Sorry for the delay. Work has been crazy. While waiting for a response to my initial post I've been searching for solutions and tried a couple. However, I was still getting lots of popups. When I run PC-cillin Adware_DigInk, Adware_EnBrowser, Troj_Vundo.WO, Troj_Agent keeps popping up even though I've deleted it previously. Still getting popups as I post this. I've run the things you suggested and the logs are below. Thanks for the help!! I really need it.
SDFix: Version 1.117
Run by Jacquelyn on Wed 12/05/2007 at 10:38 PM
Microsoft Windows XP [Version 5.1.2600]
Running From: C:\SDFix
Safe Mode:
Checking Services:
Restoring Windows Registry Values
Restoring Windows Default Hosts File
Rebooting...
Normal Mode:
Checking Files:
No Trojan Files Found
Removing Temp Files...
ADS Check:
C:\WINDOWS
No streams found.
C:\WINDOWS\system32
No streams found.
C:\WINDOWS\system32\svchost.exe
No streams found.
C:\WINDOWS\system32\ntoskrnl.exe
No streams found.
Final Check:
catchme 0.3.1262.1 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2007-12-05 22:45:37
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden services & system hive ...
scanning hidden registry entries ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0
Remaining Services:
------------------
Authorized Application Key Export:
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\\Program Files\\Palm\\HOTSYNC.EXE"="C:\\Program Files\\Palm\\HOTSYNC.EXE:*:Disabled:HotSync® Manager Application"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
Remaining Files:
---------------
Files with Hidden Attributes:
Tue 23 May 2006 88 A.SHR --- "C:\i386\EB62764080.sys"
Tue 23 May 2006 2,828 A.SH. --- "C:\i386\KGyGaAvL.sys"
Wed 20 Dec 2006 104 ..SHR --- "C:\WINDOWS\system32\80407662EB.sys"
Fri 14 Sep 2007 88 ..SHR --- "C:\WINDOWS\system32\EB62764080.sys"
Fri 14 Sep 2007 7,518 A.SH. --- "C:\WINDOWS\system32\KGyGaAvL.sys"
Thu 29 Jun 2006 575,488 ...H. --- "C:\Documents and Settings\Jacquelyn\Desktop\~WRL1099.tmp"
Thu 15 Feb 2007 36,864 ...H. --- "C:\Documents and Settings\Jacquelyn\Desktop\~WRL1221.tmp"
Sat 20 Nov 2004 35,328 A..H. --- "C:\Documents and Settings\Jacquelyn\Desktop\JOBS\~WRL2936.tmp"
Sun 12 Dec 2004 47,104 A..H. --- "C:\Documents and Settings\Jacquelyn\Desktop\JOBS\~WRL3607.tmp"
Mon 26 Jun 2006 28,160 A..H. --- "C:\Documents and Settings\Jacquelyn\Desktop\JOBS\Job Applications\2006\~WRL1930.tmp"
Mon 26 Jun 2006 19,968 A..H. --- "C:\Documents and Settings\Jacquelyn\Desktop\JOBS\Job Applications\2006\~WRL3003.tmp"
Mon 26 Jun 2006 28,672 A..H. --- "C:\Documents and Settings\Jacquelyn\Desktop\JOBS\Job Applications\2006\~WRL3933.tmp"
Tue 11 Apr 2006 27,648 A..H. --- "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\DV421 HIV and emerging threats\~WRL0003.tmp"
Mon 22 May 2006 46,592 A..H. --- "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\DV421 HIV and emerging threats\~WRL2303.tmp"
Mon 22 May 2006 34,816 A..H. --- "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\DV421 HIV and emerging threats\~WRL2899.tmp"
Wed 8 Mar 2006 35,840 A..H. --- "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\EH411 Epidemics\~WRL0752.tmp"
Thu 9 Mar 2006 44,544 A..H. --- "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\EH411 Epidemics\~WRL1510.tmp"
Tue 2 May 2006 344,064 A..H. --- "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\EH411 Epidemics\~WRL1530.tmp"
Tue 2 May 2006 288,768 A..H. --- "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\EH411 Epidemics\~WRL1559.tmp"
Tue 2 May 2006 397,312 A..H. --- "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\EH411 Epidemics\~WRL1663.tmp"
Tue 2 May 2006 296,960 A..H. --- "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\EH411 Epidemics\~WRL1743.tmp"
Thu 9 Mar 2006 47,104 A..H. --- "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\EH411 Epidemics\~WRL1786.tmp"
Tue 2 May 2006 296,448 A..H. --- "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\EH411 Epidemics\~WRL1807.tmp"
Thu 9 Mar 2006 44,032 A..H. --- "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\EH411 Epidemics\~WRL2319.tmp"
Thu 9 Mar 2006 46,592 A..H. --- "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\EH411 Epidemics\~WRL2883.tmp"
Tue 2 May 2006 264,704 A..H. --- "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\EH411 Epidemics\~WRL3375.tmp"
Thu 9 Mar 2006 43,520 A..H. --- "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\EH411 Epidemics\~WRL3847.tmp"
Tue 2 May 2006 380,416 A..H. --- "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\EH411 Epidemics\~WRL3937.tmp"
Wed 3 May 2006 74,240 A..H. --- "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\Personal revision\~WRL1393.tmp"
Wed 3 May 2006 84,480 A..H. --- "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\Personal revision\~WRL2253.tmp"
Tue 2 May 2006 78,848 A..H. --- "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\Personal revision\~WRL2359.tmp"
Tue 2 May 2006 50,688 A..H. --- "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\Personal revision\~WRL2398.tmp"
Wed 3 May 2006 104,448 A..H. --- "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\Personal revision\~WRL2591.tmp"
Tue 2 May 2006 64,512 A..H. --- "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\Personal revision\~WRL2872.tmp"
Wed 3 May 2006 89,088 A..H. --- "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\Personal revision\~WRL3462.tmp"
Tue 2 May 2006 69,120 A..H. --- "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\Personal revision\~WRL3558.tmp"
Tue 2 May 2006 69,120 A..H. --- "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\Personal revision\~WRL3675.tmp"
Tue 2 May 2006 57,856 A..H. --- "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\Personal revision\~WRL3759.tmp"
Wed 3 May 2006 102,400 A..H. --- "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\Personal revision\~WRL4034.tmp"
Tue 25 Apr 2006 25,600 A..H. --- "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\SO455 BIOS\~WRL0123.tmp"
Tue 25 Apr 2006 26,624 A..H. --- "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\SO455 BIOS\~WRL0124.tmp"
Tue 25 Apr 2006 23,552 A..H. --- "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\SO455 BIOS\~WRL0199.tmp"
Tue 25 Apr 2006 19,968 A..H. --- "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\SO455 BIOS\~WRL0235.tmp"
Tue 25 Apr 2006 32,768 A..H. --- "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\SO455 BIOS\~WRL1390.tmp"
Tue 25 Apr 2006 27,648 A..H. --- "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\SO455 BIOS\~WRL1978.tmp"
Tue 25 Apr 2006 36,864 A..H. --- "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\SO455 BIOS\~WRL2317.tmp"
Sat 15 Apr 2006 42,496 A..H. --- "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\SO455 BIOS\~WRL2948.tmp"
Wed 19 Apr 2006 64,000 A..H. --- "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\SO455 BIOS\~WRL3116.tmp"
Tue 25 Apr 2006 29,696 A..H. --- "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\SO455 BIOS\~WRL3149.tmp"
Tue 25 Apr 2006 24,064 A..H. --- "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\SO455 BIOS\~WRL3167.tmp"
Tue 25 Apr 2006 26,624 A..H. --- "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\SO455 BIOS\~WRL3694.tmp"
Tue 25 Apr 2006 19,968 A..H. --- "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\SO455 BIOS\~WRL3969.tmp"
Wed 14 Mar 2007 30,208 ...H. --- "C:\Documents and Settings\Jacquelyn\Desktop\JOBS\Job Applications\2007\Abt Associates\~WRL0005.tmp"
Tue 7 Dec 2004 27,136 A..H. --- "C:\Documents and Settings\Jacquelyn\My Documents\School\BUCKNELL\Fall 2004\hinduism\~WRL0001.tmp"
Wed 3 May 2006 74,240 A..H. --- "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\EH411 Epidemics\Personal revision\~WRL1393.tmp"
Wed 3 May 2006 84,480 A..H. --- "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\EH411 Epidemics\Personal revision\~WRL2253.tmp"
Tue 2 May 2006 78,848 A..H. --- "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\EH411 Epidemics\Personal revision\~WRL2359.tmp"
Tue 2 May 2006 50,688 A..H. --- "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\EH411 Epidemics\Personal revision\~WRL2398.tmp"
Wed 3 May 2006 104,448 A..H. --- "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\EH411 Epidemics\Personal revision\~WRL2591.tmp"
Tue 2 May 2006 64,512 A..H. --- "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\EH411 Epidemics\Personal revision\~WRL2872.tmp"
Wed 3 May 2006 89,088 A..H. --- "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\EH411 Epidemics\Personal revision\~WRL3462.tmp"
Tue 2 May 2006 69,120 A..H. --- "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\EH411 Epidemics\Personal revision\~WRL3558.tmp"
Tue 2 May 2006 69,120 A..H. --- "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\EH411 Epidemics\Personal revision\~WRL3675.tmp"
Tue 2 May 2006 57,856 A..H. --- "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\EH411 Epidemics\Personal revision\~WRL3759.tmp"
Wed 3 May 2006 102,400 A..H. --- "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\EH411 Epidemics\Personal revision\~WRL4034.tmp"
Sat 15 Sep 2007 8 A..H. --- "C:\Documents and Settings\Daniel\Application Data\Gtek\GTUpdate\AUpdate\Channels\ch_u1\lock.tmp"
Sat 15 Sep 2007 8 A..H. --- "C:\Documents and Settings\Daniel\Application Data\Gtek\GTUpdate\AUpdate\Channels\ch_u2\lock.tmp"
Sat 15 Sep 2007 8 A..H. --- "C:\Documents and Settings\Daniel\Application Data\Gtek\GTUpdate\AUpdate\Channels\ch_u3\lock.tmp"
Sat 15 Sep 2007 8 A..H. --- "C:\Documents and Settings\Daniel\Application Data\Gtek\GTUpdate\AUpdate\Channels\ch_u4\lock.tmp"
Fri 13 Apr 2007 8 A..H. --- "C:\Documents and Settings\Jacquelyn\Application Data\Gtek\GTUpdate\AUpdate\Channels\ch_u1\lock.tmp"
Fri 13 Apr 2007 8 A..H. --- "C:\Documents and Settings\Jacquelyn\Application Data\Gtek\GTUpdate\AUpdate\Channels\ch_u2\lock.tmp"
Sat 14 Apr 2007 8 A..H. --- "C:\Documents and Settings\Jacquelyn\Application Data\Gtek\GTUpdate\AUpdate\Channels\ch_u3\lock.tmp"
Fri 20 Apr 2007 8 A..H. --- "C:\Documents and Settings\Jacquelyn\Application Data\Gtek\GTUpdate\AUpdate\Channels\ch_u4\lock.tmp"
Finished!
-------------------------------------------------------------------
ComboFix 07-12-02.6 - Jacquelyn 2007-12-05 22:50:54.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.92 [GMT -5:00]
Running from: C:\Documents and Settings\Jacquelyn\Desktop\ComboFix.exe
.
((((((((((((((((((((((((( Files Created from 2007-11-06 to 2007-12-06 )))))))))))))))))))))))))))))))
.
2007-12-05 22:50 . 2007-12-05 22:50 268 --ah----- C:\sqmdata14.sqm
2007-12-05 22:50 . 2007-12-05 22:50 244 --ah----- C:\sqmnoopt14.sqm
2007-12-05 22:37 . 2007-12-05 22:38 <DIR> d-------- C:\WINDOWS\ERUNT
2007-12-05 21:56 . 2007-12-05 21:56 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Grisoft
2007-12-05 20:25 . 2007-12-05 20:25 268 --ah----- C:\sqmdata13.sqm
2007-12-05 20:25 . 2007-12-05 20:25 244 --ah----- C:\sqmnoopt13.sqm
2007-12-03 06:49 . 2007-12-03 06:49 268 --ah----- C:\sqmdata12.sqm
2007-12-03 06:49 . 2007-12-03 06:49 244 --ah----- C:\sqmnoopt12.sqm
2007-12-02 21:08 . 2007-12-02 21:08 268 --ah----- C:\sqmdata11.sqm
2007-12-02 21:08 . 2007-12-02 21:08 244 --ah----- C:\sqmnoopt11.sqm
2007-12-02 18:40 . 2007-12-05 22:22 <DIR> d-------- C:\VundoFix Backups
2007-12-02 16:33 . 2007-12-02 17:28 <DIR> d-------- C:\Documents and Settings\Jacquelyn\.housecall6.6
2007-12-02 11:58 . 2007-12-02 11:58 268 --ah----- C:\sqmdata10.sqm
2007-12-02 11:58 . 2007-12-02 11:58 244 --ah----- C:\sqmnoopt10.sqm
2007-12-01 10:02 . 2007-12-01 10:02 268 --ah----- C:\sqmdata09.sqm
2007-12-01 10:02 . 2007-12-01 10:02 244 --ah----- C:\sqmnoopt09.sqm
2007-12-01 09:36 . 2007-12-01 09:36 268 --ah----- C:\sqmdata08.sqm
2007-12-01 09:36 . 2007-12-01 09:36 244 --ah----- C:\sqmnoopt08.sqm
2007-12-01 09:29 . 2007-12-01 09:29 268 --ah----- C:\sqmdata07.sqm
2007-12-01 09:29 . 2007-12-01 09:29 244 --ah----- C:\sqmnoopt07.sqm
2007-11-30 23:07 . 2007-11-30 23:07 <DIR> d-------- C:\Documents and Settings\Jacquelyn\Application Data\Grisoft
2007-11-30 23:06 . 2007-11-30 23:06 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2007-11-30 23:06 . 2007-05-30 07:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-11-30 22:18 . 2007-12-05 22:15 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-11-30 14:02 . 2007-11-30 14:03 <DIR> d-------- C:\Program Files\CCleaner
2007-11-30 13:34 . 2007-12-02 17:03 143 --a------ C:\WINDOWS\system32\mcrh.tmp
2007-11-30 13:07 . 2007-12-02 11:07 794,136 ---hs---- C:\WINDOWS\system32\pitelall.ini
2007-11-30 12:39 . 2007-11-30 12:39 <DIR> d-------- C:\Documents and Settings\Jacquelyn\Application Data\Uniblue
2007-11-26 22:33 . 2007-11-26 23:36 <DIR> d-------- C:\Program Files\Enigma Software Group
2007-11-26 19:54 . 2007-11-30 22:52 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Rabio
2007-11-26 19:10 . 2007-12-02 21:08 <DIR> d-------- C:\Temp
2007-11-17 13:41 . 2007-11-17 13:41 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Apple
2007-11-17 13:39 . 2004-08-10 05:00 49,680 --a------ C:\WINDOWS\twunk_16.exe
2007-11-17 13:39 . 2004-08-10 05:00 49,680 --a------ C:\WINDOWS\system32\dllcache\twunk_16.exe
2007-11-16 12:20 . 2007-11-16 12:20 208,896 --a------ C:\WINDOWS\io43mvuiw4kj.exe
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-17 18:41 --------- d-----w C:\Program Files\Apple Software Update
2007-11-06 01:22 --------- d--h--w C:\Documents and Settings\Jacquelyn\Application Data\Move Networks
2007-10-26 03:34 8,460,288 ----a-w C:\WINDOWS\system32\dllcache\shell32.dll
2007-09-14 22:33 7,518 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
2007-09-12 18:52 53,248 ----a-w C:\WINDOWS\hg173.exe
2007-09-12 18:50 53,248 ----a-w C:\WINDOWS\df87173.exe
2006-07-28 13:21 251 ----a-w C:\Program Files\wt3d.ini
2006-06-16 14:27 44,608 ----a-w C:\Documents and Settings\Jacquelyn\Application Data\GDIPFONTCACHEV1.DAT
2003-08-05 15:41 53,248 ----a-w C:\WINDOWS\inf\ap561.exe
2002-11-26 20:24 32,768 ----a-w C:\WINDOWS\inf\Remove561.exe
2002-11-22 19:56 118,784 ----a-w C:\WINDOWS\inf\ShowBmp.exe
2002-10-29 22:07 36,864 ----a-w C:\WINDOWS\inf\Setup8a.exe
2002-10-01 18:43 119,798 ----a-w C:\WINDOWS\inf\spca561.sys
2006-12-20 18:50 104 --sh--r C:\WINDOWS\system32\80407662EB.sys
.
((((((((((((((((((((((((((((( snapshot@2007-12-02_21.14.04.82 )))))))))))))))))))))))))))))))))))))))))
.
+ 2007-12-06 01:19:42 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE
+ 2007-12-06 03:38:26 5,156,864 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\
00000001\NTUSER.DAT
+ 2007-12-06 03:38:27 143,360 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\
00000002\UsrClass.dat
+ 2007-12-06 01:19:42 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE
+ 2007-12-06 03:38:08 5,156,864 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\
00000001\NTUSER.DAT
+ 2007-12-06 03:38:08 143,360 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\
00000002\UsrClass.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"OE_OEM"="C:\Program Files\Trend Micro\Internet Security 14\TMAS_OE\TMAS_OEMon.exe" [2006-11-01 10:08]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-10 05:00]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 11:54]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2005-09-29 14:01]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-10-14 20:49]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-10-14 20:46]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-10-14 20:50]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2005-11-29 04:56]
"IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [2004-10-30 14:59]
"SigmatelSysTrayApp"="stsystra.exe" [2005-09-09 23:19 C:\WINDOWS\stsystra.exe]
"DMXLauncher"="C:\Program Files\Dell\Media Experience\DMXLauncher.exe" [2005-10-05 03:12]
"Dell QuickSet"="C:\Program Files\Dell\QuickSet\quickset.exe" [2005-12-15 10:44]
"ShowLOMControl"="1 (0x1)" []
"ISUSPM Startup"="C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-06-10 10:44]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-06-10 10:44]
"DLA"="C:\WINDOWS\System32\DLA\DLACTRLW.EXE" [2005-09-08 05:20]
"PrinTray"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\2\printray.exe" [2000-06-07 12:32]
"LXSUPMON"="C:\WINDOWS\system32\LXSUPMON.exe" [2000-06-07 13:01]
"LexStart"="lexstart.exe" []
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 08:41]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-05-26 11:45]
"pccguide.exe"="C:\Program Files\Trend Micro\Internet Security 14\pccguide.exe" [2006-12-15 17:51]
"io43mvuiw4kj"="C:\WINDOWS\io43mvuiw4kj.exe" [2007-11-16 12:20]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 21:05:26]
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2006-05-01 01:16:55]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-12 20:01:04]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless]
C:\Program Files\Intel\Wireless\Bin\LgNotify.dll 2004-09-07 16:08 110592 C:\Program Files\Intel\Wireless\Bin\LgNotify.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"= c:\windows\system32\ldcore.dll
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}]
\Shell\AutoRun\command - E:\setup.exe
.
Contents of the 'Scheduled Tasks' folder
"2007-11-17 18:41:08 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************
catchme 0.3.1318 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2007-12-05 22:52:40
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2007-12-05 22:53:22
C:\ComboFix2.txt ... 2007-12-02 21:14
.
--- E O F ---
Logfile of HijackThis v1.99.1
Scan saved at 10:54:20 PM, on 12/5/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\WINDOWS\system32\dllhost.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PccGuide.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Dell\Media Experience\DMXLauncher.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\WINDOWS\system32\LXSUPMON.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\io43mvuiw4kj.exe
C:\Program Files\Trend Micro\Internet Security 14\TMAS_OE\TMAS_OEMon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Jacquelyn\My Documents\HJT log\HJT.EXE.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
http://go.microsoft....k/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [ShowLOMControl]
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\2\printray.exe
O4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\system32\LXSUPMON.EXE RUN
O4 - HKLM\..\Run: [LexStart] lexstart.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 14\pccguide.exe"
O4 - HKLM\..\Run: [io43mvuiw4kj] C:\WINDOWS\io43mvuiw4kj.exe
O4 - HKCU\..\Run: [OE_OEM] "C:\Program Files\Trend Micro\Internet Security 14\TMAS_OE\TMAS_OEMon.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) -
http://housecall65.t...ivex/hcImpl.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) -
http://www2.snapfish...fishActivia.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - AppInit_DLLs: c:\windows\system32\ldcore.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: IntelWireless - C:\Program Files\Intel\Wireless\Bin\LgNotify.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
O23 - Service: WLANKEEPER - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe