio\ISStart.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1105115711\EE\AOLHostManager.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\Logitech\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LVCOMSX] "C:\Program Files\Common Files\Logitech\LComMgr\LVComSX.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SM_IAN] C:\Program Files\AdvancedCleaner Free\ian_monitor.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkID=39204
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} (HpProductDetection Class) - http://h20270.www2.hp.com/ediags/gmn2/inst…ctDetection.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{2BB797B5-3C5B-476B-B0EB-AFA8351917BF}: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CCS\Services\Tcpip\..\{373E2CB8-1AE5-44EA-9A4F-56152FE5E163}: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CS1\Services\Tcpip\..\{2BB797B5-3C5B-476B-B0EB-AFA8351917BF}: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
O21 - SSODL: bindmod - {48957161-4026-4016-8928-77CA262D07BD} - C:\WINDOWS\bindmod.dll (file missing)
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intuit Fuse Service - Intuit - C:\Program Files\Common Files\Intuit\Fuse\Service\Intuit Fuse Service.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\Logitech\SrvLnch\SrvLnch.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: spkrmon - Unknown owner - C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
———————————————————————————————————————————————————-
Post #2
Hello and welcome to the forums

I suggest you do this:

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Clear "Hide file extensions for known file types."
Under the "Hidden files" folder, select "Show hidden files and folders."
Clear "Hide protected operating system files."
Click Apply, and then click OK.


Please do not delete anything unless instructed to.

Next:


Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»

Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.


(If you use FireFox or the Opera browser
To keep saved passwords, click No at the prompt.)

It's normal after running ATF cleaner that the PC will be slower to boot the first time.

Next:

Download ComboFix from Here to your Desktop.
  • Double click combofix.exe and follow the prompts.
  • When finished, it shall produce a log for you, combofix.txt. Post that log and a HiJackthis log in your next reply
Note: Do not mouseclick while its running. That may cause it to stall
Post #3
Here's the Combofix log:

ComboFix 07-11-01.1 - money 2007-11-03 14:55:10.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.164 [GMT -4:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Cash\Desktop\Error Cleaner.url
C:\Documents and Settings\Cash\Desktop\internet.lnk
C:\Documents and Settings\Cash\Desktop\Privacy Protector.url
C:\Documents and Settings\Cash\Desktop\Spyware&Malware Protection.url
C:\Documents and Settings\Cash\Favorites\Error Cleaner.url
C:\Documents and Settings\Cash\Favorites\Privacy Protector.url
C:\Documents and Settings\Cash\Favorites\Spyware&Malware Protection.url
C:\Documents and Settings\Crystal\Desktop\internet.lnk
C:\Documents and Settings\money\Desktop\internet.lnk

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
——-\nm


((((((((((((((((((((((((( Files Created from 2007-10-03 to 2007-11-03 )))))))))))))))))))))))))))))))
.

2007-11-03 14:53 51,200 –a—— C:\WINDOWS\NirCmd.exe
2007-11-03 13:20 d——– C:\Program Files\Ares
2007-11-02 13:01 d——– C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2007-11-02 12:59 d——– C:\Program Files\SUPERAntiSpyware
2007-11-02 12:59 d——– C:\Program Files\Common Files\Wise Installation Wizard
2007-11-02 12:59 d——– C:\Documents and Settings\money\Application Data\SUPERAntiSpyware.com
2007-11-02 12:51 d——– C:\RVAXO
2007-11-02 12:42 373,743 –a—— C:\WINDOWS\system32\RVAXO.bat
2007-11-02 12:42 69,632 –a—— C:\WINDOWS\system32\remove.exe
2007-11-02 12:38 d——– C:\Program Files\Trend Micro
2007-11-02 02:35 32,256 –a—— C:\WINDOWS\system32\tmrsr.exe
2007-11-02 02:35 4 –a—— C:\WINDOWS\system32\prrbpgbr.sys
2007-11-02 02:35 2 –a—— C:\WINDOWS\system32\faxwin32.bin
2007-10-31 22:47 d——– C:\WINDOWS\system32\Color
2007-10-31 22:47 212,480 –a—— C:\WINDOWS\PCDLIB32.DLL
2007-10-31 22:47 210,944 –a—— C:\WINDOWS\system32\MSVCRT10.DLL
2007-10-31 22:47 197,120 –a—— C:\WINDOWS\kpcp32.dll
2007-10-31 22:47 133,120 –a—— C:\WINDOWS\sprof32.dll
2007-10-31 22:47 58,368 –a—— C:\WINDOWS\pfpick.dll
2007-10-31 22:47 40,129 –a—— C:\WINDOWS\iccsigs.dat
2007-10-31 22:47 37,376 –a—— C:\WINDOWS\KPSYS32.DLL
2007-10-31 22:47 20,992 –a—— C:\WINDOWS\icccodes.dll
2007-10-31 22:45 d——– C:\Documents and Settings\money\WINDOWS
2007-10-30 17:26 d——– C:\Program Files\Windows Installer Clean Up
2007-10-30 17:26 d——– C:\Program Files\MSECACHE
2007-10-29 18:24 d——– C:\Program Files\Microsoft ActiveSync
2007-10-29 18:24 d——– C:\Program Files\Common Files\L&H
2007-10-29 18:22 d——– C:\WINDOWS\SHELLNEW
2007-10-29 18:19 dr-h—– C:\MSOCache
2007-10-29 01:56 d——– C:\Documents and Settings\money\Application Data\Viewpoint
2007-10-29 01:31 d——– C:\Program Files\SpywareBlaster
2007-10-29 01:30 d——– C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-10-28 16:50 d——– C:\Documents and Settings\All Users\Application Data\Office Genuine Advantage
2007-10-27 11:17 d——– C:\Documents and Settings\Cash\Contacts
2007-10-27 11:14 d——– C:\Documents and Settings\Cash\Application Data\Yahoo!
2007-10-27 03:00 d——– C:\Program Files\MSXML 4.0
2007-10-26 21:59 d——– C:\Documents and Settings\Lisa\Application Data\Yahoo!
2007-10-26 21:29 d——– C:\Program Files\Norton Security Scan
2007-10-26 14:14 15,104 –a—— C:\WINDOWS\system32\drivers\usbscan.sys
2007-10-26 14:14 15,104 –a–c— C:\WINDOWS\system32\dllcache\usbscan.sys
2007-10-26 14:08 d——– C:\Program Files\Hewlett-Packard
2007-10-26 14:08 d——– C:\Program Files\Common Files\Hewlett-Packard
2007-10-26 14:08 278,584 –a—— C:\WINDOWS\system32\HPZidr12.dll
2007-10-26 14:08 204,800 –a—— C:\WINDOWS\system32\HPZipr12.dll
2007-10-26 14:08 94,208 –a—— C:\WINDOWS\system32\HPZipt12.dll
2007-10-26 14:08 69,632 –a—— C:\WINDOWS\system32\HPZipm12.exe
2007-10-26 14:08 61,440 –a—— C:\WINDOWS\system32\HPZinw12.exe
2007-10-26 14:08 57,344 –a—— C:\WINDOWS\system32\HPZisn12.dll
2007-10-26 14:07 106,279 –a—— C:\WINDOWS\hpoins07.dat
2007-10-26 14:07 17,505 ——— C:\WINDOWS\hpomdl07.dat
2007-10-26 13:59 51,120 –a—— C:\WINDOWS\system32\drivers\HPZid412.sys
2007-10-26 13:59 21,744 –a—— C:\WINDOWS\system32\drivers\HPZius12.sys
2007-10-26 13:59 16,496 –a—— C:\WINDOWS\system32\drivers\HPZipr12.sys
2007-10-26 13:58 606,208 –a—— C:\WINDOWS\system32\hpotscl.dll
2007-10-26 13:58 393,216 –a—— C:\WINDOWS\system32\hpzcon12.dll
2007-10-26 13:58 278,528 –a—— C:\WINDOWS\system32\hpgwiamd.dll
2007-10-26 13:58 274,432 –a—— C:\WINDOWS\system32\HPZc3212.dll
2007-10-26 13:58 258,122 –a—— C:\WINDOWS\system32\hpovst08.dll
2007-10-26 13:58 196,608 –a—— C:\WINDOWS\system32\hpzcoi12.dll
2007-10-26 13:58 180,315 –a—— C:\WINDOWS\system32\hpzsnt12.dll
2007-10-26 13:58 98,304 –a—— C:\WINDOWS\system32\hpzjsn01.dll
2007-10-26 09:45 d——– C:\_
2007-10-26 09:19 d——– C:\Documents and Settings\All Users\Application Data\FLEXnet
2007-10-26 09:07 720,176 -ra—— C:\WINDOWS\system32\drivers\LV302AV.SYS
2007-10-26 09:07 348,160 -ra—— C:\WINDOWS\system\msvcr71.dll
2007-10-26 09:07 12,080 -ra—— C:\WINDOWS\system32\drivers\lv302af.sys
2007-10-26 09:07 4,770 -ra—— C:\WINDOWS\system32\Repository.reg
2007-10-26 09:04 d——– C:\Documents and Settings\All Users\Application Data\Logitech
2007-10-25 21:44 d——– C:\Program Files\Bonjour
2007-10-25 21:30 d——– C:\Program Files\Common Files\Macrovision Shared
2007-10-25 20:23 10,880 –a—— C:\WINDOWS\system32\drivers\NdisIP.sys
2007-10-25 20:23 10,880 –a–c— C:\WINDOWS\system32\dllcache\ndisip.sys
2007-10-25 20:23 5,504 –a—— C:\WINDOWS\system32\drivers\MSTEE.sys
2007-10-25 20:23 5,504 –a–c— C:\WINDOWS\system32\dllcache\mstee.sys
2007-10-25 20:19 d——– C:\Program Files\Common Files\Logitech
2007-10-25 20:19 513,584 -ra—— C:\WINDOWS\system32\LVUI2RC.dll
2007-10-25 20:19 472,396 –a—— C:\WINDOWS\system32\drivers\lvcm.sys
2007-10-25 20:19 263,728 -ra—— C:\WINDOWS\system32\lvcodec2.dll
2007-10-25 20:19 210,480 -ra—— C:\WINDOWS\system32\LVUI2.dll
2007-10-25 20:19 116,272 -ra—— C:\WINDOWS\system32\lvcoinst.dll
2007-10-25 20:19 90,112 –a—— C:\WINDOWS\system32\LVComS.exe
2007-10-25 20:19 57,344 –a—— C:\WINDOWS\system32\LVComC.dll
2007-10-25 20:19 38,960 -ra—— C:\WINDOWS\system32\drivers\LVUSBSta.sys
2007-10-25 20:18 d–h—– C:\WINDOWS\msdownld.tmp
2007-10-25 20:18 d——– C:\Program Files\Windows Media Components
2007-10-25 20:16 d——– C:\Program Files\Logitech
2007-10-25 19:49 25,856 –a—— C:\WINDOWS\system32\drivers\usbprint.sys
2007-10-25 19:49 25,856 –a–c— C:\WINDOWS\system32\dllcache\usbprint.sys
2007-10-25 19:40 1,156 –a—— C:\WINDOWS\mozver.dat
2007-10-25 18:46 d——– C:\Program Files\Opera
2007-10-25 18:41 d——– C:\Documents and Settings\money\Contacts
2007-10-25 18:40 d—-c— C:\WINDOWS\system32\DRVSTORE
2007-10-25 18:40 d——– C:\Program Files\MSN Messenger
2007-10-25 18:29 d——– C:\Documents and Settings\money\Application Data\Yahoo!
2007-10-25 18:29 d——– C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2007-10-25 18:24 d——– C:\Documents and Settings\All Users\Application Data\Yahoo!
2007-10-25 18:23 d——– C:\Program Files\Yahoo!
2007-10-25 18:21 d——– C:\Documents and Settings\money\Application Data\acccore
2007-10-25 18:21 d——– C:\Documents and Settings\All Users\Application Data\AOL OCP
2007-10-25 18:17 d——– C:\Program Files\AIM6

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-03 18:59 57,764 –sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2007-11-01 02:47 ——— d—–w C:\Program Files\Common Files\Adobe
2007-10-25 22:21 ——— d—–w C:\Program Files\Viewpoint
2007-10-25 22:21 ——— d—–w C:\Program Files\Common Files\AOL
2007-10-25 22:21 ——— d—–w C:\Documents and Settings\All Users\Application Data\Viewpoint
2007-10-25 22:21 ——— d—–w C:\Documents and Settings\All Users\Application Data\AOL
2007-10-07 19:20 ——— d—–w C:\Program Files\Pure Networks
2007-10-07 19:11 ——— d—–w C:\Program Files\Common Files\Intuit
2007-10-07 17:21 ——— d—–w C:\Program Files\Windows Messaging
2007-10-07 16:51 ——— d—–w C:\Program Files\Common Files\Symantec Shared
2007-10-07 15:26 ——— d—–w C:\Program Files\DiscWizard for Windows
2007-10-07 15:01 ——— d—–w C:\Documents and Settings\Administrator\Application Data\Lavasoft
2007-10-07 06:47 ——— d–h–w C:\Program Files\InstallShield Installation Information
2007-10-07 06:30 ——— d—–w C:\Program Files\Common Files\Real
2007-09-24 14:28 ——— d—–w C:\Documents and Settings\JHTax\Application Data\AOL
2007-09-06 20:14 75,248 —-a-w C:\WINDOWS\zllsputility.exe
2007-09-06 20:14 1,086,952 —-a-w C:\WINDOWS\system32\zpeng24.dll
2007-08-21 06:15 683,520 —-a-w C:\WINDOWS\system32\inetcomm.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe" [2005-11-10 14:03]
"LVCOMS"="C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE" [2002-12-10 17:54]
"LogitechGalleryRepair"="C:\Program Files\Logitech\ImageStudio\ISStart.exe" [2002-12-10 18:32]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2005-01-23 10:36]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2005-01-23 10:31]
"HostManager"="C:\Program Files\Common Files\AOL\1105115711\EE\AOLHostManager.exe" []
"AOLDialer"="C:\Program Files\Common Files\AOL\ACS\AOLDial.exe" []
"AOL Spyware Protection"="C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe" []
"LogitechCommunicationsManager"="C:\Program Files\Common Files\Logitech\LComMgr\Communications_Helper.exe" [2006-06-26 09:46]
"LVCOMSX"="C:\Program Files\Common Files\Logitech\LComMgr\LVComSX.exe" [2006-06-26 10:33]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-01-07 12:36]
"SM_IAN"="C:\Program Files\AdvancedCleaner Free\ian_monitor.exe" []

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56]
"Aim6"="" []
"ares"="C:\Program Files\Ares\Ares.exe" [2007-07-16 17:54]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2007-08-31 16:46]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2007-06-21 14:06]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"RunNarrator"=Narrator.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 13:55 77824]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"bindmod"= {48957161-4026-4016-8928-77CA262D07BD} - C:\WINDOWS\bindmod.dll [ ]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"System"="kdidz.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Google Updater.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Google Updater.lnk
backup=C:\WINDOWS\pss\Google Updater.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOL Fast Start]
"C:\Program Files\America Online 9.0\AOL.EXE" -b

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ares]
"C:\Program Files\Ares\Ares.exe" -h

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechImageStudioTray]
C:\Program Files\Logitech\ImageStudio\LogiTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechQuickCamRibbon]
"C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" /hide

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
"C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray]
C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ZoneAlarm Client]
"C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"

R2 MSSQL$MSSMLBIZ;SQL Server (MSSMLBIZ);"c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe" -sMSSMLBIZ
S3 Intuit Fuse Service;Intuit Fuse Service;"C:\Program Files\Common Files\Intuit\Fuse\Service\Intuit Fuse Service.exe"

.
Contents of the 'Scheduled Tasks' folder
"2007-11-02 19:00:34 C:\WINDOWS\Tasks\Norton Security Scan.job"
- C:\Program Files\Norton Security Scan\Nss.exe
.
**************************************************************************

catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-03 15:26:59
Windows 5.1.2600 Service Pack 2 NTFS

detected NTDLL code modification:
ZwQueryDirectoryFile

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

C:\WINDOWS\system32\kdidz.exe 75813 bytes executable

scan completed successfully
hidden files: 1

**************************************************************************
.
Completion time: 2007-11-03 15:29:27 - machine was rebooted
.
— E O F —
Post #4
Aaand here is the HijackThis! log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:29:55 PM, on 11/3/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Common Files\Logitech\LComMgr\Communications_Helper.exe
C:\Program Files\Common Files\Logitech\LComMgr\LVComSX.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: (no name) - {3B28B033-8C1B-47DE-803D-3CF3AAE2CD20} - (no file)
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE
O4 - HKLM\..\Run: [LogitechGalleryRepair] C:\Program Files\Logitech\ImageStudio\ISStart.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1105115711\EE\AOLHostManager.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\Logitech\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LVCOMSX] "C:\Program Files\Common Files\Logitech\LComMgr\LVComSX.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SM_IAN] C:\Program Files\AdvancedCleaner Free\ian_monitor.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkID=39204
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} (HpProductDetection Class) - http://h20270.www2.hp.com/ediags/gmn2/inst…ctDetection.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{2BB797B5-3C5B-476B-B0EB-AFA8351917BF}: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CCS\Services\Tcpip\..\{373E2CB8-1AE5-44EA-9A4F-56152FE5E163}: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CS1\Services\Tcpip\..\{2BB797B5-3C5B-476B-B0EB-AFA8351917BF}: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CS3\Services\Tcpip\..\{2BB797B5-3C5B-476B-B0EB-AFA8351917BF}: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
O21 - SSODL: bindmod - {48957161-4026-4016-8928-77CA262D07BD} - C:\WINDOWS\bindmod.dll (file missing)
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intuit Fuse Service - Intuit - C:\Program Files\Common Files\Intuit\Fuse\Service\Intuit Fuse Service.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\Logitech\SrvLnch\SrvLnch.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: spkrmon - Unknown owner - C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

–
End of file - 9317 bytes
Post #5
Open notepad and copy/paste the text in the quotebox below into it:

File::
C:\WINDOWS\system32\RVAXO.bat
C:\WINDOWS\system32\remove.exe
C:\WINDOWS\system32\tmrsr.exe
C:\WINDOWS\system32\prrbpgbr.sys
C:\WINDOWS\system32\faxwin32.bin
C:\Program Files\AdvancedCleaner Free\ian_monitor.exe
C:\WINDOWS\bindmod.dll

Folder::
C:\RVAXO
C:\Program Files\Bonjour
C:\Program Files\Viewpoint
C:\Documents and Settings\All Users\Application Data\Viewpoint
C:\Program Files\AdvancedCleaner Free

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SM_IAN"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"bindmod"=-
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"System"=-


Save this as Save this as "CFScript"


[external image: Posted Image]

Refering to the picture above, drag CFScript.txt into ComboFix.exe

Then post the results log and a new HijackThis log.
Post #6
Thanks so much for you help, LDTate!

Here is my ComboFix log:

————————————————————————
ComboFix 07-11-01.1 - money 2007-11-03 16:27:00.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.219 [GMT -4:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\money\Desktop\CFScript.txt
* Created a new restore point

FILE::
C:\Program Files\AdvancedCleaner Free\ian_monitor.exe
C:\WINDOWS\bindmod.dll
C:\WINDOWS\system32\faxwin32.bin
C:\WINDOWS\system32\prrbpgbr.sys
C:\WINDOWS\system32\remove.exe
C:\WINDOWS\system32\RVAXO.bat
C:\WINDOWS\system32\tmrsr.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Application Data\Viewpoint
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\ComponentRegistry.ini
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\HostRegistry.ini
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\MetaStreamConfig.ini
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\MetaStreamID.ini
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\MTSDownloadSites.txt
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\-672030091.792518060
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\546226441.792519862
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\URLCache.ini
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\1388552057.792518061
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\URLCache.ini
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\-1696999369.792518064
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\407034558.ini
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\URLCache.ini
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03\2120360722.792518119
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03\URLCache.ini
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\UpdateVersionList_v2.mtx
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\UserShell\AOL9\FLFBootStrap.mtx
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\UserShell\AOL9Plus\FLFBootStrap.mtx
C:\Program Files\Bonjour
C:\Program Files\Bonjour\mdnsNSP.dll
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Viewpoint
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Viewpoint\Common\VistaBoot.sdll
C:\Program Files\Viewpoint\Viewpoint Media Player\AxMetaStream.dll
C:\Program Files\Viewpoint\Viewpoint Media Player\ClassIDs.ini
C:\Program Files\Viewpoint\Viewpoint Media Player\ComponentMgr.dll
C:\Program Files\Viewpoint\Viewpoint Media Player\ComponentRegistry.ini
C:\Program Files\Viewpoint\Viewpoint Media Player\Components\AOLUserShell.dll
C:\Program Files\Viewpoint\Viewpoint Media Player\Components\Cursors.dll
C:\Program Files\Viewpoint\Viewpoint Media Player\Components\JpegReader.dll
C:\Program Files\Viewpoint\Viewpoint Media Player\Components\Mts3Reader.dll
C:\Program Files\Viewpoint\Viewpoint Media Player\Components\SceneComponent.dll
C:\Program Files\Viewpoint\Viewpoint Media Player\Components\SreeDMMX.dll
C:\Program Files\Viewpoint\Viewpoint Media Player\Components\SWFView.dll
C:\Program Files\Viewpoint\Viewpoint Media Player\Components\VETScriptInterpreter.dll
C:\Program Files\Viewpoint\Viewpoint Media Player\Components\VMPSpeech.dll
C:\Program Files\Viewpoint\Viewpoint Media Player\Components\VMPVideo2.dll
C:\Program Files\Viewpoint\Viewpoint Media Player\HostRegistry.ini
C:\Program Files\Viewpoint\Viewpoint Media Player\MetaStreamConfig.ini
C:\Program Files\Viewpoint\Viewpoint Media Player\MetaStreamID.ini
C:\Program Files\Viewpoint\Viewpoint Media Player\MtsAxInstaller.exe
C:\Program Files\Viewpoint\Viewpoint Media Player\npViewpoint.dll
C:\Program Files\Viewpoint\Viewpoint Media Player\npViewpoint.xpt
C:\RVAXO
C:\RVAXO\results.log
C:\RVAXO\search_res.txt
C:\WINDOWS\system32\faxwin32.bin
C:\WINDOWS\system32\kdidz.exe
C:\WINDOWS\system32\prrbpgbr.sys
C:\WINDOWS\system32\remove.exe
C:\WINDOWS\system32\RVAXO.bat
C:\WINDOWS\system32\tmrsr.exe

.
((((((((((((((((((((((((( Files Created from 2007-10-03 to 2007-11-03 )))))))))))))))))))))))))))))))
.

2007-11-03 14:53 51,200 –a—— C:\WINDOWS\NirCmd.exe
2007-11-03 13:20 d——– C:\Program Files\Ares
2007-11-02 13:01 d——– C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2007-11-02 12:59 d——– C:\Program Files\SUPERAntiSpyware
2007-11-02 12:59 d——– C:\Program Files\Common Files\Wise Installation Wizard
2007-11-02 12:59 d——– C:\Documents and Settings\money\Application Data\SUPERAntiSpyware.com
2007-11-02 12:38 d——– C:\Program Files\Trend Micro
2007-10-31 22:47 d——– C:\WINDOWS\system32\Color
2007-10-31 22:47 212,480 –a—— C:\WINDOWS\PCDLIB32.DLL
2007-10-31 22:47 210,944 –a—— C:\WINDOWS\system32\MSVCRT10.DLL
2007-10-31 22:47 197,120 –a—— C:\WINDOWS\kpcp32.dll
2007-10-31 22:47 133,120 –a—— C:\WINDOWS\sprof32.dll
2007-10-31 22:47 58,368 –a—— C:\WINDOWS\pfpick.dll
2007-10-31 22:47 40,129 –a—— C:\WINDOWS\iccsigs.dat
2007-10-31 22:47 37,376 –a—— C:\WINDOWS\KPSYS32.DLL
2007-10-31 22:47 20,992 –a—— C:\WINDOWS\icccodes.dll
2007-10-31 22:45 d——– C:\Documents and Settings\money\WINDOWS
2007-10-30 17:26 d——– C:\Program Files\Windows Installer Clean Up
2007-10-30 17:26 d——– C:\Program Files\MSECACHE
2007-10-29 18:24 d——– C:\Program Files\Microsoft ActiveSync
2007-10-29 18:24 d——– C:\Program Files\Common Files\L&H
2007-10-29 18:22 d——– C:\WINDOWS\SHELLNEW
2007-10-29 18:19 dr-h—– C:\MSOCache
2007-10-29 01:56 d——– C:\Documents and Settings\money\Application Data\Viewpoint
2007-10-29 01:31 d——– C:\Program Files\SpywareBlaster
2007-10-29 01:30 d——– C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-10-28 16:50 d——– C:\Documents and Settings\All Users\Application Data\Office Genuine Advantage
2007-10-27 11:17 d——– C:\Documents and Settings\Cash\Contacts
2007-10-27 11:14 d——– C:\Documents and Settings\Cash\Application Data\Yahoo!
2007-10-27 03:00 d——– C:\Program Files\MSXML 4.0
2007-10-26 21:59 d——– C:\Documents and Settings\Lisa\Application Data\Yahoo!
2007-10-26 21:29 d——– C:\Program Files\Norton Security Scan
2007-10-26 14:14 15,104 –a—— C:\WINDOWS\system32\drivers\usbscan.sys
2007-10-26 14:14 15,104 –a–c— C:\WINDOWS\system32\dllcache\usbscan.sys
2007-10-26 14:08 d——– C:\Program Files\Hewlett-Packard
2007-10-26 14:08 d——– C:\Program Files\Common Files\Hewlett-Packard
2007-10-26 14:08 278,584 –a—— C:\WINDOWS\system32\HPZidr12.dll
2007-10-26 14:08 204,800 –a—— C:\WINDOWS\system32\HPZipr12.dll
2007-10-26 14:08 94,208 –a—— C:\WINDOWS\system32\HPZipt12.dll
2007-10-26 14:08 69,632 –a—— C:\WINDOWS\system32\HPZipm12.exe
2007-10-26 14:08 61,440 –a—— C:\WINDOWS\system32\HPZinw12.exe
2007-10-26 14:08 57,344 –a—— C:\WINDOWS\system32\HPZisn12.dll
2007-10-26 14:07 106,279 –a—— C:\WINDOWS\hpoins07.dat
2007-10-26 14:07 17,505 ——— C:\WINDOWS\hpomdl07.dat
2007-10-26 13:59 51,120 –a—— C:\WINDOWS\system32\drivers\HPZid412.sys
2007-10-26 13:59 21,744 –a—— C:\WINDOWS\system32\drivers\HPZius12.sys
2007-10-26 13:59 16,496 –a—— C:\WINDOWS\system32\drivers\HPZipr12.sys
2007-10-26 13:58 606,208 –a—— C:\WINDOWS\system32\hpotscl.dll
2007-10-26 13:58 393,216 –a—— C:\WINDOWS\system32\hpzcon12.dll
2007-10-26 13:58 278,528 –a—— C:\WINDOWS\system32\hpgwiamd.dll
2007-10-26 13:58 274,432 –a—— C:\WINDOWS\system32\HPZc3212.dll
2007-10-26 13:58 258,122 –a—— C:\WINDOWS\system32\hpovst08.dll
2007-10-26 13:58 196,608 –a—— C:\WINDOWS\system32\hpzcoi12.dll
2007-10-26 13:58 180,315 –a—— C:\WINDOWS\system32\hpzsnt12.dll
2007-10-26 13:58 98,304 –a—— C:\WINDOWS\system32\hpzjsn01.dll
2007-10-26 09:45 d——– C:\_
2007-10-26 09:19 d——– C:\Documents and Settings\All Users\Application Data\FLEXnet
2007-10-26 09:07 720,176 -ra—— C:\WINDOWS\system32\drivers\LV302AV.SYS
2007-10-26 09:07 348,160 -ra—— C:\WINDOWS\system\msvcr71.dll
2007-10-26 09:07 12,080 -ra—— C:\WINDOWS\system32\drivers\lv302af.sys
2007-10-26 09:07 4,770 -ra—— C:\WINDOWS\system32\Repository.reg
2007-10-26 09:04 d——– C:\Documents and Settings\All Users\Application Data\Logitech
2007-10-25 21:30 d——– C:\Program Files\Common Files\Macrovision Shared
2007-10-25 20:23 10,880 –a—— C:\WINDOWS\system32\drivers\NdisIP.sys
2007-10-25 20:23 10,880 –a–c— C:\WINDOWS\system32\dllcache\ndisip.sys
2007-10-25 20:23 5,504 –a—— C:\WINDOWS\system32\drivers\MSTEE.sys
2007-10-25 20:23 5,504 –a–c— C:\WINDOWS\system32\dllcache\mstee.sys
2007-10-25 20:19 d——– C:\Program Files\Common Files\Logitech
2007-10-25 20:19 513,584 -ra—— C:\WINDOWS\system32\LVUI2RC.dll
2007-10-25 20:19 472,396 –a—— C:\WINDOWS\system32\drivers\lvcm.sys
2007-10-25 20:19 263,728 -ra—— C:\WINDOWS\system32\lvcodec2.dll
2007-10-25 20:19 210,480 -ra—— C:\WINDOWS\system32\LVUI2.dll
2007-10-25 20:19 116,272 -ra—— C:\WINDOWS\system32\lvcoinst.dll
2007-10-25 20:19 90,112 –a—— C:\WINDOWS\system32\LVComS.exe
2007-10-25 20:19 57,344 –a—— C:\WINDOWS\system32\LVComC.dll
2007-10-25 20:19 38,960 -ra—— C:\WINDOWS\system32\drivers\LVUSBSta.sys
2007-10-25 20:18 d–h—– C:\WINDOWS\msdownld.tmp
2007-10-25 20:18 d——– C:\Program Files\Windows Media Components
2007-10-25 20:16 d——– C:\Program Files\Logitech
2007-10-25 19:49 25,856 –a—— C:\WINDOWS\system32\drivers\usbprint.sys
2007-10-25 19:49 25,856 –a–c— C:\WINDOWS\system32\dllcache\usbprint.sys
2007-10-25 19:40 1,156 –a—— C:\WINDOWS\mozver.dat
2007-10-25 18:46 d——– C:\Program Files\Opera
2007-10-25 18:41 d——– C:\Documents and Settings\money\Contacts
2007-10-25 18:40 d—-c— C:\WINDOWS\system32\DRVSTORE
2007-10-25 18:40 d——– C:\Program Files\MSN Messenger
2007-10-25 18:29 d——– C:\Documents and Settings\money\Application Data\Yahoo!
2007-10-25 18:29 d——– C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2007-10-25 18:24 d——– C:\Documents and Settings\All Users\Application Data\Yahoo!
2007-10-25 18:23 d——– C:\Program Files\Yahoo!
2007-10-25 18:21 d——– C:\Documents and Settings\money\Application Data\acccore
2007-10-25 18:21 d——– C:\Documents and Settings\All Users\Application Data\AOL OCP
2007-10-25 18:17 d——– C:\Program Files\AIM6
2007-10-25 17:53 d——– C:\Netgear
2007-10-25 17:31 d——– C:\Program Files\support.com
2007-10-25 17:31 d——– C:\Documents and Settings\All Users\Application Data\Support.com
2007-10-25 10:12 d——– C:\Program Files\Microsoft Works
2007-10-25 10:04 d——– C:\Documents and Settings\All Users\Application Data\Microsoft Help
2007-10-15 18:54 582,656 —–c— C:\WINDOWS\system32\dllcache\rpcrt4.dll
2007-10-07 15:04 d——– C:\Linksys Driver

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-03 20:33 58,148 –sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2007-11-01 02:47 ——— d—–w C:\Program Files\Common Files\Adobe
2007-10-25 22:21 ——— d—–w C:\Program Files\Common Files\AOL
2007-10-25 22:21 ——— d—–w C:\Documents and Settings\All Users\Application Data\AOL
2007-10-07 19:20 ——— d—–w C:\Program Files\Pure Networks
2007-10-07 19:11 ——— d—–w C:\Program Files\Common Files\Intuit
2007-10-07 17:21 ——— d—–w C:\Program Files\Windows Messaging
2007-10-07 16:51 ——— d—–w C:\Program Files\Common Files\Symantec Shared
2007-10-07 15:26 ——— d—–w C:\Program Files\DiscWizard for Windows
2007-10-07 15:01 ——— d—–w C:\Documents and Settings\Administrator\Application Data\Lavasoft
2007-10-07 06:47 ——— d–h–w C:\Program Files\InstallShield Installation Information
2007-10-07 06:30 ——— d—–w C:\Program Files\Common Files\Real
2007-09-24 14:28 ——— d—–w C:\Documents and Settings\JHTax\Application Data\AOL
2007-09-06 20:14 75,248 —-a-w C:\WINDOWS\zllsputility.exe
.

((((((((((((((((((((((((((((( snapshot@2007-11-03_15.28.16.81 )))))))))))))))))))))))))))))))))))))))))
.
- 2007-11-03 18:59:35 5,822,496 –sha-w C:\WINDOWS\system32\drivers\fidbox.dat
+ 2007-11-03 20:33:48 5,822,496 –sha-w C:\WINDOWS\system32\drivers\fidbox.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe" [2005-11-10 14:03]
"LVCOMS"="C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE" [2002-12-10 17:54]
"LogitechGalleryRepair"="C:\Program Files\Logitech\ImageStudio\ISStart.exe" [2002-12-10 18:32]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2005-01-23 10:36]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2005-01-23 10:31]
"HostManager"="C:\Program Files\Common Files\AOL\1105115711\EE\AOLHostManager.exe" []
"AOLDialer"="C:\Program Files\Common Files\AOL\ACS\AOLDial.exe" []
"AOL Spyware Protection"="C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe" []
"LogitechCommunicationsManager"="C:\Program Files\Common Files\Logitech\LComMgr\Communications_Helper.exe" [2006-06-26 09:46]
"LVCOMSX"="C:\Program Files\Common Files\Logitech\LComMgr\LVComSX.exe" [2006-06-26 10:33]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56]
"Aim6"="" []
"ares"="C:\Program Files\Ares\Ares.exe" [2007-07-16 17:54]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"RunNarrator"=Narrator.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 13:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Google Updater.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Google Updater.lnk
backup=C:\WINDOWS\pss\Google Updater.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOL Fast Start]
"C:\Program Files\America Online 9.0\AOL.EXE" -b

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ares]
"C:\Program Files\Ares\Ares.exe" -h

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechImageStudioTray]
C:\Program Files\Logitech\ImageStudio\LogiTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechQuickCamRibbon]
"C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" /hide

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
"C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray]
C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ZoneAlarm Client]
"C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"

R2 MSSQL$MSSMLBIZ;SQL Server (MSSMLBIZ);"c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe" -sMSSMLBIZ
S3 Intuit Fuse Service;Intuit Fuse Service;"C:\Program Files\Common Files\Intuit\Fuse\Service\Intuit Fuse Service.exe"

.
Contents of the 'Scheduled Tasks' folder
"2007-11-02 19:00:34 C:\WINDOWS\Tasks\Norton Security Scan.job"
- C:\Program Files\Norton Security Scan\Nss.exe
.
**************************************************************************

catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-03 16:36:05
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-11-03 16:37:54 - machine was rebooted
C:\ComboFix2.txt … 2007-11-03 15:29
.
— E O F —
————————————————————————–
Post #7
And HijackThis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:40:44 PM, on 11/3/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Common Files\Logitech\LComMgr\Communications_Helper.exe
C:\Program Files\Common Files\Logitech\LComMgr\LVComSX.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Ares\Ares.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: (no name) - {3B28B033-8C1B-47DE-803D-3CF3AAE2CD20} - (no file)
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE
O4 - HKLM\..\Run: [LogitechGalleryRepair] C:\Program Files\Logitech\ImageStudio\ISStart.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1105115711\EE\AOLHostManager.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\Logitech\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LVCOMSX] "C:\Program Files\Common Files\Logitech\LComMgr\LVComSX.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkID=39204
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} (HpProductDetection Class) - http://h20270.www2.hp.com/ediags/gmn2/inst…ctDetection.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{2BB797B5-3C5B-476B-B0EB-AFA8351917BF}: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CCS\Services\Tcpip\..\{373E2CB8-1AE5-44EA-9A4F-56152FE5E163}: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CS1\Services\Tcpip\..\{2BB797B5-3C5B-476B-B0EB-AFA8351917BF}: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Unknown owner - C:\Program Files\Bonjour\mDNSResponder.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intuit Fuse Service - Intuit - C:\Program Files\Common Files\Intuit\Fuse\Service\Intuit Fuse Service.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\Logitech\SrvLnch\SrvLnch.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: spkrmon - Unknown owner - C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe
O23 - Service: Viewpoint Manager Service - Unknown owner - C:\Program Files\Viewpoint\Common\ViewpointService.exe (file missing)
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

–
End of file - 8329 bytes
Post #8
Run hijackthis. Hit None of the above, Click Do a System Scan Only. Put a checkmark/tick in the box on the left side on these:

O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Unknown owner - C:\Program Files\Bonjour\mDNSResponder.exe (file missing)
O23 - Service: Viewpoint Manager Service - Unknown owner - C:\Program Files\Viewpoint\Common\ViewpointService.exe (file missing)

Close ALL windows and browsers except HijackThis and click "Fix checked"


Reboot and "copy/paste" a new HijackThis log file into this thread.

Also please describe how your computer behaves at the moment.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI