What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] reply

7 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Logfile of HijackThis v1.99.1
Scan saved at 2:27:28 PM, on 11/17/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\ntvdm.exe
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\vvgeowbv.exe,C:\WINDOWS\system32\userinit.exe
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: Security Toolbar - {11A69AE4-FBED-4832-A2BF-45AF82825583} - C:\WINDOWS\system32\lpbdwcse.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [cc65e58a] rundll32.exe "C:\WINDOWS\system32\fmokewgv.dll",b
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
O16 - DPF: {493ACF15-5CD9-4474-82A6-91670C3DD66E} (LinkedIn ContactFinderControl) - http://www.linkedin.com/cab/LinkedInContactFinderControl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1124667992359
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1124667976640
O16 - DPF: {A8683C98-5341-421B-B23C-8514C05354F1} (FujifilmUploader Class) - http://photo.walmart.com/photo/uploads/Fuj…ploadClient.cab
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
Post #2
Welcome to the forum.

Enable hidden files:
Open Windows Explorer & Go to Tools > Folder Options. Click on the View tab and make sure that "Show hidden files and folders" is checked.
Also uncheck "Hide protected operating system files" and untick "hide extensions for known file types" . Now click "Apply to all folders"
Click "Apply" then "OK" (reverse this procedure when we are done)

——————-

Clean out temp files:

Download and run ATF Cleaner - hit "select all" then just uncheck "cookies" (uncheck cookies is optional - leave it checked if you want to delete all cookies) then click "empty selected" That will clear out all the temp files on the system.

——————-

Download combofix.exe from the link below:
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Double click combofix.exe & follow the prompts.
A window will open with a warning.
Type "Y" (and Enter) to start the fix.
When the scan completes it will open a text window.
Please attach that log back here together with a fresh HJT log.
Caution - do not touch your mouse/keyboard until the scan has completed.
The scan will temporarily disable your desktop, and if interrupted may leave your desktop disabled. If this occurs, please reboot to restore the desktop.

Combofix will automatically save the log file to C:\combofix.txt

———————

Please download VundoFix.exe to your desktop.
  • Double-click VundoFix.exe to run it.
  • Click the Scan for Vundo button.
  • Once it's done scanning, click the Remove Vundo button.
  • You will receive a prompt asking if you want to remove the files, click YES
  • Once you click yes, your desktop will go blank as it starts removing Vundo.
  • When completed, it will prompt that it will reboot your computer, click OK.
  • Please post the contents of C:\vundofix.txt and a new HiJackThis log.
Note: It is possible that VundoFix encountered a file it could not remove.
In this case, VundoFix will run on reboot, simply follow the above instructions starting from "Click the Scan for Vundo button." when VundoFix appears at
reboot.

——————–


Please download and install the 30 day trial version of AVG Anti-Spyware 7.5 here:
http://www.ewido.net/en/download/

After it's installed…Check for updates:
Double click on the AVG-AS icon in the system tray or on the desktop> this will bring up the main program if it's not already up.

On the Main Page click the Update Tab and then Start Update.
Download and install any updates if available.

Select the Scanner icon at the top of the screen, then select the Settings tab.
Once in the Settings screen click on Recommended actions and then select Quarantine.
Under Reports
Select Automatically generate report after every scan
Un-Select Only if threats were found

Close ALL open Windows / Programs / Folders.
Open up AVG-AS
Now click the Scanner Icon on top
Click on Complete System Scan
Be patient - it takes a while to run.

IMPORTANT! Do not save the report before you have clicked the Apply all actions button. If you do, the log that is created will indicate "No action taken", making it more difficult to interpret the report. So be sure you save it only AFTER clicking the "Apply all actions" button?

Once the scan is complete do the following:
If you have any infections you will prompted, then select Apply All Actions

Next select the Reports icon at the top.
Copy and paste the scan report in your next reply.

Close AVG-AS and Reboot in Normal Mode.

Post the log from AVG AS, ComboFix, VundoFix, and a fresh HJT log, MrC
Post #3
I ran the ATF cleaner, Combofix, Hijackthis and vundofix. These are the logs from them but I'm still not hooked up to the internet.
Shoud I hook up and then download AVG Anti-Spyware program, I'm afraid the popups will come back!! ComboFix 07-11-08.1 - John Wright 2007-11-18 16:32:48.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1690 [GMT -6:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
* Created a new restore point
.

Unable to gain System Privileges

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Application Data.\czexypyj.dll
C:\Documents and Settings\All Users\Application Data.\ihytmxwp.dll
C:\Documents and Settings\All Users\Application Data.\ozulyrex.dll
C:\Documents and Settings\All Users\Application Data.\ranudory.dll
C:\Documents and Settings\All Users\Application Data.\salesmonitor
C:\Documents and Settings\All Users\Application Data.\wlmvyzkn.dll
C:\Documents and Settings\All Users\Application Data.\xkxqhypa.dll
C:\Documents and Settings\All Users\Application Data.\zqzqtadi.dll
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CnsMin.zip
C:\Documents and Settings\All Users\Application Data\storageprotector
C:\Documents and Settings\All Users\Application Data\storageprotector\Data\ac
C:\Documents and Settings\All Users\Application Data\storageprotector\Data\em
C:\Documents and Settings\All Users\Application Data\storageprotector\Data\oid
C:\Documents and Settings\All Users\Application Data\storageprotector\Data\user
C:\Documents and Settings\All Users\Start Menu\Live Safety Center.lnk
C:\Documents and Settings\John Wright\Application Data\CURITY~1
C:\Documents and Settings\John Wright\Application Data\ICROSO~1
C:\Documents and Settings\John Wright\Application Data\install_en[1].exe
C:\Documents and Settings\John Wright\Application Data\PPPATC~1
C:\Documents and Settings\John Wright\Application Data\storageprotector
C:\Documents and Settings\John Wright\Application Data\storageprotector\Logs\update.log
C:\Documents and Settings\John Wright\Desktop\Live Safety Center.lnk
C:\Documents and Settings\John Wright\Desktop\Online Security Guide.lnk
C:\Documents and Settings\John Wright\err.log
C:\Documents and Settings\John Wright\Favorites\Online Security Guide.lnk
C:\Documents and Settings\John Wright\My Documents\ASKS~1
C:\Documents and Settings\John Wright\My Documents\FNTS~1
C:\Documents and Settings\John Wright\My Documents\MCROSO~1.NET
C:\Documents and Settings\John Wright\My Documents\SCURIT~1
C:\Documents and Settings\John Wright\My Documents\STEM32~1
C:\Documents and Settings\John Wright\ResErrors.log
C:\Program Files\3269.exe
C:\Program Files\Astonsoft\pronyk.html
C:\Program Files\Common Files\{3C65E~1
C:\Program Files\Common Files\{3C65E~1\UnInstall.exe
C:\Program Files\Common Files\{CC65E~1
C:\Program Files\Common Files\crosof~1
C:\Program Files\Common Files\dobe~1
C:\Program Files\Common Files\smante~1
C:\Program Files\e-zshopper
C:\Program Files\e-zshopper\BarLcher.dll
C:\Program Files\outlook
C:\Program Files\smante~1
C:\Program Files\ssembl~1
C:\Program Files\Temporary
C:\Program Files\ucleaner_setup.exe
C:\Program Files\wnsxs~1
C:\Temp\1cb
C:\Temp\1cb\syscheck.log
C:\WINDOWS\cookies.ini
C:\WINDOWS\gimmygames.dat
C:\WINDOWS\keyboard11.dat
C:\WINDOWS\stem~1
C:\WINDOWS\system32\bsnzafqa.bin
C:\WINDOWS\system32\cfg.dat
C:\WINDOWS\system32\cfx32.ocx
C:\WINDOWS\system32\curity~1
C:\WINDOWS\system32\drivers\blank.gif
C:\WINDOWS\system32\drivers\box_1.gif
C:\WINDOWS\system32\drivers\box_2.gif
C:\WINDOWS\system32\drivers\box_3.gif
C:\WINDOWS\system32\drivers\button_buynow.gif
C:\WINDOWS\system32\drivers\button_freescan.gif
C:\WINDOWS\system32\drivers\cell_bg.gif
C:\WINDOWS\system32\drivers\cell_footer.gif
C:\WINDOWS\system32\drivers\cell_header_block.gif
C:\WINDOWS\system32\drivers\cell_header_remove.gif
C:\WINDOWS\system32\drivers\cell_header_scan.gif
C:\WINDOWS\system32\drivers\detect.htm
C:\WINDOWS\system32\drivers\download_box.gif
C:\WINDOWS\system32\drivers\download_btn.jpg
C:\WINDOWS\system32\drivers\download_now_btn.gif
C:\WINDOWS\system32\drivers\footer_back.jpg
C:\WINDOWS\system32\drivers\header_1.gif
C:\WINDOWS\system32\drivers\header_2.gif
C:\WINDOWS\system32\drivers\header_3.gif
C:\WINDOWS\system32\drivers\header_4.gif
C:\WINDOWS\system32\drivers\header_red_bg.gif
C:\WINDOWS\system32\drivers\header_red_free_scan.gif
C:\WINDOWS\system32\drivers\header_red_free_scan_bg.gif
C:\WINDOWS\system32\drivers\header_red_protect_your_pc.gif
C:\WINDOWS\system32\drivers\infected.gif
C:\WINDOWS\system32\drivers\main_back.gif
C:\WINDOWS\system32\drivers\perfect_cleaner_box.jpg
C:\WINDOWS\system32\drivers\product_1_header.gif
C:\WINDOWS\system32\drivers\product_1_name_small.gif
C:\WINDOWS\system32\drivers\product_2_header.gif
C:\WINDOWS\system32\drivers\product_2_name_small.gif
C:\WINDOWS\system32\drivers\product_3_header.gif
C:\WINDOWS\system32\drivers\product_3_name_small.gif
C:\WINDOWS\system32\drivers\product_features.gif
C:\WINDOWS\system32\drivers\pt.htm
C:\WINDOWS\system32\drivers\rating.gif
C:\WINDOWS\system32\drivers\s_detect.htm
C:\WINDOWS\system32\drivers\screenshot.jpg
C:\WINDOWS\system32\drivers\sep_hor.gif
C:\WINDOWS\system32\drivers\sep_vert.gif
C:\WINDOWS\system32\drivers\shadow.jpg
C:\WINDOWS\system32\drivers\shadow_bg.gif
C:\WINDOWS\system32\drivers\spacer.gif
C:\WINDOWS\system32\drivers\spy_away_box.jpg
C:\WINDOWS\system32\drivers\star.gif
C:\WINDOWS\system32\drivers\star_gray.gif
C:\WINDOWS\system32\drivers\star_gray_small.gif
C:\WINDOWS\system32\drivers\star_small.gif
C:\WINDOWS\system32\drivers\style.css
C:\WINDOWS\system32\drivers\v.gif
C:\WINDOWS\system32\drivers\warning_icon.gif
C:\WINDOWS\system32\drivers\win_logo.gif
C:\WINDOWS\system32\drivers\x.gif
C:\WINDOWS\system32\dwdsrngt.exe
C:\WINDOWS\system32\ejholicb.dllbox
C:\WINDOWS\system32\f1
C:\WINDOWS\system32\h2
C:\WINDOWS\system32\h2\jumper83122.exe
C:\WINDOWS\system32\ivfawhoz.dllbox
C:\WINDOWS\system32\jjkkj.bak1
C:\WINDOWS\system32\jjkkj.bak2
C:\WINDOWS\system32\jjkkj.ini
C:\WINDOWS\system32\jkkjj.dll
C:\WINDOWS\system32\lpbdwcse.dllbox
C:\WINDOWS\system32\m1
C:\WINDOWS\system32\mbols~1
C:\WINDOWS\system32\mcroso~1
C:\WINDOWS\system32\pac.txt
C:\WINDOWS\system32\r2
C:\WINDOWS\system32\r2\revdrive33b.exe
C:\WINDOWS\system32\ssembl~1
C:\WINDOWS\system32\sstem3~1
C:\WINDOWS\system32\vxddsk.exe
C:\WINDOWS\system32\winpfz32.sys
C:\WINDOWS\system32\wintisv.exe
C:\WINDOWS\system32\wml.exe
C:\WINDOWS\system32\zxdnt3d.cfg
C:\WINDOWS\TTC-4444.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
——-\LEGACY_CMDSERVICE
——-\LEGACY_COM+_MESSAGES
——-\LEGACY_NETWORK_MONITOR
——-\com+ messages


((((((((((((((((((((((((( Files Created from 2007-10-18 to 2007-11-18 )))))))))))))))))))))))))))))))
.

2007-11-18 16:30 51,200 –a—— C:\WINDOWS\NirCmd.exe
2007-11-17 12:47 188,960 –a—— C:\WINDOWS\system32\WINGDE.DLL
2007-11-17 12:47 92,208 –a—— C:\WINDOWS\system32\WING.DLL
2007-11-17 12:47 12,800 –a—— C:\WINDOWS\system32\wing32.dll
2007-11-16 18:22 145,984 –a—— C:\WINDOWS\system32\lpbdwcse.dll
2007-11-16 18:22 145,984 –a—— C:\WINDOWS\system32\jmtumqko.dll
2007-11-16 18:19 145,984 –a—— C:\WINDOWS\system32\katcvjqr.dll
2007-11-16 17:49 85,056 –a—— C:\WINDOWS\system32\fmokewgv.dll
2007-11-16 17:46 81,984 –a—— C:\WINDOWS\system32\qopbreqy.dll
2007-11-16 17:27 d——– C:\WINDOWS\system32\CatRoot2
2007-11-13 13:49 d——– C:\Program Files\chadbeph
2007-11-13 13:49 161,344 –a—— C:\Documents and Settings\John Wright\Application Data\trant.exe
2007-11-12 19:47 d——– C:\Program Files\E404 Helper
2007-11-12 19:46 81,472 –a—— C:\WINDOWS\system32\unluqwiu.dll
2007-11-12 19:44 89,664 –a—— C:\WINDOWS\system32\grxattou.dll
2007-11-12 06:19 36,352 –a—— C:\WINDOWS\system32\byxwvuv.dll
2007-11-11 22:20 d–h—– C:\WINDOWS\system32\GroupPolicy
2007-11-11 20:19 d——– C:\VundoFix Backups
2007-11-11 10:58 d–hs—- C:\WINDOWS\Sm9obiBXcmlnaHQ
2007-11-11 10:22 4 –a—— C:\WINDOWS\system32\stfv.bin
2007-11-11 10:01 21,504 –a—— C:\WINDOWS\system32\aivskurq.dll
2007-11-11 10:01 12 –a—— C:\WINDOWS\system32\dpqaqlqx.bin
2007-11-11 09:14 d——– C:\Program Files\Lavasoft
2007-11-11 09:14 d——– C:\Documents and Settings\All Users\Application Data\Lavasoft
2007-11-11 07:00 79,936 –a—— C:\WINDOWS\system32\oxrbvcyv.dll
2007-11-11 06:55 88,128 –a—— C:\WINDOWS\system32\vvskwiqs.dll
2007-11-11 06:55 71,232 –a—— C:\WINDOWS\system32\lmjjegav.exe
2007-11-11 06:51 d——– C:\WINDOWS\system32\rMa06yy
2007-11-11 06:51 d——– C:\Temp\abW9
2007-11-11 06:51 d——– C:\Temp
2007-11-11 06:51 36,352 –a—— C:\WINDOWS\system32\byxxvwt.dll
2007-11-10 20:10 36,352 –a—— C:\WINDOWS\system32\cbxyxyv.dll
2007-11-10 07:06 81,472 –a—— C:\WINDOWS\system32\gantyxyr.dll
2007-11-10 06:57 145,984 –a—— C:\WINDOWS\system32\vvmhfqfl.dll
2007-11-09 18:39 36,352 –a—— C:\WINDOWS\system32\gebywwt.dll
2007-11-08 17:50 d——– C:\Program Files\Replay Converter
2007-11-08 17:35 35,328 –a—— C:\WINDOWS\system32\efcayax.dll
2007-11-08 17:35 134 –a—— C:\n.bat
2007-11-08 17:35 0 –a—— C:\z.dat
2007-11-08 17:35 0 –a—— C:\x.dat
2007-11-08 16:54 d——– C:\Program Files\Common Files\xing shared

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-18 22:36 ——— d—–w C:\Program Files\Astonsoft
2007-11-17 14:12 ——— d—–w C:\Program Files\SpywareBlaster
2007-11-16 23:26 ——— d—–w C:\Program Files\XoftSpySE
2007-11-13 01:43 ——— d—a-w C:\Documents and Settings\All Users\Application Data\TEMP
2007-11-13 01:43 ——— d—–w C:\Program Files\Google
2007-11-11 15:49 ——— d—–w C:\Documents and Settings\John Wright\Application Data\Uniblue
2007-11-11 15:13 ——— d—–w C:\Program Files\Common Files\Wise Installation Wizard
2007-11-11 13:49 ——— d—–w C:\Program Files\Real
2007-11-11 13:22 ——— d—–w C:\Program Files\Yahoo!
2007-11-11 13:09 ——— d–h–w C:\Program Files\InstallShield Installation Information
2007-11-11 12:44 ——— d—–w C:\Program Files\Common Files\Adobe
2007-11-11 12:43 ——— d—–w C:\Documents and Settings\John Wright\Application Data\Lavasoft
2007-11-08 23:02 36,624 ——w C:\WINDOWS\system32\drivers\PxHelp20.sys
2007-11-08 23:02 2,560 ——w C:\WINDOWS\system32\drivers\cdralw2k.sys
2007-11-08 23:02 2,432 ——w C:\WINDOWS\system32\drivers\cdr4_xp.sys
2007-10-05 20:36 ——— d—–w C:\Program Files\Java
2007-09-23 21:56 ——— d—–w C:\Program Files\Bejeweled 2 Deluxe
2007-09-21 03:21 ——— d—–w C:\Documents and Settings\John Wright\Application Data\LinkedIn
2007-01-10 18:15 839,694 —-a-w C:\WINDOWS\Fonts\Crack.exe
2007-01-04 23:53 93,509 —-a-w C:\Documents and Settings\John Wright\install.exe
2005-04-16 04:59 1,613 —-a-w C:\Program Files\uninstal.log
2005-07-29 22:24:26 472 –sha-r C:\WINDOWS\Sm9obiBXcmlnaHQ\mA6Cv21rwA5BuJk.vbs
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{029e02f0-a0e5-4b19-b958-7bf2db29fb13}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2F02D978-0FF6-80F7-60BB-0426224AB7B3}]
2007-11-13 13:50 110592 –a—— C:\Program Files\chadbeph\iecdpdba.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3FB474CC-EE5A-4031-89A9-DCBC68DD19E1}]
2007-08-02 07:43 282624 –a—— C:\Program Files\SpywareBlaster\hosecukyt83122.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{51000073-BC70-4AAF-8D92-AC95A9954A3D}]
C:\Program Files\Astonsoft\lafuv985.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{54645654-2225-4455-44A1-9F4543D34546}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6abc861a-31e7-4d91-b43b-d3c98f22a5c0}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{844cfec7-57bb-4982-ad3e-03685079a732}]
2007-11-16 17:46 81984 –a—— C:\WINDOWS\system32\qopbreqy.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A40BB501-A94D-4D53-81A7-19F6AEA8585D}]
2007-08-02 07:43 282624 –a—— C:\Program Files\SpywareBlaster\hosecukyt4444.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{a4a435cf-3583-11d4-91bd-0048546a1450}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A95B2816-1D7E-4561-A202-68C0DE02353A}]
2007-11-16 18:22 145984 –a—— C:\WINDOWS\system32\lpbdwcse.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BCC73622-F72D-4277-803C-D65565A0947F}]
2007-11-08 17:35 35328 –a—— C:\WINDOWS\system32\efcayax.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BF442538-BE32-4055-A549-2F3B699F55EB}]
2007-11-11 10:01 21504 –a—— C:\WINDOWS\system32\aivskurq.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C0E41684-CEFA-4C35-9C80-213A6F57A3E7}]
2007-08-02 07:43 282624 –a—— C:\Program Files\SpywareBlaster\hosecukyt555077.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{c2680e10-1655-4a0e-87f8-4259325a84b7}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{c4ca6559-2cf1-48b6-96b2-8340a06fd129}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{d8efadf1-9009-11d6-8c73-608c5dc19089}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{e9306072-417e-43e3-81d5-369490beef7c}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{11A69AE4-FBED-4832-A2BF-45AF82825583}"= C:\WINDOWS\system32\lpbdwcse.dll [2007-11-16 18:22 145984]

[HKEY_CLASSES_ROOT\CLSID\{11A69AE4-FBED-4832-A2BF-45AF82825583}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-01-22 09:10]
"cc65e58a"="C:\WINDOWS\system32\fmokewgv.dll" [2007-11-16 17:49]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-11-08 16:54]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:56]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"swg"=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoRecentDocsMenu"=0 (0x0)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{BCC73622-F72D-4277-803C-D65565A0947F}"= C:\WINDOWS\system32\efcayax.dll [2007-11-08 17:35 35328]

[HKEY_CURRENT_USER\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="C:\\WINDOWS\\system32\\vvgeowbv.exe,C:\\WINDOWS\\system32\\userinit.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\efcayax]
efcayax.dll 2007-11-08 17:35 35328 C:\WINDOWS\system32\efcayax.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\lpbdwcse]
lpbdwcse.dll 2007-11-16 18:22 145984 C:\WINDOWS\system32\lpbdwcse.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winpsa32]
winpsa32.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winwly32]
winwly32.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"= msv1_0 C:\WINDOWS\system32\jkkjj.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^John Wright^Start Menu^Programs^Startup^TA_Start.lnk]
backup=C:\WINDOWS\pss\TA_Start.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^John Wright^Start Menu^Programs^Startup^Think-Adz.lnk]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ExploreUpdSched]

R2 IOPort;IOPort;\??\C:\WINDOWS\system32\DRIVERS\IOPORT.SYS
R3 LCcfltr;Logitech USB Filter Driver;C:\WINDOWS\system32\Drivers\LCcFltr.Sys
R3 P17;Sound Blaster Live! 24-bit;C:\WINDOWS\system32\drivers\P17.sys
S2 nvcap;nVidia WDM Video Capture (universal);C:\WINDOWS\system32\DRIVERS\nvcap.sys
S2 nvTUNEP;nVidia WDM TVTuner;C:\WINDOWS\system32\DRIVERS\nvtunep.sys
S2 nvtvSND;nVidia WDM TVAudio Crossbar;C:\WINDOWS\system32\DRIVERS\nvtvsnd.sys
S2 NVXBAR;nVidia WDM A/V Crossbar;C:\WINDOWS\system32\DRIVERS\NVxbar.sys
S3 3c1807pd;U.S. Robotics V.92 Fax Win Int;C:\WINDOWS\system32\DRIVERS\3c1807pd.sys
S3 SetupNTGLM7X;SetupNTGLM7X;\??\H:\NTGLM7X.sys
S3 USRpdA;U.S. Robotics 56K PCI Faxmodem Driver;C:\WINDOWS\system32\DRIVERS\USRpdA.sys

.
Contents of the 'Scheduled Tasks' folder
"2007-01-29 20:10:22 C:\WINDOWS\Tasks\RegCure.job"
- C:\Program Files\RegCure\RegCure.exe
"2007-11-18 22:41:44 C:\WINDOWS\Tasks\XoftSpySE 2.job"
- C:\Program Files\XoftSpySE\XoftSpy.exe
"2007-11-17 09:04:05 C:\WINDOWS\Tasks\XoftSpySE.job"
.
**************************************************************************

catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-18 16:42:09
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-11-18 16:44:06 - machine was rebooted
.
— E O F —
Logfile of HijackThis v1.99.1
Scan saved at 5:15:02 PM, on 11/18/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: (no name) - {029e02f0-a0e5-4b19-b958-7bf2db29fb13} - (no file)
O2 - BHO: (no name) - {2F02D978-0FF6-80F7-60BB-0426224AB7B3} - C:\Program Files\chadbeph\iecdpdba.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: (no name) - {3FB474CC-EE5A-4031-89A9-DCBC68DD19E1} - C:\Program Files\SpywareBlaster\hosecukyt83122.dll
O2 - BHO: 0 - {51000073-BC70-4AAF-8D92-AC95A9954A3D} - C:\Program Files\Astonsoft\lafuv985.dll (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {54645654-2225-4455-44A1-9F4543D34546} - (no file)
O2 - BHO: (no name) - {6abc861a-31e7-4d91-b43b-d3c98f22a5c0} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: {237a9705-8630-e3da-2894-bb757cefc448} - {844cfec7-57bb-4982-ad3e-03685079a732} - C:\WINDOWS\system32\qopbreqy.dll
O2 - BHO: (no name) - {A40BB501-A94D-4D53-81A7-19F6AEA8585D} - C:\Program Files\SpywareBlaster\hosecukyt4444.dll
O2 - BHO: (no name) - {a4a435cf-3583-11d4-91bd-0048546a1450} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: aivskurq.msdn_hlp - {BF442538-BE32-4055-A549-2F3B699F55EB} - C:\WINDOWS\system32\aivskurq.dll
O2 - BHO: (no name) - {C0E41684-CEFA-4C35-9C80-213A6F57A3E7} - C:\Program Files\SpywareBlaster\hosecukyt555077.dll
O2 - BHO: (no name) - {c2680e10-1655-4a0e-87f8-4259325a84b7} - (no file)
O2 - BHO: (no name) - {c4ca6559-2cf1-48b6-96b2-8340a06fd129} - (no file)
O2 - BHO: (no name) - {d8efadf1-9009-11d6-8c73-608c5dc19089} - (no file)
O2 - BHO: (no name) - {e9306072-417e-43e3-81d5-369490beef7c} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: (no name) - {11A69AE4-FBED-4832-A2BF-45AF82825583} - (no file)
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [cc65e58a] rundll32.exe "C:\WINDOWS\system32\fmokewgv.dll",b
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
O16 - DPF: {493ACF15-5CD9-4474-82A6-91670C3DD66E} (LinkedIn ContactFinderControl) - http://www.linkedin.com/cab/LinkedInContactFinderControl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1124667992359
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1124667976640
O16 - DPF: {A8683C98-5341-421B-B23C-8514C05354F1} (FujifilmUploader Class) - http://photo.walmart.com/photo/uploads/Fuj…ploadClient.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: winpsa32 - winpsa32.dll (file missing)
O20 - Winlogon Notify: winwly32 - winwly32.dll (file missing)
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe


VundoFix V6.5.11

Checking Java version…

Java version is 1.5.0.6
Old versions of java are exploitable and should be removed.

Java version is 1.5.0.10

Scan started at 8:19:44 PM 11/11/2007

Listing files found while scanning….

C:\WINDOWS\system32\ejholicb.dll

Beginning removal…

Attempting to delete C:\WINDOWS\system32\ejholicb.dll
C:\WINDOWS\system32\ejholicb.dll Has been deleted!

Performing Repairs to the registry.
Done!

VundoFix V6.6.2

Checking Java version…

Java version is 1.5.0.6
Old versions of java are exploitable and should be removed.

Java version is 1.5.0.10

Scan started at 4:54:59 PM 11/18/2007

Listing files found while scanning….

C:\windows\system32\byxwvuv.dll
C:\windows\system32\byxxvwt.dll
C:\windows\system32\cbxyxyv.dll
C:\WINDOWS\system32\efcayax.dll
C:\windows\system32\gebywwt.dll
C:\windows\system32\jmtumqko.dll
C:\windows\system32\katcvjqr.dll
C:\windows\system32\lpbdwcse.dll
C:\windows\system32\lpbdwcse.dllbox
C:\windows\system32\vvmhfqfl.dll

Beginning removal…

Attempting to delete C:\windows\system32\byxwvuv.dll
C:\windows\system32\byxwvuv.dll Has been deleted!

Attempting to delete C:\windows\system32\byxxvwt.dll
C:\windows\system32\byxxvwt.dll Has been deleted!

Attempting to delete C:\windows\system32\cbxyxyv.dll
C:\windows\system32\cbxyxyv.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\efcayax.dll
C:\WINDOWS\system32\efcayax.dll Could not be deleted.

Attempting to delete C:\windows\system32\gebywwt.dll
C:\windows\system32\gebywwt.dll Has been deleted!

Attempting to delete C:\windows\system32\jmtumqko.dll
C:\windows\system32\jmtumqko.dll Has been deleted!

Attempting to delete C:\windows\system32\katcvjqr.dll
C:\windows\system32\katcvjqr.dll Has been deleted!

Attempting to delete C:\windows\system32\lpbdwcse.dll
C:\windows\system32\lpbdwcse.dll Has been deleted!

Attempting to delete C:\windows\system32\lpbdwcse.dllbox
C:\windows\system32\lpbdwcse.dllbox Has been deleted!

Attempting to delete C:\windows\system32\vvmhfqfl.dll
C:\windows\system32\vvmhfqfl.dll Has been deleted!

Performing Repairs to the registry.
Done!

VundoFix V6.6.2

Checking Java version…

Java version is 1.5.0.6
Old versions of java are exploitable and should be removed.

Java version is 1.5.0.10

Scan started at 5:04:43 PM 11/18/2007

Listing files found while scanning….

C:\windows\system32\efcayax.dll

Beginning removal…

Attempting to delete C:\windows\system32\efcayax.dll
C:\windows\system32\efcayax.dll Has been deleted!

Performing Repairs to the registry.
Done!
Post #4 last edited
Please open Notepad (Start > Run > in the Open field type: notepad)
Click: OK

Copy/ paste the blue text below to Notepad:

File::
C:\WINDOWS\system32\lpbdwcse.dll
C:\WINDOWS\system32\jmtumqko.dll
C:\WINDOWS\system32\katcvjqr.dll
C:\WINDOWS\system32\fmokewgv.dll
C:\WINDOWS\system32\qopbreqy.dll
C:\WINDOWS\system32\unluqwiu.dll
C:\WINDOWS\system32\grxattou.dll
C:\WINDOWS\system32\byxwvuv.dll
C:\WINDOWS\system32\stfv.bin
C:\WINDOWS\system32\aivskurq.dll
C:\WINDOWS\system32\dpqaqlqx.bin
C:\WINDOWS\system32\oxrbvcyv.dll
C:\WINDOWS\system32\vvskwiqs.dll
C:\WINDOWS\system32\lmjjegav.exe
C:\WINDOWS\system32\byxxvwt.dll
C:\WINDOWS\system32\cbxyxyv.dll
C:\WINDOWS\system32\gantyxyr.dll
C:\WINDOWS\system32\vvmhfqfl.dll
C:\WINDOWS\system32\gebywwt.dll
C:\WINDOWS\system32\efcayax.dll
C:\Program Files\chadbeph\iecdpdba.dll
C:\Program Files\SpywareBlaster\hosecukyt83122.dll
C:\Program Files\SpywareBlaster\hosecukyt4444.dll
C:\WINDOWS\system32\qopbreqy.dll
C:\WINDOWS\system32\lpbdwcse.dll
C:\WINDOWS\system32\efcayax.dll
C:\WINDOWS\system32\lpbdwcse.dll
C:\WINDOWS\system32\fmokewgv.dll
C:\WINDOWS\system32\jkkjj.dll

Folder::
C:\Program Files\chadbeph

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{029e02f0-a0e5-4b19-b958-7bf2db29fb13}]

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2F02D978-0FF6-80F7-60BB-0426224AB7B3}]

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3FB474CC-EE5A-4031-89A9-DCBC68DD19E1}]

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{51000073-BC70-4AAF-8D92-AC95A9954A3D}]

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{54645654-2225-4455-44A1-9F4543D34546}]

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6abc861a-31e7-4d91-b43b-d3c98f22a5c0}]

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{844cfec7-57bb-4982-ad3e-03685079a732}]

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A40BB501-A94D-4D53-81A7-19F6AEA8585D}]

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{a4a435cf-3583-11d4-91bd-0048546a1450}]

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A95B2816-1D7E-4561-A202-68C0DE02353A}]

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BCC73622-F72D-4277-803C-D65565A0947F}]

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BF442538-BE32-4055-A549-2F3B699F55EB}]

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C0E41684-CEFA-4C35-9C80-213A6F57A3E7}]

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{c2680e10-1655-4a0e-87f8-4259325a84b7}]

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{c4ca6559-2cf1-48b6-96b2-8340a06fd129}]

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{d8efadf1-9009-11d6-8c73-608c5dc19089}]

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{e9306072-417e-43e3-81d5-369490beef7c}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{11A69AE4-FBED-4832-A2BF-45AF82825583}"=-

[-HKEY_CLASSES_ROOT\CLSID\{11A69AE4-FBED-4832-A2BF-45AF82825583}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"cc65e58a"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{BCC73622-F72D-4277-803C-D65565A0947F}"=-

[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\efcayax]

[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\lpbdwcse]

[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winpsa32]

[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winwly32]


Save as CFScript.txt
Change the "Save as type" to "All Files"
Save it to the Desktop.
Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

[external image: Posted Image]


ComboFix now runs a scan on your system, and may reboot when it finishes. This is normal.

CAUTION: Do not mouse-click ComboFix while it is running. It may cause it to stall.

When finished, a log is produced.

Please provide the contents of the ComboFix log and a fresh HJT log in your next reply.
MrC
Post #5
When I put the file in combofix it starts to run and then it said that combo was out of date and needs to be updated the it unenstalls I tryed to redownload it again and rerun it but it did the same
Post #7
You can do it this way:

1. Please download OTMoveIt by OldTimer to your desktop.
2. Please double-click OTMoveIt.exe to run it.
Where it says: "Paste List of Files/Folders to be Moved", copy and paste next blue part into that Window:

C:\WINDOWS\system32\lpbdwcse.dll
C:\WINDOWS\system32\jmtumqko.dll
C:\WINDOWS\system32\katcvjqr.dll
C:\WINDOWS\system32\fmokewgv.dll
C:\WINDOWS\system32\qopbreqy.dll
C:\WINDOWS\system32\unluqwiu.dll
C:\WINDOWS\system32\grxattou.dll
C:\WINDOWS\system32\byxwvuv.dll
C:\WINDOWS\system32\stfv.bin
C:\WINDOWS\system32\aivskurq.dll
C:\WINDOWS\system32\dpqaqlqx.bin
C:\WINDOWS\system32\oxrbvcyv.dll
C:\WINDOWS\system32\vvskwiqs.dll
C:\WINDOWS\system32\lmjjegav.exe
C:\WINDOWS\system32\byxxvwt.dll
C:\WINDOWS\system32\cbxyxyv.dll
C:\WINDOWS\system32\gantyxyr.dll
C:\WINDOWS\system32\vvmhfqfl.dll
C:\WINDOWS\system32\gebywwt.dll
C:\WINDOWS\system32\efcayax.dll
C:\Program Files\chadbeph\iecdpdba.dll
C:\Program Files\SpywareBlaster\hosecukyt83122.dll
C:\Program Files\SpywareBlaster\hosecukyt4444.dll
C:\WINDOWS\system32\qopbreqy.dll
C:\WINDOWS\system32\lpbdwcse.dll
C:\WINDOWS\system32\efcayax.dll
C:\WINDOWS\system32\lpbdwcse.dll
C:\WINDOWS\system32\fmokewgv.dll
C:\WINDOWS\system32\jkkjj.dll
C:\Program Files\chadbeph

3. Then click the red Moveit! button below.
This will display the results in the right windows where it says Results on top
4. Copy and paste everything present in the Results window (right window) and save these results in notepad and save it on your desktop, because I need to see those results afterwards.
5. Close OTMoveIt

Note:
If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

==================================================
Next:
Copy and paste the blue text below into notepad and save it as fix.reg
Make sure the Save as type field says All files.
Save it to your desktop.

REGEDIT4

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{029e02f0-a0e5-4b19-b958-7bf2db29fb13}]

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2F02D978-0FF6-80F7-60BB-0426224AB7B3}]

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3FB474CC-EE5A-4031-89A9-DCBC68DD19E1}]

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{51000073-BC70-4AAF-8D92-AC95A9954A3D}]

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{54645654-2225-4455-44A1-9F4543D34546}]

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6abc861a-31e7-4d91-b43b-d3c98f22a5c0}]

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{844cfec7-57bb-4982-ad3e-03685079a732}]

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A40BB501-A94D-4D53-81A7-19F6AEA8585D}]

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{a4a435cf-3583-11d4-91bd-0048546a1450}]

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A95B2816-1D7E-4561-A202-68C0DE02353A}]

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BCC73622-F72D-4277-803C-D65565A0947F}]

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BF442538-BE32-4055-A549-2F3B699F55EB}]

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C0E41684-CEFA-4C35-9C80-213A6F57A3E7}]

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{c2680e10-1655-4a0e-87f8-4259325a84b7}]

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{c4ca6559-2cf1-48b6-96b2-8340a06fd129}]

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{d8efadf1-9009-11d6-8c73-608c5dc19089}]

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{e9306072-417e-43e3-81d5-369490beef7c}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{11A69AE4-FBED-4832-A2BF-45AF82825583}"=-

[-HKEY_CLASSES_ROOT\CLSID\{11A69AE4-FBED-4832-A2BF-45AF82825583}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"cc65e58a"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{BCC73622-F72D-4277-803C-D65565A0947F}"=-

[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\efcayax]

[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\lpbdwcse]

[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winpsa32]

[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winwly32]



If you did it right it should look like this:
[external image: Posted Image]


Now double click on it and allow it to merge into the registry.

—————

Post the log from OTMoveIt and a fresh HJT log, MrC
Post #12
I got it to work on my computer:

Change your clock back one day so it reads the 17th.

Now download ComboFix again.

Delete the file I had you make before in notepad it's incorrect.

Use this:

Please open Notepad (Start > Run > in the Open field type: notepad)
Click: OK

Copy/ paste the blue text below to Notepad:

File::
C:\WINDOWS\system32\lpbdwcse.dll
C:\WINDOWS\system32\jmtumqko.dll
C:\WINDOWS\system32\katcvjqr.dll
C:\WINDOWS\system32\fmokewgv.dll
C:\WINDOWS\system32\qopbreqy.dll
C:\WINDOWS\system32\unluqwiu.dll
C:\WINDOWS\system32\grxattou.dll
C:\WINDOWS\system32\byxwvuv.dll
C:\WINDOWS\system32\stfv.bin
C:\WINDOWS\system32\aivskurq.dll
C:\WINDOWS\system32\dpqaqlqx.bin
C:\WINDOWS\system32\oxrbvcyv.dll
C:\WINDOWS\system32\vvskwiqs.dll
C:\WINDOWS\system32\lmjjegav.exe
C:\WINDOWS\system32\byxxvwt.dll
C:\WINDOWS\system32\cbxyxyv.dll
C:\WINDOWS\system32\gantyxyr.dll
C:\WINDOWS\system32\vvmhfqfl.dll
C:\WINDOWS\system32\gebywwt.dll
C:\WINDOWS\system32\efcayax.dll
C:\Program Files\chadbeph\iecdpdba.dll
C:\Program Files\SpywareBlaster\hosecukyt83122.dll
C:\Program Files\SpywareBlaster\hosecukyt4444.dll
C:\WINDOWS\system32\qopbreqy.dll
C:\WINDOWS\system32\lpbdwcse.dll
C:\WINDOWS\system32\efcayax.dll
C:\WINDOWS\system32\lpbdwcse.dll
C:\WINDOWS\system32\fmokewgv.dll
C:\WINDOWS\system32\jkkjj.dll

Folder::
C:\Program Files\chadbeph

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{029e02f0-a0e5-4b19-b958-7bf2db29fb13}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2F02D978-0FF6-80F7-60BB-0426224AB7B3}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3FB474CC-EE5A-4031-89A9-DCBC68DD19E1}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{51000073-BC70-4AAF-8D92-AC95A9954A3D}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{54645654-2225-4455-44A1-9F4543D34546}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6abc861a-31e7-4d91-b43b-d3c98f22a5c0}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{844cfec7-57bb-4982-ad3e-03685079a732}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A40BB501-A94D-4D53-81A7-19F6AEA8585D}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{a4a435cf-3583-11d4-91bd-0048546a1450}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A95B2816-1D7E-4561-A202-68C0DE02353A}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BCC73622-F72D-4277-803C-D65565A0947F}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BF442538-BE32-4055-A549-2F3B699F55EB}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C0E41684-CEFA-4C35-9C80-213A6F57A3E7}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{c2680e10-1655-4a0e-87f8-4259325a84b7}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{c4ca6559-2cf1-48b6-96b2-8340a06fd129}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{d8efadf1-9009-11d6-8c73-608c5dc19089}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{e9306072-417e-43e3-81d5-369490beef7c}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{11A69AE4-FBED-4832-A2BF-45AF82825583}"=-
[-HKEY_CLASSES_ROOT\CLSID\{11A69AE4-FBED-4832-A2BF-45AF82825583}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"cc65e58a"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{BCC73622-F72D-4277-803C-D65565A0947F}"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\efcayax]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\lpbdwcse]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winpsa32]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winwly32]


Save as CFScript.txt
Change the "Save as type" to "All Files"
Save it to the Desktop.
Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

[external image: Posted Image]


ComboFix now runs a scan on your system, and may reboot when it finishes. This is normal.

CAUTION: Do not mouse-click ComboFix while it is running. It may cause it to stall.

When finished, a log is produced.

Please provide the contents of the ComboFix log and a fresh HJT log in your next reply.
MrC
Post #13
ComboFix 07-11-08.1 - John Wright 2007-11-17 20:49:15.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1709 [GMT -6:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\John Wright\Desktop\CFScript.txt
* Created a new restore point

FILE
C:\Program Files\chadbeph\iecdpdba.dll
C:\Program Files\SpywareBlaster\hosecukyt4444.dll
C:\Program Files\SpywareBlaster\hosecukyt83122.dll
C:\WINDOWS\system32\aivskurq.dll
C:\WINDOWS\system32\byxwvuv.dll
C:\WINDOWS\system32\byxxvwt.dll
C:\WINDOWS\system32\cbxyxyv.dll
C:\WINDOWS\system32\dpqaqlqx.bin
C:\WINDOWS\system32\efcayax.dll
C:\WINDOWS\system32\fmokewgv.dll
C:\WINDOWS\system32\gantyxyr.dll
C:\WINDOWS\system32\gebywwt.dll
C:\WINDOWS\system32\grxattou.dll
C:\WINDOWS\system32\jkkjj.dll
C:\WINDOWS\system32\jmtumqko.dll
C:\WINDOWS\system32\katcvjqr.dll
C:\WINDOWS\system32\lmjjegav.exe
C:\WINDOWS\system32\lpbdwcse.dll
C:\WINDOWS\system32\oxrbvcyv.dll
C:\WINDOWS\system32\qopbreqy.dll
C:\WINDOWS\system32\stfv.bin
C:\WINDOWS\system32\unluqwiu.dll
C:\WINDOWS\system32\vvmhfqfl.dll
C:\WINDOWS\system32\vvskwiqs.dll
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\chadbeph
C:\Program Files\chadbeph\iecdpdba.dll
C:\Program Files\SpywareBlaster\hosecukyt4444.dll
C:\Program Files\SpywareBlaster\hosecukyt83122.dll

.
((((((((((((((((((((((((( Files Created from 2007-10-18 to 2007-11-18 )))))))))))))))))))))))))))))))
.

2007-11-18 16:30 51,200 –a—— C:\WINDOWS\NirCmd.exe
2007-11-17 12:47 188,960 –a—— C:\WINDOWS\system32\WINGDE.DLL
2007-11-17 12:47 92,208 –a—— C:\WINDOWS\system32\WING.DLL
2007-11-17 12:47 12,800 –a—— C:\WINDOWS\system32\wing32.dll
2007-11-16 17:27 d——– C:\WINDOWS\system32\CatRoot2
2007-11-13 13:49 161,344 –a—— C:\Documents and Settings\John Wright\Application Data\trant.exe
2007-11-12 19:47 d——– C:\Program Files\E404 Helper
2007-11-11 22:20 d–h—– C:\WINDOWS\system32\GroupPolicy
2007-11-11 10:58 d–hs—- C:\WINDOWS\Sm9obiBXcmlnaHQ
2007-11-11 09:14 d——– C:\Program Files\Lavasoft
2007-11-11 09:14 d——– C:\Documents and Settings\All Users\Application Data\Lavasoft
2007-11-11 06:51 d——– C:\WINDOWS\system32\rMa06yy
2007-11-11 06:51 d——– C:\Temp\abW9
2007-11-11 06:51 d——– C:\Temp
2007-11-08 17:50 d——– C:\Program Files\Replay Converter
2007-11-08 17:35 134 –a—— C:\n.bat
2007-11-08 17:35 0 –a—— C:\z.dat
2007-11-08 17:35 0 –a—— C:\x.dat
2007-11-08 16:54 d——– C:\Program Files\Common Files\xing shared

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-18 22:36 ——— d—–w C:\Program Files\Astonsoft
2007-11-18 02:50 ——— d—–w C:\Program Files\SpywareBlaster
2007-11-16 23:26 ——— d—–w C:\Program Files\XoftSpySE
2007-11-13 01:43 ——— d—a-w C:\Documents and Settings\All Users\Application Data\TEMP
2007-11-13 01:43 ——— d—–w C:\Program Files\Google
2007-11-11 15:49 ——— d—–w C:\Documents and Settings\John Wright\Application Data\Uniblue
2007-11-11 15:13 ——— d—–w C:\Program Files\Common Files\Wise Installation Wizard
2007-11-11 13:49 ——— d—–w C:\Program Files\Real
2007-11-11 13:22 ——— d—–w C:\Program Files\Yahoo!
2007-11-11 13:09 ——— d–h–w C:\Program Files\InstallShield Installation Information
2007-11-11 12:44 ——— d—–w C:\Program Files\Common Files\Adobe
2007-11-11 12:43 ——— d—–w C:\Documents and Settings\John Wright\Application Data\Lavasoft
2007-11-08 23:02 36,624 ——w C:\WINDOWS\system32\drivers\PxHelp20.sys
2007-11-08 23:02 2,560 ——w C:\WINDOWS\system32\drivers\cdralw2k.sys
2007-11-08 23:02 2,432 ——w C:\WINDOWS\system32\drivers\cdr4_xp.sys
2007-10-05 20:36 ——— d—–w C:\Program Files\Java
2007-09-23 21:56 ——— d—–w C:\Program Files\Bejeweled 2 Deluxe
2007-09-21 03:21 ——— d—–w C:\Documents and Settings\John Wright\Application Data\LinkedIn
2007-01-04 23:53 93,509 —-a-w C:\Documents and Settings\John Wright\install.exe
2005-04-16 04:59 1,613 —-a-w C:\Program Files\uninstal.log
2005-07-29 22:24:26 472 –sha-r C:\WINDOWS\Sm9obiBXcmlnaHQ\mA6Cv21rwA5BuJk.vbs
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-01-22 09:10]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-11-08 16:54]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:56]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"swg"=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoRecentDocsMenu"=0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="C:\\WINDOWS\\system32\\vvgeowbv.exe,C:\\WINDOWS\\system32\\userinit.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^John Wright^Start Menu^Programs^Startup^TA_Start.lnk]
backup=C:\WINDOWS\pss\TA_Start.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^John Wright^Start Menu^Programs^Startup^Think-Adz.lnk]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ExploreUpdSched]

R2 IOPort;IOPort;\??\C:\WINDOWS\system32\DRIVERS\IOPORT.SYS
R3 LCcfltr;Logitech USB Filter Driver;C:\WINDOWS\system32\Drivers\LCcFltr.Sys
R3 P17;Sound Blaster Live! 24-bit;C:\WINDOWS\system32\drivers\P17.sys
S2 nvcap;nVidia WDM Video Capture (universal);C:\WINDOWS\system32\DRIVERS\nvcap.sys
S2 nvTUNEP;nVidia WDM TVTuner;C:\WINDOWS\system32\DRIVERS\nvtunep.sys
S2 nvtvSND;nVidia WDM TVAudio Crossbar;C:\WINDOWS\system32\DRIVERS\nvtvsnd.sys
S2 NVXBAR;nVidia WDM A/V Crossbar;C:\WINDOWS\system32\DRIVERS\NVxbar.sys
S3 3c1807pd;U.S. Robotics V.92 Fax Win Int;C:\WINDOWS\system32\DRIVERS\3c1807pd.sys
S3 SetupNTGLM7X;SetupNTGLM7X;\??\H:\NTGLM7X.sys
S3 USRpdA;U.S. Robotics 56K PCI Faxmodem Driver;C:\WINDOWS\system32\DRIVERS\USRpdA.sys

.
Contents of the 'Scheduled Tasks' folder
"2007-01-29 20:10:22 C:\WINDOWS\Tasks\RegCure.job"
- C:\Program Files\RegCure\RegCure.exe
"2007-11-18 02:52:20 C:\WINDOWS\Tasks\XoftSpySE 2.job"
- C:\Program Files\XoftSpySE\XoftSpy.exe
"2007-11-17 09:04:05 C:\WINDOWS\Tasks\XoftSpySE.job"
.
**************************************************************************

catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-17 20:52:42
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-11-17 20:53:55 - machine was rebooted
C:\ComboFix2.txt … 2007-11-18 16:44
.
— E O F —
Logfile of HijackThis v1.99.1
Scan saved at 9:01:55 PM, on 11/17/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
O16 - DPF: {493ACF15-5CD9-4474-82A6-91670C3DD66E} (LinkedIn ContactFinderControl) - http://www.linkedin.com/cab/LinkedInContactFinderControl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1124667992359
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1124667976640
O16 - DPF: {A8683C98-5341-421B-B23C-8514C05354F1} (FujifilmUploader Class) - http://photo.walmart.com/photo/uploads/Fuj…ploadClient.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
Post #14
You did GOOD!

———————–

Please keep in mind that there's restrictions placed on your IEs control panel.
If you put them there OK, if not just have HJT fix these two:

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present

——————————–

Delete this file if found:

C:\WINDOWS\system32\vvgeowbv.exe

——————-

Do you know what this folder and file are for?

C:\WINDOWS\Sm9obiBXcmlnaHQ<—folder
C:\WINDOWS\Sm9obiBXcmlnaHQ\mA6Cv21rwA5BuJk.vbs<—file in it

———————–

Download the Registry Search Tool at this link:
http://www.billsway.com/vbspage/ (it's about halfway down)
Unzip it and run it. (If your antivirus inteferes you may have to disable script blocking in the antivirus.) Put the following in the search box and hit OK.

vvgeowbv.exe

Post the results.

——–

Let me know, MrC

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI