Spyware / Malware / Virus Removal

[Closed] Helo

13 min read

Looking for the outcome? Ask AI

hdmanley Topic Starter

Post #1December 2, 2007, 2:51 AM UTC

My computer just went crazy. whatever the problem was latched itself onto my COX SECURITY SUITE, YAHOO MESSENGER, and several other programs and stopped them from running altogether. At start up it says that the components could not be found. Try reinstalling to see if that fixes the problem. I have and nothing. I have used spy sweeper but after restarting the program fails. I have used viruskeeper 2007, multi virus cleaner 2007 and a few others and they are not detecting what trojan remover has. Can you please help me.

This is a log of the Hijack this scan

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:44:53 PM, on 12/1/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\DOCUME~1\DA967~1.JAN\LOCALS~1\Temp\ctfmon.exe
C:\DOCUME~1\DA967~1.JAN\LOCALS~1\Temp\SearchProtection.exe
c:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://awesomehomepage.com/newsletter.php?list=laughnetwork
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer Provided by Cox High Speed Internet
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exe
O3 - Toolbar: (no name) - {2C0A5F28-48D8-408B-9172-9C6121025BCE} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Security Toolbar - {11A69AE4-FBED-4832-A2BF-45AF82825583} - C:\WINDOWS\SYSTEM32\AMRRVTHR.DLL (file missing)
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [MSKDetectorExe] "C:\Program Files\McAfee\SpamKiller\MSKDetct.exe" /uninstall
O4 - HKLM\..\Run: [YSearchProtection] "C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] C:\WINDOWS\system32\dumprep 0 -k
O4 - HKLM\..\Run: [Host Process] C:\WINDOWS\Fonts\svchost.exe
O4 - HKLM\..\Run: [SoftwareStation] "C:\Program Files\eAcceleration\Station\station.exe" /b Startup
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [VirusKeeper] C:\DOCUME~1\DA967~1.JAN\LOCALS~1\Temp\VirusKeeper.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [WinUpdater] "C:\Program Files\WinUpdater\update.exe" /background
O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [YSearchProtection] "C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe"
O4 - HKCU\..\Run: [AdobeUpdater] "C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe"
O4 - HKCU\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user')
O4 - Global Startup: ymetray.lnk = C:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/…arch.jhtml?p=ZK
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Panda ActiveScan - {653D93AF-C741-4e5e-8C1B-59BA43F93E16} - http://www.pandasoftware.com/activescan (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\D.J and Heather\Start Menu\Programs\IMVU\Run IMVU.lnk (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://support.cox.com/sdccommon/download/tgctlcm.cab
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=58813
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15030/CTSUEng.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1A1F56AA-3401-46F9-B277-D57F3421F821} (FunGamesLoader Object) - http://www.worldwinner.com/games/v46/share…GamesLoader.cab
O16 - DPF: {1B4F9DD7-2D7C-44B5-9126-73206DA0AE75} (CNavigationManager Object) - http://www3.authentium.com/cssrelease/bin/wizard.exe
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/f…p1.0.0.15-3.cab
O16 - DPF: {2C153C75-8476-434B-B3C3-57B63A3D1939} (Brickout Control) - http://www.worldwinner.com/games/v48/brickout/brickout.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst20040510.cab
O16 - DPF: {33E54F7F-561C-49E6-929B-D7E76D3AFEB1} (Pool Control) - http://www.worldwinner.com/games/v50/pool/pool.cab
O16 - DPF: {45A0A292-ECC6-4D8F-9EA9-A4BD411D24C1} (king.com) - http://www.king.com/ctl/kingcomie.cab
O16 - DPF: {6C6FE41A-0DA6-42A1-9AD8-792026B2B2A7} (FreeCell Control) - http://www.worldwinner.com/games/v41/freecell/freecell.cab
O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - http://www.worldwinner.com/games/shared/wwlaunch.cab
O16 - DPF: {9903F4ED-B673-456A-A15F-ED90C7DE9EF5} (Sol Control) - http://www.worldwinner.com/games/v46/sol/sol.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {A2E05F45-F127-4092-B9F7-9A02C3E04C77} (HGPlugin7USA Class) - http://gamedownload.ijjimax.com/gamedownlo…GPlugin7USA.cab
O16 - DPF: {BB383206-6DA1-4E80-B62A-3DF950FCC697} (Create & Print ActiveX Plug-in) - http://ak.imgag.com/imgag/cp/install/AxCtp2.cab
O16 - DPF: {C93C1C34-CEA9-49B1-9046-040F59E0E0D8} (Paint Control) - http://www.worldwinner.com/games/v43/paint/paint.cab
O16 - DPF: {CC32D4D8-2A0B-4CEB-B105-C9B968379105} (CGameManagerCtrl Object) - https://disney.go.com/games/downloads/gamem…GameManager.cab
O16 - DPF: {CF969D51-F764-4FBF-9E90-475248601C8A} (FamilyFeud Control) - http://www.worldwinner.com/games/v47/famil…/familyfeud.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://clubgames.pogo.com/online2/pogop/ch…aploader_v6.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15030/CTPID.cab
O16 - DPF: {FFFFFFFF-CACE-BABE-BABE-00AA0055595A} - http://www.trueswitch.com/sbcyahoo/TrueInstallSBC.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: DvpApi (dvpapi) - Authentium, Inc. - c:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe
O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O24 - Desktop Component 0: (no name) - C:\Program Files\Windows NT\profsyvyr.html

–
End of file - 11177 bytes

bob4

Post #2December 2, 2007, 11:22 AM UTC

_________________________________
Welcome to the Forums.

The fixes we will use are specific to your problems and should only be used for this issue on this machine.

Please only use this topic to reply to. Do not start another thread.
If any other issues arise let me know.
The process is not instant. Please continue to review my answers until I tell you your machine is clear. Absence of symptoms does not mean that everything is clear. So lets do this to the end!

All hijackthis logs I ask for should be done in normal mode ( not safe mode)
These logs should be done last after you have followed my instructions in the previous post.

Please if you decide to seek help at another forum let us know. There is a shortage of helpers and tying 2 of us up is a waste of time.
If you have any questions about any advice given here please STOP and ask!

Please print these out as some of this may require a reboot.

_____________________________
Anti Virus
You seem to be running two (2) AQntivirus programs. This is a bad idea. Running two Anti virus programs will cause conflicts and provide you with much less protection.
I would remove one through add/remove priograms. It's up to you which you keep.
Authentium\AntiVirus

___________________________________________________
EAcceleration..
I would remove this program through add remove programs.

See. this note

_______________________
My web search

remove it through add/remove programs.
it has malware in it.

______________________________
HJT
Run hijackthis and choose scan only and place a check by the following lines if present.
Close all other windows and browsers except HJT before clicking on Fix Checked

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://awesomehomepage.com/newsletter.php?list=laughnetwork
O3 - Toolbar: (no name) - {2C0A5F28-48D8-408B-9172-9C6121025BCE} - (no file)
O3 - Toolbar: Security Toolbar - {11A69AE4-FBED-4832-A2BF-45AF82825583} - C:\WINDOWS\SYSTEM32\AMRRVTHR.DLL (file missing)
O4 - HKLM\..\Run: [KernelFaultCheck] C:\WINDOWS\system32\dumprep 0 -k
O4 - HKLM\..\Run: [Host Process] C:\WINDOWS\Fonts\svchost.exe
O4 - HKLM\..\Run: [SoftwareStation] "C:\Program Files\eAcceleration\Station\station.exe" /b Startup
O4 - HKCU\..\Run: [WinUpdater] "C:\Program Files\WinUpdater\update.exe" /background
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/…arch.jhtml?p=ZK
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/f…p1.0.0.15-3.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://clubgames.pogo.com/online2/pogop/ch…aploader_v6.cab
O16 - DPF: {BB383206-6DA1-4E80-B62A-3DF950FCC697} (Create & Print ActiveX Plug-in) - http://ak.imgag.com/imgag/cp/install/AxCtp2.cab
O24 - Desktop Component 0: (no name) - C:\Program Files\Windows NT\profsyvyr.html

________________________________________________________

1. Download Combo fix from one of these locations. ( Please save it to your desktop )
http://www.techsupportforum.com/sectools/sUBs/ComboFix.exe
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

DO NOT USE IT JUST YET,

________________________________________
Open notepad and copy/paste the text in the quotebox below into it:

File::
C:\Program Files\Windows NT\profsyvyr.html

Folder::
C:\Program Files\WinUpdater

open Control Panel > Network Connections.
Right click onyour Network icons & select "Repair"

[external image: Posted Image]

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

_________________________
In your next reply I would like to see:

A new HJT log
The report from ComboFix

hdmanley

Post #3December 2, 2007, 4:49 PM UTC

Thank you so much for your help. Here are the logs that you wanted. The first is the High Jack this and the 2nd is the combo fix.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:48:19 AM, on 12/2/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe
C:\DOCUME~1\DA967~1.JAN\LOCALS~1\Temp\SearchProtection.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\DOCUME~1\DA967~1.JAN\LOCALS~1\Temp\ctfmon.exe
c:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
F3 - REG:win.ini: load=C:\WINDOWS\system32\awvvt.exe
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [MSKDetectorExe] "C:\Program Files\McAfee\SpamKiller\MSKDetct.exe" /uninstall
O4 - HKLM\..\Run: [YSearchProtection] "C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [YSearchProtection] "C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe"
O4 - HKCU\..\Run: [AdobeUpdater] "C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe"
O4 - HKCU\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user')
O4 - Global Startup: ymetray.lnk = C:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\D.J and Heather\Start Menu\Programs\IMVU\Run IMVU.lnk (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://support.cox.com/sdccommon/download/tgctlcm.cab
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=58813
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15030/CTSUEng.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1A1F56AA-3401-46F9-B277-D57F3421F821} (FunGamesLoader Object) - http://www.worldwinner.com/games/v46/share…GamesLoader.cab
O16 - DPF: {1B4F9DD7-2D7C-44B5-9126-73206DA0AE75} (CNavigationManager Object) - http://www3.authentium.com/cssrelease/bin/wizard.exe
O16 - DPF: {2C153C75-8476-434B-B3C3-57B63A3D1939} (Brickout Control) - http://www.worldwinner.com/games/v48/brickout/brickout.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst20040510.cab
O16 - DPF: {33E54F7F-561C-49E6-929B-D7E76D3AFEB1} (Pool Control) - http://www.worldwinner.com/games/v50/pool/pool.cab
O16 - DPF: {45A0A292-ECC6-4D8F-9EA9-A4BD411D24C1} (king.com) - http://www.king.com/ctl/kingcomie.cab
O16 - DPF: {6C6FE41A-0DA6-42A1-9AD8-792026B2B2A7} (FreeCell Control) - http://www.worldwinner.com/games/v41/freecell/freecell.cab
O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - http://www.worldwinner.com/games/shared/wwlaunch.cab
O16 - DPF: {9903F4ED-B673-456A-A15F-ED90C7DE9EF5} (Sol Control) - http://www.worldwinner.com/games/v46/sol/sol.cab
O16 - DPF: {A2E05F45-F127-4092-B9F7-9A02C3E04C77} (HGPlugin7USA Class) - http://gamedownload.ijjimax.com/gamedownlo…GPlugin7USA.cab
O16 - DPF: {C93C1C34-CEA9-49B1-9046-040F59E0E0D8} (Paint Control) - http://www.worldwinner.com/games/v43/paint/paint.cab
O16 - DPF: {CC32D4D8-2A0B-4CEB-B105-C9B968379105} (CGameManagerCtrl Object) - https://disney.go.com/games/downloads/gamem…GameManager.cab
O16 - DPF: {CF969D51-F764-4FBF-9E90-475248601C8A} (FamilyFeud Control) - http://www.worldwinner.com/games/v47/famil…/familyfeud.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15030/CTPID.cab
O16 - DPF: {FFFFFFFF-CACE-BABE-BABE-00AA0055595A} - http://www.trueswitch.com/sbcyahoo/TrueInstallSBC.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: DvpApi (dvpapi) - Authentium, Inc. - c:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe
O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

–
End of file - 8791 bytes

ComboFix 07-12-02.5 - D.J and Heather 2007-12-02 9:58:58.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.83 [GMT -6:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\D.J and Heather\Desktop\cfscript.txt
* Created a new restore point

FILE
C:\Program Files\Windows NT\profsyvyr.html
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Start Menu\Live Safety Center.lnk
C:\Documents and Settings\All Users\Start Menu\Online Security Guide.lnk
C:\Documents and Settings\D.J and Heather\Application Data\FunWebProducts
C:\Documents and Settings\D.J and Heather\Desktop\Live Safety Center.lnk
C:\Documents and Settings\D.J and Heather\Desktop\Online Security Guide.lnk
C:\Documents and Settings\D.J and Heather\Favorites\Online Security Guide.lnk
C:\Program Files\FunWebProducts
C:\Program Files\MyWebSearch
C:\Program Files\Temporary
C:\Program Files\WinUpdater
C:\Program Files\WinUpdater\Temp\license.txt
C:\Program Files\WinUpdater\update.exe
C:\WINDOWS\Fonts\a.zip
C:\WINDOWS\system32\awvvt.dll
C:\WINDOWS\system32\drivers\core.cache.dsk
C:\WINDOWS\system32\pac.txt
C:\WINDOWS\system32\tvvwa.ini
C:\WINDOWS\system32\tvvwa.ini2
C:\WINDOWS\system32\UpMedia
C:\winlogon.exe
C:\x.dat
C:\z.dat
C:\WINDOWS\Fonts\'

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
——-\LEGACY_DOMAINSERVICE
——-\DomainService

((((((((((((((((((((((((( Files Created from 2007-11-02 to 2007-12-02 )))))))))))))))))))))))))))))))
.

2007-12-01 21:48 . 2007-12-01 21:48 d——– C:\VundoFix Backups
2007-12-01 20:58 . 2007-12-02 10:02 333,312 –a—— C:\WINDOWS\system32\awvvt.exe
2007-12-01 20:39 . 2007-12-01 20:39 d——– C:\Program Files\Trend Micro
2007-12-01 20:34 . 2007-12-02 09:45 d——– C:\Program Files\SUPERAntiSpyware
2007-12-01 20:34 . 2007-12-01 20:34 d——– C:\Documents and Settings\D.J and Heather\Application Data\SUPERAntiSpyware.com
2007-12-01 20:34 . 2007-12-01 20:34 d——– C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2007-12-01 00:01 . 2007-12-01 00:01 d——– C:\Program Files\Common Files\Scanner
2007-11-30 23:42 . 2007-11-30 23:42 d–h—– C:\WINDOWS\$hf_mig$
2007-11-30 22:26 . 2007-12-02 09:46 d——– C:\Program Files\AxBx
2007-11-30 22:22 . 2007-11-30 22:22 d——– C:\Program Files\Digital Locker Assistant
2007-11-30 22:09 . 2007-12-02 10:02 d——– C:\Program Files\Windows Defender
2007-11-30 22:03 . 2007-12-01 20:21 333,312 –a—— C:\WINDOWS\system32\delete
2007-11-30 21:24 . 2007-11-30 23:37 6,928 –ahs—- C:\WINDOWS\system32\tvvwa.ini2.ren
2007-11-30 20:59 . 2007-10-01 16:24 23,864 –a—— C:\WINDOWS\system32\drivers\sskbfd.sys
2007-11-30 20:49 . 2007-08-13 18:54 33,792 –a—— C:\WINDOWS\system32\dllcache\custsat.dll
2007-11-30 18:42 . 2007-11-30 18:42 d——– C:\Documents and Settings\D.J and Heather\Application Data\eAcceleration
2007-11-30 18:09 . 2007-11-30 18:09 71,232 –a—— C:\WINDOWS\system32\cnmdyuvx.exe .ren
2007-11-29 20:38 . 2007-11-29 20:38 d——– C:\Documents and Settings\D.J and Heather\Application Data\Skype
2007-11-29 18:57 . 2007-11-29 18:57 d——– C:\Program Files\ReflexiveArcade
2007-11-29 17:20 . 2007-11-29 17:20 d——– C:\Documents and Settings\D.J and Heather\Application Data\Simply Super Software
2007-11-29 17:13 . 2007-11-30 18:41 d——– C:\Program Files\eAcceleration
2007-11-29 17:10 . 2007-11-29 17:10 333,312 –a—— C:\WINDOWS\system32\RCX50.tmp
2007-11-29 17:02 . 2007-11-29 17:02 d——– C:\WINDOWS\McAfee.com
2007-11-29 16:41 . 2007-11-30 23:46 164 –a—— C:\install.dat
2007-11-29 16:37 . 2007-11-29 16:37 333,312 –a—— C:\WINDOWS\system32\RCX44.tmp
2007-11-29 16:25 . 2007-11-29 16:25 333,312 –a—— C:\WINDOWS\system32\RCX42.tmp
2007-11-29 16:08 . 2007-11-29 16:08 d——– C:\Program Files\Common Files\Authentium
2007-11-29 15:56 . 2007-11-29 15:56 333,312 –a—— C:\WINDOWS\system32\RCX49.tmp
2007-11-29 15:53 . 2007-11-29 16:08 d——– C:\Program Files\Common Files\Aluria(2)
2007-11-29 15:46 . 2007-11-29 15:46 333,312 –a—— C:\WINDOWS\system32\RCX43.tmp
2007-11-29 15:35 . 2007-11-30 23:39 6,928 –ahs—- C:\WINDOWS\system32\tvvwa.ini.ren
2007-11-29 15:34 . 2007-11-29 15:34 147,456 –a—— C:\WINDOWS\system32\vbzip10.dll
2007-11-29 15:27 . 2007-11-29 16:18 d——– C:\Program Files\Shockwave.com
2007-11-18 14:13 . 2007-11-18 14:13 d——– C:\Documents and Settings\D.J and Heather\Application Data\Souptoys
2007-11-07 20:14 . 2007-11-07 20:14 d——– C:\Program Files\Resource Kit
2007-11-07 19:55 . 2007-11-07 19:55 d–h—– C:\WINDOWS\system32\GroupPolicy
2007-11-04 18:18 . 2007-11-04 18:18 d——– C:\Documents and Settings\All Users\Application Data\PrettyGoodGames
2007-11-02 19:11 . 2007-11-02 19:11 d——– C:\Documents and Settings\All Users\Application Data\MinigolfAdventures

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-02 16:02 329,824 —-a-w C:\WINDOWS\system32\awvvt.dll
2007-12-02 16:02 ——— d—–w C:\Program Files\MSN Messenger
2007-12-02 02:21 ——— d—a-w C:\Documents and Settings\All Users\Application Data\TEMP
2007-12-02 02:19 ——— d—–w C:\Program Files\Common Files\Authentium Shared
2007-12-02 02:13 ——— d–h–w C:\Program Files\InstallShield Installation Information
2007-12-02 02:12 ——— d—–w C:\Program Files\MyHeritage
2007-12-02 02:09 ——— d—–w C:\Program Files\Creative
2007-12-01 06:01 ——— d—–w C:\Program Files\Yahoo!
2007-12-01 02:06 ——— d—–w C:\Program Files\BAE
2007-11-30 03:21 ——— d—–w C:\Program Files\Microsoft ActiveSync
2007-11-29 23:53 ——— d—–w C:\Program Files\Dell Support
2007-11-29 22:21 ——— d—–w C:\Program Files\Oberon Media
2007-11-29 21:35 ——— d—–w C:\Documents and Settings\D.J and Heather\Application Data\LimeWire
2007-11-29 21:30 166,945 —-a-w C:\WINDOWS\system32\drivers\core.cache(4).dsk
2007-11-29 21:30 166,945 —-a-w C:\WINDOWS\system32\drivers\core.cache(3).dsk
2007-11-29 21:30 166,945 —-a-w C:\WINDOWS\system32\drivers\core.cache(2).dsk
2007-11-29 21:30 134 —-a-w C:\n.bat
2007-11-20 22:47 ——— d—–w C:\Program Files\MySpace
2007-11-10 01:34 ——— d—–w C:\Documents and Settings\D.J and Heather\Application Data\U3
2007-10-28 00:00 ——— d–h–r C:\Documents and Settings\D.J and Heather\Application Data\yahoo!
2007-10-27 23:59 ——— d—–w C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2007-10-27 21:27 ——— d—–w C:\Documents and Settings\All Users\Application Data\yahoo!
2007-10-27 15:43 ——— d—–w C:\Program Files\PartyGaming
2007-10-26 03:34 8,460,288 —-a-w C:\WINDOWS\system32\dllcache\shell32.dll
2007-10-11 00:57 ——— d—–w C:\Documents and Settings\D.J and Heather\Application Data\Move Networks
2007-10-07 17:04 ——— d—–w C:\Documents and Settings\All Users\Application Data\HipSoft
2007-09-20 02:33 374 —-a-w C:\Documents and Settings\D.J and Heather\Application Data\internaldb6334.dat
2007-09-20 02:18 556 —-a-w C:\Documents and Settings\D.J and Heather\Application Data\internaldb8467.dat
2007-09-20 02:18 18,432 —-a-w C:\Documents and Settings\D.J and Heather\Application Data\internaldb41.dat
2007-04-25 22:21 92,064 —-a-w C:\Documents and Settings\D.J and Heather\mqdmmdm.sys
2007-04-25 22:21 9,232 —-a-w C:\Documents and Settings\D.J and Heather\mqdmmdfl.sys
2007-04-25 22:21 79,328 —-a-w C:\Documents and Settings\D.J and Heather\mqdmserd.sys
2007-04-25 22:21 66,656 —-a-w C:\Documents and Settings\D.J and Heather\mqdmbus.sys
2007-04-25 22:21 6,208 —-a-w C:\Documents and Settings\D.J and Heather\mqdmcmnt.sys
2007-04-25 22:21 5,936 —-a-w C:\Documents and Settings\D.J and Heather\mqdmwhnt.sys
2007-04-25 22:21 4,048 —-a-w C:\Documents and Settings\D.J and Heather\mqdmcr.sys
2007-04-25 22:21 25,600 —-a-w C:\Documents and Settings\D.J and Heather\usbsermptxp.sys
2007-04-25 22:21 22,768 —-a-w C:\Documents and Settings\D.J and Heather\usbsermpt.sys
2006-06-11 19:45 164 —ha-w C:\Documents and Settings\All Users\hpothb07.dat
2006-04-27 02:46 0 —ha-w C:\Documents and Settings\Guest\hpothb07.dat
2006-04-27 02:46 0 —ha-w C:\Documents and Settings\dj\hpothb07.dat
2006-04-27 02:46 0 —ha-w C:\Documents and Settings\Default User\hpothb07.dat
2006-04-27 02:46 0 —ha-w C:\Documents and Settings\D.J and Heather\hpothb07.dat
2006-07-23 20:21 104 –sh–r C:\WINDOWS\system32\1E167A62E3.sys
2006-11-23 16:47 729,295 –sha-w C:\WINDOWS\system32\cdeeg.bak1
2006-07-23 20:21 5,852 –sha-w C:\WINDOWS\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8E3FBDE2-7DBD-4040-85D9-29BBC559C129}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-10 04:00]
"H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe" []
"msnmsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-12-01 22:01]
"Creative Detector"="C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" [2007-12-01 22:01]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2007-12-01 22:01]
"YSearchProtection"="C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe" [2007-12-01 22:01]
"AdobeUpdater"="C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [2007-12-01 22:01]
"MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe" [2007-12-01 22:01]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-12-01 22:01]
"MSKDetectorExe"="C:\Program Files\McAfee\SpamKiller\MSKDetct.exe" [2007-12-02 10:02]
"YSearchProtection"="C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe" [2007-12-01 22:01]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2007-12-01 22:01]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe" [2007-12-01 22:01]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
ymetray.lnk - C:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe [2007-10-03 12:56:10]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"= msv1_0 C:\\WINDOWS\\system32\\awvvt

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 9.0 Tray Icon.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\America Online 9.0 Tray Icon.lnk
backup=C:\WINDOWS\pss\America Online 9.0 Tray Icon.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk
backup=C:\WINDOWS\pss\Digital Line Detect.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^hp psc 2000 Series.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hp psc 2000 Series.lnk
backup=C:\WINDOWS\pss\hp psc 2000 Series.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^hpoddt01.exe.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hpoddt01.exe.lnk
backup=C:\WINDOWS\pss\hpoddt01.exe.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^ymetray.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ymetray.lnk
backup=C:\WINDOWS\pss\ymetray.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^D.J and Heather^Start Menu^Programs^Startup^Morpheus.lnk]
path=C:\Documents and Settings\D.J and Heather\Start Menu\Programs\Startup\Morpheus.lnk
backup=C:\WINDOWS\pss\Morpheus.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AnyDVD]
C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp]
C:\Program Files\Common Files\Symantec Shared\ccApp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTDVDDET]
2003-06-18 00:00 45056 –a—— C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDET.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2004-08-10 04:00 15360 –a—— C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTHelper]
CTHELPER.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTSysVol]
C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe /r

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellHelp]
C:\Dell\DellHelp\DellHelp.exe /c

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupport]
C:\Program Files\Dell Support\DSAgnt.exe /startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DLA]
2005-09-08 04:20 122940 –a—— C:\WINDOWS\System32\DLA\DLACTRLW.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DMXLauncher]
2005-10-05 02:12 94208 –a—— C:\Program Files\Dell\Media Experience\DMXLauncher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray]
2005-09-29 13:01 67584 –a—— C:\WINDOWS\ehome\ehtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H/PC Connection Agent]
C:\PROGRA~1\MI3AA1~1\wcescomm.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IAAnotif]
2005-06-17 06:56 139264 –a—— C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe -startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe -start

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCAgentExe]
c:\PROGRA~1\mcafee.com\agent\mcagent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCUpdateExe]
C:\PROGRA~1\mcafee.com\agent\mcupdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MPFExe]
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSKAGENTEXE]
C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSKDetectorExe]
C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe /startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
C:\Program Files\MSN Messenger\MsnMsgr.Exe /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2001-07-09 10:50 155648 –a—— C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Norton Ghost 10.0]
C:\Program Files\Norton Ghost\Agent\GhostTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OASClnt]
C:\Program Files\McAfee.com\VSO\oasclnt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2006-05-20 18:40 36972 –a—— C:\Program Files\Java\jre1.5.0\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg]
2000-05-11 00:00 90112 ——— C:\WINDOWS\UpdReg.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VirusScan Online]
C:\Program Files\McAfee.com\VSO\mcvsshld.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VSOCheckTask]
C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe /checktask

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE -quiet

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\YOP]
C:\PROGRA~1\Yahoo!\YOP\yop.exe /autostart

R2 CdaD10BA;CdaD10BA;\??\C:\WINDOWS\system32\drivers\CdaD10BA.SYS
S3 tj2knd5;Terayon Cable Modem (NDIS);C:\WINDOWS\system32\DRIVERS\tj2knd5.sys
S3 tj2kunic;Terayon Cable Modem (WDM);C:\WINDOWS\system32\DRIVERS\tj2kunic.sys
S3 usbsermptxp;Motorola USB Modem Driver for MPT XP;C:\WINDOWS\system32\DRIVERS\usbsermptxp.sys

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}]
\Shell\AutoRun\command - E:\setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f7bc7804-ae11-11db-bba2-00038a000015}]
\Shell\AutoRun\command - I:\LaunchU3.exe -a

.
Contents of the 'Scheduled Tasks' folder
"2006-07-15 01:40:08 C:\WINDOWS\Tasks\FRU Task #Hewlett-Packard#hp psc 2170 series#1145055879.job"
- C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe4-I
"2007-12-02 08:19:37 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
.
**************************************************************************

catchme 0.3.1318 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-02 10:02:43
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-12-02 10:03:19 - machine was rebooted
.
— E O F —

bob4

Post #4December 2, 2007, 8:31 PM UTC last edited December 2, 2007, 8:32 PM UTC

________________________________________
Open notepad and copy/paste the text in the quotebox below into it:

File::
C:\WINDOWS\system32\awvvt.exe
C:\WINDOWS\system32\tvvwa.ini2.ren
C:\WINDOWS\system32\cnmdyuvx.exe .ren
C:\install.dat
C:\WINDOWS\system32\tvvwa.ini.ren
C:\WINDOWS\system32\awvvt.dll
C:\WINDOWS\system32\drivers\core.cache(4).dsk
C:\WINDOWS\system32\drivers\core.cache(3).dsk
C:\WINDOWS\system32\drivers\core.cache(2).dsk
C:\WINDOWS\system32\cdeeg.bak1

Folder::
C:\WINDOWS\system32\delete

Registry::
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E3FBDE2-7DBD-4040-85D9-29BBC559C129}]
[-HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{8E3FBDE2-7DBD-4040-85D9-29BBC559C129}]

Save this as CFScript.txt, in the same location as ComboFix.exe

[external image: Posted Image]

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:ComboFix.txt which I will need in your next reply.

_____________________________
Submit a file to Jotti
Please go here : http://virusscan.jotti.org/
On top of the page there is a field to add the filepath, copy and paste these filepaths: 1 at a time.

C:\WINDOWS\system32\1E167A62E3.sys
C:\WINDOWS\system32\RCX50.tmp
C:\WINDOWS\system32\RCX42.tmp

Then hit Submit
The scan will take a while before the result comes up so please be patient.
Then copy the result and post it here in this thread.

If Jotti's service load is too high, you can use the following scanner instead:
http://www.virustotal.com/xhtml/index_en.html

______________________________

Download and install CCleaner from here

If you use either the Firefox or Mozilla browsers, the box to uncheck for Cookies is on the Applications tab, under Firefox/Mozilla.

Set Cookie Retention.
Click on the Options block on the left, then choose Cookies.
Under the Cookies to delete pane, highlight any cookies you would like to retain permanently (those companies or sites with which you regularly visit or do business), and click the right arrow > to move them to the Cookies to keep pane.
Reset Temp File Removal for Regular Use.
Click on the Options block on the left. Select the Advanced button.
Check "Only delete files in Windows Temp folders older than 48 hours".

Now run the program and click on Run Cleaner
( Do not use the Registry function to clean anything with this program. Having anything auto clean your regisrty is risky).

_________________________________
Please do an online scan with Kaspersky Online Scanner
Click on Kaspersky Online Scanner
You will be promted to install an ActiveX component from Kaspersky, Click Yes.
The program will launch and then start to download the latest definition files.
Once the scanner is installed and the definitions downloaded, click Next.
Now click on Scan Settings
In the scan settings make sure that the following are selected:
Scan using the following Anti-Virus database:

Extended (If available otherwise Standard)
Scan Options:
Scan Archives
Scan Mail Bases
Click OK
Now under select a target to scan select My Computer

Note for Internet Explorer 7 users: If at any time you have trouble with the accept button of the licence, click on the Zoom tool located at the right bottom of the IE window and set the zoom to 75 %. Once the license accepted, reset to 100%.

The scan will take a while so be patient and let it run. Once the scan is complete it will display if your system has been infected.

Now click on the Save as Text button:

Save the file to your desktop.

Copy and paste that information in your next post.

_________________________
In your next reply I would like to see:

A new HJT log
The report from ComboFix
The report from Kasperskys
The 3 reports from Jottis/virus total

hdmanley

Post #5December 2, 2007, 11:54 PM UTC

Thank you. Here are the logs you requested.

HiJack This

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:49:05 PM, on 12/2/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\CTsvcCDA.exe
c:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\fxssvc.exe
C:\DOCUME~1\DA967~1.JAN\LOCALS~1\Temp\SearchProtection.exe
C:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\notepad.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
F3 - REG:win.ini: load=C:\WINDOWS\system32\awvvt.exe
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [MSKDetectorExe] "C:\Program Files\McAfee\SpamKiller\MSKDetct.exe" /uninstall
O4 - HKLM\..\Run: [YSearchProtection] "C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [YSearchProtection] "C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe"
O4 - HKCU\..\Run: [AdobeUpdater] "C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe"
O4 - HKCU\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user')
O4 - Global Startup: ymetray.lnk = C:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\D.J and Heather\Start Menu\Programs\IMVU\Run IMVU.lnk (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://support.cox.com/sdccommon/download/tgctlcm.cab
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=58813
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15030/CTSUEng.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/u…can_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1A1F56AA-3401-46F9-B277-D57F3421F821} (FunGamesLoader Object) - http://www.worldwinner.com/games/v46/share…GamesLoader.cab
O16 - DPF: {1B4F9DD7-2D7C-44B5-9126-73206DA0AE75} (CNavigationManager Object) - http://www3.authentium.com/cssrelease/bin/wizard.exe
O16 - DPF: {2C153C75-8476-434B-B3C3-57B63A3D1939} (Brickout Control) - http://www.worldwinner.com/games/v48/brickout/brickout.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst20040510.cab
O16 - DPF: {33E54F7F-561C-49E6-929B-D7E76D3AFEB1} (Pool Control) - http://www.worldwinner.com/games/v50/pool/pool.cab
O16 - DPF: {45A0A292-ECC6-4D8F-9EA9-A4BD411D24C1} (king.com) - http://www.king.com/ctl/kingcomie.cab
O16 - DPF: {6C6FE41A-0DA6-42A1-9AD8-792026B2B2A7} (FreeCell Control) - http://www.worldwinner.com/games/v41/freecell/freecell.cab
O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - http://www.worldwinner.com/games/shared/wwlaunch.cab
O16 - DPF: {9903F4ED-B673-456A-A15F-ED90C7DE9EF5} (Sol Control) - http://www.worldwinner.com/games/v46/sol/sol.cab
O16 - DPF: {A2E05F45-F127-4092-B9F7-9A02C3E04C77} (HGPlugin7USA Class) - http://gamedownload.ijjimax.com/gamedownlo…GPlugin7USA.cab
O16 - DPF: {C93C1C34-CEA9-49B1-9046-040F59E0E0D8} (Paint Control) - http://www.worldwinner.com/games/v43/paint/paint.cab
O16 - DPF: {CC32D4D8-2A0B-4CEB-B105-C9B968379105} (CGameManagerCtrl Object) - https://disney.go.com/games/downloads/gamem…GameManager.cab
O16 - DPF: {CF969D51-F764-4FBF-9E90-475248601C8A} (FamilyFeud Control) - http://www.worldwinner.com/games/v47/famil…/familyfeud.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15030/CTPID.cab
O16 - DPF: {FFFFFFFF-CACE-BABE-BABE-00AA0055595A} - http://www.trueswitch.com/sbcyahoo/TrueInstallSBC.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: DvpApi (dvpapi) - Authentium, Inc. - c:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe
O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

–
End of file - 9029 bytes

Combofix

ComboFix 07-12-02.5 - D.J and Heather 2007-12-02 15:51:13.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.151 [GMT -6:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\D.J and Heather\Desktop\CFScript.txt
* Created a new restore point

FILE
C:\install.dat
C:\WINDOWS\system32\awvvt.dll
C:\WINDOWS\system32\awvvt.exe
C:\WINDOWS\system32\cdeeg.bak1
C:\WINDOWS\system32\cnmdyuvx.exe .ren
C:\WINDOWS\system32\drivers\core.cache(2).dsk
C:\WINDOWS\system32\drivers\core.cache(3).dsk
C:\WINDOWS\system32\drivers\core.cache(4).dsk
C:\WINDOWS\system32\tvvwa.ini.ren
C:\WINDOWS\system32\tvvwa.ini2.ren
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\install.dat
C:\WINDOWS\system32\awvvt.dll
C:\WINDOWS\system32\awvvt.exe
C:\WINDOWS\system32\cdeeg.bak1
C:\WINDOWS\system32\cnmdyuvx.exe .ren
C:\WINDOWS\system32\delete\
C:\WINDOWS\system32\drivers\core.cache(2).dsk
C:\WINDOWS\system32\drivers\core.cache(3).dsk
C:\WINDOWS\system32\drivers\core.cache(4).dsk
C:\WINDOWS\system32\tvvwa.ini
C:\WINDOWS\system32\tvvwa.ini.ren
C:\WINDOWS\system32\tvvwa.ini2
C:\WINDOWS\system32\tvvwa.ini2.ren
D:\Autorun.inf

.
((((((((((((((((((((((((( Files Created from 2007-11-02 to 2007-12-02 )))))))))))))))))))))))))))))))
.

2007-12-02 15:54 . 2007-12-02 15:54 329,824 ——— C:\WINDOWS\system32\awvvt.dll
2007-12-02 13:03 . 2007-12-02 13:03 d——– C:\Documents and Settings\D.J and Heather\Application Data\Jane s Hotel
2007-12-02 12:47 . 2007-12-02 12:47 143 –a—— C:\WINDOWS\system32\mcrh.tmp
2007-12-02 10:33 . 2007-12-02 10:33 333,312 –a—— C:\WINDOWS\system32\RCX3B.tmp
2007-12-02 10:27 . 2007-12-02 10:27 333,312 –a—— C:\WINDOWS\system32\RCX25.tmp
2007-12-02 10:15 . 2007-12-02 10:15 333,312 –a—— C:\WINDOWS\system32\RCX24.tmp
2007-12-01 21:48 . 2007-12-01 21:48 d——– C:\VundoFix Backups
2007-12-01 20:39 . 2007-12-01 20:39 d——– C:\Program Files\Trend Micro
2007-12-01 20:34 . 2007-12-02 09:45 d——– C:\Program Files\SUPERAntiSpyware
2007-12-01 20:34 . 2007-12-01 20:34 d——– C:\Documents and Settings\D.J and Heather\Application Data\SUPERAntiSpyware.com
2007-12-01 20:34 . 2007-12-01 20:34 d——– C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2007-12-01 00:01 . 2007-12-01 00:01 d——– C:\Program Files\Common Files\Scanner
2007-11-30 23:42 . 2007-11-30 23:42 d–h—– C:\WINDOWS\$hf_mig$
2007-11-30 22:26 . 2007-12-02 09:46 d——– C:\Program Files\AxBx
2007-11-30 22:22 . 2007-11-30 22:22 d——– C:\Program Files\Digital Locker Assistant
2007-11-30 22:09 . 2007-12-02 15:55 d——– C:\Program Files\Windows Defender
2007-11-30 22:03 . 2007-12-01 20:21 333,312 –a—— C:\WINDOWS\system32\delete
2007-11-30 20:59 . 2007-10-01 16:24 23,864 –a—— C:\WINDOWS\system32\drivers\sskbfd.sys
2007-11-30 20:49 . 2007-08-13 18:54 33,792 –a—— C:\WINDOWS\system32\dllcache\custsat.dll
2007-11-30 18:42 . 2007-11-30 18:42 d——– C:\Documents and Settings\D.J and Heather\Application Data\eAcceleration
2007-11-29 20:38 . 2007-11-29 20:38 d——– C:\Documents and Settings\D.J and Heather\Application Data\Skype
2007-11-29 18:57 . 2007-11-29 18:57 d——– C:\Program Files\ReflexiveArcade
2007-11-29 17:20 . 2007-11-29 17:20 d——– C:\Documents and Settings\D.J and Heather\Application Data\Simply Super Software
2007-11-29 17:13 . 2007-11-30 18:41 d——– C:\Program Files\eAcceleration
2007-11-29 17:10 . 2007-11-29 17:10 333,312 –a—— C:\WINDOWS\system32\RCX50.tmp
2007-11-29 17:02 . 2007-11-29 17:02 d——– C:\WINDOWS\McAfee.com
2007-11-29 16:37 . 2007-11-29 16:37 333,312 –a—— C:\WINDOWS\system32\RCX44.tmp
2007-11-29 16:25 . 2007-11-29 16:25 333,312 –a—— C:\WINDOWS\system32\RCX42.tmp
2007-11-29 16:08 . 2007-11-29 16:08 d——– C:\Program Files\Common Files\Authentium
2007-11-29 15:56 . 2007-11-29 15:56 333,312 –a—— C:\WINDOWS\system32\RCX49.tmp
2007-11-29 15:53 . 2007-11-29 16:08 d——– C:\Program Files\Common Files\Aluria(2)
2007-11-29 15:46 . 2007-11-29 15:46 333,312 –a—— C:\WINDOWS\system32\RCX43.tmp
2007-11-29 15:34 . 2007-11-29 15:34 147,456 –a—— C:\WINDOWS\system32\vbzip10.dll
2007-11-29 15:30 . 2007-11-29 15:30 d——– C:\WINDOWS\system32\mm6
2007-11-29 15:30 . 2007-11-30 19:50 d——– C:\WINDOWS\system32\hv2
2007-11-29 15:30 . 2007-11-29 16:09 d——– C:\WINDOWS\system32\ft21
2007-11-29 15:30 . 2007-11-29 15:30 d——– C:\WINDOWS\system32\dr1
2007-11-29 15:30 . 2007-11-29 15:30 d——– C:\WINDOWS\system32\daSgo18
2007-11-29 15:30 . 2007-11-30 20:01 d——– C:\Temp
2007-11-29 15:30 . 2007-11-29 16:10 370,176 –a—— C:\WINDOWS\mrofinu1000140.exe.tmp
2007-11-29 15:30 . 2007-11-29 15:30 134 –a—— C:\n.bat
2007-11-29 15:27 . 2007-11-29 16:18 d——– C:\Program Files\Shockwave.com
2007-11-18 14:13 . 2007-11-18 14:13 d——– C:\Documents and Settings\D.J and Heather\Application Data\Souptoys
2007-11-07 20:14 . 2007-11-07 20:14 d——– C:\Program Files\Resource Kit
2007-11-07 19:55 . 2007-11-07 19:55 d–h—– C:\WINDOWS\system32\GroupPolicy
2007-11-04 18:18 . 2007-11-04 18:18 d——– C:\Documents and Settings\All Users\Application Data\PrettyGoodGames
2007-11-02 19:11 . 2007-11-02 19:11 d——– C:\Documents and Settings\All Users\Application Data\MinigolfAdventures

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-02 21:54 ——— d—–w C:\Program Files\MSN Messenger
2007-12-02 21:48 ——— d—a-w C:\Documents and Settings\All Users\Application Data\TEMP
2007-12-02 19:02 ——— d—–w C:\Program Files\Oberon Media
2007-12-02 16:19 ——— d—–w C:\Documents and Settings\D.J and Heather\Application Data\LimeWire
2007-12-02 02:19 ——— d—–w C:\Program Files\Common Files\Authentium Shared
2007-12-02 02:13 ——— d–h–w C:\Program Files\InstallShield Installation Information
2007-12-02 02:12 ——— d—–w C:\Program Files\MyHeritage
2007-12-02 02:09 ——— d—–w C:\Program Files\Creative
2007-12-01 06:01 ——— d—–w C:\Program Files\Yahoo!
2007-12-01 02:06 ——— d—–w C:\Program Files\BAE
2007-11-30 03:21 ——— d—–w C:\Program Files\Microsoft ActiveSync
2007-11-29 23:53 ——— d—–w C:\Program Files\Dell Support
2007-11-20 22:47 ——— d—–w C:\Program Files\MySpace
2007-11-10 01:34 ——— d—–w C:\Documents and Settings\D.J and Heather\Application Data\U3
2007-10-28 00:00 ——— d–h–r C:\Documents and Settings\D.J and Heather\Application Data\yahoo!
2007-10-27 23:59 ——— d—–w C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2007-10-27 21:27 ——— d—–w C:\Documents and Settings\All Users\Application Data\yahoo!
2007-10-27 15:43 ——— d—–w C:\Program Files\PartyGaming
2007-10-26 03:34 8,460,288 —-a-w C:\WINDOWS\system32\dllcache\shell32.dll
2007-10-11 00:57 ——— d—–w C:\Documents and Settings\D.J and Heather\Application Data\Move Networks
2007-10-07 17:04 ——— d—–w C:\Documents and Settings\All Users\Application Data\HipSoft
2007-09-20 02:33 374 —-a-w C:\Documents and Settings\D.J and Heather\Application Data\internaldb6334.dat
2007-09-20 02:18 556 —-a-w C:\Documents and Settings\D.J and Heather\Application Data\internaldb8467.dat
2007-09-20 02:18 18,432 —-a-w C:\Documents and Settings\D.J and Heather\Application Data\internaldb41.dat
2007-04-25 22:21 92,064 —-a-w C:\Documents and Settings\D.J and Heather\mqdmmdm.sys
2007-04-25 22:21 9,232 —-a-w C:\Documents and Settings\D.J and Heather\mqdmmdfl.sys
2007-04-25 22:21 79,328 —-a-w C:\Documents and Settings\D.J and Heather\mqdmserd.sys
2007-04-25 22:21 66,656 —-a-w C:\Documents and Settings\D.J and Heather\mqdmbus.sys
2007-04-25 22:21 6,208 —-a-w C:\Documents and Settings\D.J and Heather\mqdmcmnt.sys
2007-04-25 22:21 5,936 —-a-w C:\Documents and Settings\D.J and Heather\mqdmwhnt.sys
2007-04-25 22:21 4,048 —-a-w C:\Documents and Settings\D.J and Heather\mqdmcr.sys
2007-04-25 22:21 25,600 —-a-w C:\Documents and Settings\D.J and Heather\usbsermptxp.sys
2007-04-25 22:21 22,768 —-a-w C:\Documents and Settings\D.J and Heather\usbsermpt.sys
2006-06-11 19:45 164 —ha-w C:\Documents and Settings\All Users\hpothb07.dat
2006-04-27 02:46 0 —ha-w C:\Documents and Settings\Guest\hpothb07.dat
2006-04-27 02:46 0 —ha-w C:\Documents and Settings\dj\hpothb07.dat
2006-04-27 02:46 0 —ha-w C:\Documents and Settings\Default User\hpothb07.dat
2006-04-27 02:46 0 —ha-w C:\Documents and Settings\D.J and Heather\hpothb07.dat
2006-07-23 20:21 104 –sh–r C:\WINDOWS\system32\1E167A62E3.sys
2006-07-23 20:21 5,852 –sha-w C:\WINDOWS\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{18595EA8-3D2A-4097-ABCF-D3E00D6ED4C8}]
2007-12-02 15:54 329824 ——— C:\WINDOWS\system32\awvvt.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-10 04:00]
"H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe" []
"msnmsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-12-02 12:47]
"Creative Detector"="C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" [2007-12-02 12:47]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2007-12-02 12:47]
"YSearchProtection"="C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe" [2007-12-02 12:47]
"AdobeUpdater"="C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [2007-12-02 12:47]
"MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe" [2007-12-02 12:47]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-12-02 12:47]
"MSKDetectorExe"="C:\Program Files\McAfee\SpamKiller\MSKDetct.exe" [2007-12-02 12:47]
"YSearchProtection"="C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe" [2007-12-02 12:47]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2007-12-02 12:47]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe" [2007-12-02 12:47]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
ymetray.lnk - C:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe [2007-10-03 12:56:10]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_CURRENT_USER\software\microsoft\windows nt\currentversion\windows]
"load"=C:\WINDOWS\system32\awvvt.exe

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"= msv1_0 C:\WINDOWS\system32\awvvt.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 9.0 Tray Icon.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\America Online 9.0 Tray Icon.lnk
backup=C:\WINDOWS\pss\America Online 9.0 Tray Icon.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk
backup=C:\WINDOWS\pss\Digital Line Detect.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^hp psc 2000 Series.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hp psc 2000 Series.lnk
backup=C:\WINDOWS\pss\hp psc 2000 Series.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^hpoddt01.exe.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hpoddt01.exe.lnk
backup=C:\WINDOWS\pss\hpoddt01.exe.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^ymetray.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ymetray.lnk
backup=C:\WINDOWS\pss\ymetray.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^D.J and Heather^Start Menu^Programs^Startup^Morpheus.lnk]
path=C:\Documents and Settings\D.J and Heather\Start Menu\Programs\Startup\Morpheus.lnk
backup=C:\WINDOWS\pss\Morpheus.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AnyDVD]
C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp]
C:\Program Files\Common Files\Symantec Shared\ccApp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTDVDDET]
2003-06-18 00:00 45056 –a—— C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDET.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2004-08-10 04:00 15360 –a—— C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTHelper]
CTHELPER.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTSysVol]
C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe /r

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellHelp]
C:\Dell\DellHelp\DellHelp.exe /c

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupport]
C:\Program Files\Dell Support\DSAgnt.exe /startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DLA]
2005-09-08 04:20 122940 –a—— C:\WINDOWS\System32\DLA\DLACTRLW.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DMXLauncher]
2005-10-05 02:12 94208 –a—— C:\Program Files\Dell\Media Experience\DMXLauncher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray]
2005-09-29 13:01 67584 –a—— C:\WINDOWS\ehome\ehtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H/PC Connection Agent]
C:\PROGRA~1\MI3AA1~1\wcescomm.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IAAnotif]
2005-06-17 06:56 139264 –a—— C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe -startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe -start

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCAgentExe]
c:\PROGRA~1\mcafee.com\agent\mcagent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCUpdateExe]
C:\PROGRA~1\mcafee.com\agent\mcupdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MPFExe]
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSKAGENTEXE]
C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSKDetectorExe]
C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe /startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
C:\Program Files\MSN Messenger\MsnMsgr.Exe /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2001-07-09 10:50 155648 –a—— C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Norton Ghost 10.0]
C:\Program Files\Norton Ghost\Agent\GhostTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OASClnt]
C:\Program Files\McAfee.com\VSO\oasclnt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2006-05-20 18:40 36972 –a—— C:\Program Files\Java\jre1.5.0\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg]
2000-05-11 00:00 90112 ——— C:\WINDOWS\UpdReg.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VirusScan Online]
C:\Program Files\McAfee.com\VSO\mcvsshld.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VSOCheckTask]
C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe /checktask

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE -quiet

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\YOP]
C:\PROGRA~1\Yahoo!\YOP\yop.exe /autostart

R2 CdaD10BA;CdaD10BA;\??\C:\WINDOWS\system32\drivers\CdaD10BA.SYS
S3 tj2knd5;Terayon Cable Modem (NDIS);C:\WINDOWS\system32\DRIVERS\tj2knd5.sys
S3 tj2kunic;Terayon Cable Modem (WDM);C:\WINDOWS\system32\DRIVERS\tj2kunic.sys
S3 usbsermptxp;Motorola USB Modem Driver for MPT XP;C:\WINDOWS\system32\DRIVERS\usbsermptxp.sys

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}]
\Shell\AutoRun\command - E:\setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f7bc7804-ae11-11db-bba2-00038a000015}]
\Shell\AutoRun\command - I:\LaunchU3.exe -a

.
Contents of the 'Scheduled Tasks' folder
"2006-07-15 01:40:08 C:\WINDOWS\Tasks\FRU Task #Hewlett-Packard#hp psc 2170 series#1145055879.job"
- C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe4-I
"2007-12-02 16:36:50 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
.
**************************************************************************

catchme 0.3.1318 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-02 15:55:04
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-12-02 15:55:54 - machine was rebooted
C:\ComboFix2.txt … 2007-12-02 10:03
.
— E O F —

Kasperskys

Sunday, December 02, 2007 5:29:19 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 3/12/2007
Kaspersky Anti-Virus database records: 470534

Scan Settings
Scan using the following antivirus database extended
Scan Archives true
Scan Mail Bases true

Scan Target My Computer
A:\
C:\
D:\
E:\
F:\
G:\

Scan Statistics
Total number of scanned objects 59675
Number of viruses found 2
Number of infected objects 2
Number of suspicious objects 0
Duration of the scan process 00:38:21

Infected Object Name Virus Name Last Action
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\3ad391678a806ec4d691e83aaa393b6f_24adf822-76f7-4481-b30b-ff1b40f8687f Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Microsoft\eHome\logs\ehRecvr.log Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Microsoft\Windows Defender\Support\MPLog-11302007-221000.log Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Microsoft\Windows NT\MSFax\ActivityLog\InboxLOG.txt Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Microsoft\Windows NT\MSFax\ActivityLog\OutboxLOG.txt Object is locked skipped

C:\Documents and Settings\All Users\Documents\Recorded TV\TempRec\TempSBE\MSDVRMM_3028380660_393150464_5970 Object is locked skipped

C:\Documents and Settings\All Users\Documents\Recorded TV\TempRec\TempSBE\SBE16.tmp Object is locked skipped

C:\Documents and Settings\All Users\Documents\Recorded TV\TempRec\{05C1B180-1B38-4BC8-97D3-103377F2B951}.TmpSBE Object is locked skipped

C:\Documents and Settings\All Users\DRM\drmstore.hds Object is locked skipped

C:\Documents and Settings\D.J and Heather\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\D.J and Heather\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\D.J and Heather\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\D.J and Heather\Local Settings\History\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\D.J and Heather\Local Settings\Temp\~DFC9EA.tmp Object is locked skipped

C:\Documents and Settings\D.J and Heather\Local Settings\Temp\~DFE45A.tmp Object is locked skipped

C:\Documents and Settings\D.J and Heather\Local Settings\Temp\~DFE467.tmp Object is locked skipped

C:\Documents and Settings\D.J and Heather\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped

C:\Documents and Settings\D.J and Heather\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\D.J and Heather\ntuser.dat Object is locked skipped

C:\Documents and Settings\D.J and Heather\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\D.J and Heather\Shared\Rare Recording.wma Infected: Trojan-Downloader.WMA.Wimad.l skipped

C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped

C:\qoobox\Quarantine\C\WINDOWS\system32\cnmdyuvx.exe .ren.vir Infected: Trojan.Win32.Obfuscated.kp skipped

C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP6\change.log Object is locked skipped

C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped

C:\WINDOWS\ModemLog_Conexant D850 56K V.9x DFVc Modem.txt Object is locked skipped

C:\WINDOWS\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{4F12580F-F9F7-456D-9BE2-D08EACE3E0A3}.crmlog Object is locked skipped

C:\WINDOWS\SchedLgU.Txt Object is locked skipped

C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped

C:\WINDOWS\Sti_Trace.log Object is locked skipped

C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped

C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped

C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\DEFAULT Object is locked skipped

C:\WINDOWS\system32\config\default.LOG Object is locked skipped

C:\WINDOWS\system32\config\Internet.evt Object is locked skipped

C:\WINDOWS\system32\config\Media Ce.evt Object is locked skipped

C:\WINDOWS\system32\config\SAM Object is locked skipped

C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped

C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\SECURITY Object is locked skipped

C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped

C:\WINDOWS\system32\config\SOFTWARE Object is locked skipped

C:\WINDOWS\system32\config\software.LOG Object is locked skipped

C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\SYSTEM Object is locked skipped

C:\WINDOWS\system32\config\system.LOG Object is locked skipped

C:\WINDOWS\system32\h323log.txt Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped

C:\WINDOWS\wiadebug.log Object is locked skipped

C:\WINDOWS\wiaservc.log Object is locked skipped

C:\WINDOWS\WindowsUpdate.log Object is locked skipped

D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

D:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP6\change.log Object is locked skipped

Scan process completed.

JOttis/virus

File 1E167A62E3.sys received on 12.02.2007 22:58:23 (CET)
Current status: Loading … queued waiting scanning finished NOT FOUND STOPPED

Result: 0/32 (0%)
Loading server information…
Your file is queued in position: ___.
Estimated start time is between ___ and ___ .
Do not close the window until scan is complete.
The scanner that was processing your file is stopped at this moment, we are going to wait a few seconds to try to recover your result.
If you are waiting for more than five minutes you have to resend your file.
Your file is being scanned by VirusTotal in this moment,
results will be shown as they're generated.
Compact Print results
Your file has expired or does not exists.
Service is stopped in this moments, your file is waiting to be scanned (position: ) for an undefined time.

You can wait for web response (automatic reload) or type your email in the form below and click "request" so the system sends you a notification when the scan is finished.
Email:

Antivirus Version Last Update Result
AhnLab-V3 2007.12.1.0 2007.11.30 -
AntiVir 7.6.0.34 2007.12.02 -
Authentium 4.93.8 2007.12.02 -
Avast 4.7.1074.0 2007.12.02 -
AVG 7.5.0.503 2007.12.02 -
BitDefender 7.2 2007.12.02 -
CAT-QuickHeal 9.00 2007.12.01 -
ClamAV 0.91.2 2007.12.02 -
DrWeb 4.44.0.09170 2007.12.02 -
eSafe 7.0.15.0 2007.11.29 -
eTrust-Vet 31.3.5340 2007.11.30 -
Ewido 4.0 2007.12.02 -
FileAdvisor 1 2007.12.02 -
Fortinet 3.14.0.0 2007.12.02 -
F-Prot 4.4.2.54 2007.12.02 -
F-Secure 6.70.13030.0 2007.12.02 -
Ikarus T3.1.1.12 2007.12.02 -
Kaspersky 7.0.0.125 2007.12.02 -
McAfee 5175 2007.11.30 -
Microsoft 1.3007 2007.12.02 -
NOD32v2 2697 2007.12.02 -
Norman 5.80.02 2007.11.30 -
Panda 9.0.0.4 2007.12.02 -
Prevx1 V2 2007.12.02 -
Rising 20.20.62.00 2007.12.02 -
Sophos 4.23.0 2007.12.02 -
Sunbelt 2.2.907.0 2007.12.01 -
Symantec 10 2007.12.02 -
TheHacker 6.2.9.147 2007.12.01 -
VBA32 3.12.2.5 2007.12.02 -
VirusBuster 4.3.26:9 2007.12.02 -
Webwasher-Gateway 6.6.2 2007.12.02 -
Additional information
File size: 104 bytes
MD5: 1b7d230483d4e688d35252854070cfcb
SHA1: ab12f38c2d07e5af46f2876a0ef66ee6e2b64105

File RCX50.tmp_ received on 12.02.2007 23:03:01 (CET)
Current status: Loading … queued waiting scanning finished NOT FOUND STOPPED

Result: 1/31 (3.23%)
Loading server information…
Your file is queued in position: 2.
Estimated start time is between 41 and 59 seconds.
Do not close the window until scan is complete.
The scanner that was processing your file is stopped at this moment, we are going to wait a few seconds to try to recover your result.
If you are waiting for more than five minutes you have to resend your file.
Your file is being scanned by VirusTotal in this moment,
results will be shown as they're generated.
Compact Print results
Your file has expired or does not exists.
Service is stopped in this moments, your file is waiting to be scanned (position: ) for an undefined time.

You can wait for web response (automatic reload) or type your email in the form below and click "request" so the system sends you a notification when the scan is finished.
Email:

Antivirus Version Last Update Result
AhnLab-V3 2007.12.1.0 2007.11.30 -
AntiVir 7.6.0.34 2007.12.02 -
Authentium 4.93.8 2007.12.02 -
Avast 4.7.1074.0 2007.12.02 -
AVG 7.5.0.503 2007.12.02 Dropper.Generic.SLT
BitDefender 7.2 2007.12.02 -
CAT-QuickHeal 9.00 2007.12.01 -
ClamAV 0.91.2 2007.12.02 -
DrWeb 4.44.0.09170 2007.12.02 -
eSafe 7.0.15.0 2007.11.29 -
eTrust-Vet 31.3.5340 2007.11.30 -
Ewido 4.0 2007.12.02 -
FileAdvisor 1 2007.12.02 -
Fortinet 3.14.0.0 2007.12.02 -
F-Prot 4.4.2.54 2007.12.02 -
F-Secure 6.70.13030.0 2007.12.02 -
Ikarus T3.1.1.12 2007.12.02 -
Kaspersky 7.0.0.125 2007.12.02 -
McAfee 5175 2007.11.30 -
Microsoft 1.3007 2007.12.02 -
NOD32v2 2697 2007.12.02 -
Norman 5.80.02 2007.11.30 -
Panda 9.0.0.4 2007.12.02 -
Rising 20.20.62.00 2007.12.02 -
Sophos 4.23.0 2007.12.02 -
Sunbelt 2.2.907.0 2007.12.01 -
Symantec 10 2007.12.02 -
TheHacker 6.2.9.147 2007.12.01 -
VBA32 3.12.2.5 2007.12.02 -
VirusBuster 4.3.26:9 2007.12.02 -
Webwasher-Gateway 6.6.2 2007.12.02 -
Additional information
File size: 333312 bytes
MD5: a39d9c3b066c5dbb329d065c900facf2
SHA1: a16f5c3b4c17048df84a29298029049494c433a5

File RCX42.tmp_ received on 12.02.2007 23:20:21 (CET)
Current status: Loading … queued waiting scanning finished NOT FOUND STOPPED

Result: 1/32 (3.13%)
Loading server information…
Your file is queued in position: 1.
Estimated start time is between 38 and 54 seconds.
Do not close the window until scan is complete.
The scanner that was processing your file is stopped at this moment, we are going to wait a few seconds to try to recover your result.
If you are waiting for more than five minutes you have to resend your file.
Your file is being scanned by VirusTotal in this moment,
results will be shown as they're generated.
Compact Print results
Your file has expired or does not exists.
Service is stopped in this moments, your file is waiting to be scanned (position: ) for an undefined time.

You can wait for web response (automatic reload) or type your email in the form below and click "request" so the system sends you a notification when the scan is finished.
Email:

Antivirus Version Last Update Result
AhnLab-V3 2007.12.1.0 2007.11.30 -
AntiVir 7.6.0.34 2007.12.02 -
Authentium 4.93.8 2007.12.02 -
Avast 4.7.1074.0 2007.12.02 -
AVG 7.5.0.503 2007.12.02 Dropper.Generic.SLT
BitDefender 7.2 2007.12.02 -
CAT-QuickHeal 9.00 2007.12.01 -
ClamAV 0.91.2 2007.12.02 -
DrWeb 4.44.0.09170 2007.12.02 -
eSafe 7.0.15.0 2007.11.29 -
eTrust-Vet 31.3.5340 2007.11.30 -
Ewido 4.0 2007.12.02 -
FileAdvisor 1 2007.12.02 -
Fortinet 3.14.0.0 2007.12.02 -
F-Prot 4.4.2.54 2007.12.02 -
F-Secure 6.70.13030.0 2007.12.02 -
Ikarus T3.1.1.12 2007.12.02 -
Kaspersky 7.0.0.125 2007.12.02 -
McAfee 5175 2007.11.30 -
Microsoft 1.3007 2007.12.02 -
NOD32v2 2697 2007.12.02 -
Norman 5.80.02 2007.11.30 -
Panda 9.0.0.4 2007.12.02 -
Prevx1 V2 2007.12.02 -
Rising 20.20.62.00 2007.12.02 -
Sophos 4.23.0 2007.12.02 -
Sunbelt 2.2.907.0 2007.12.01 -
Symantec 10 2007.12.02 -
TheHacker 6.2.9.147 2007.12.01 -
VBA32 3.12.2.5 2007.12.02 -
VirusBuster 4.3.26:9 2007.12.02 -
Webwasher-Gateway 6.6.2 2007.12.02 -
Additional information
File size: 333312 bytes
MD5: a39d9c3b066c5dbb329d065c900facf2
SHA1: a16f5c3b4c17048df84a29298029049494c433a5

bob4

Post #6December 3, 2007, 1:47 AM UTC

________________________________________
Open notepad and copy/paste the text in the quotebox below into it:

File::
C:\WINDOWS\system32\awvvt.dll
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\RCX3B.tmp
C:\WINDOWS\system32\RCX25.tmp
C:\WINDOWS\system32\RCX24.tmp
C:\WINDOWS\system32\RCX50.tmp
C:\WINDOWS\system32\RCX44.tmp
C:\WINDOWS\system32\RCX42.tmp
C:\WINDOWS\system32\RCX49.tmp
C:\WINDOWS\system32\RCX43.tmp
C:\WINDOWS\system32\daSgo18
C:\WINDOWS\mrofinu1000140.exe.tmp
C:\WINDOWS\system32\1E167A62E3.sys
C:\Documents and Settings\D.J and Heather\Shared\Rare Recording.wma

Folder::
C:\WINDOWS\system32\delete
C:\WINDOWS\system32\mm6
C:\WINDOWS\system32\hv2
C:\WINDOWS\system32\ft21
C:\WINDOWS\system32\dr1

Driver::

Registry::
[-HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{18595EA8-3D2A-4097-ABCF-D3E00D6ED4C8}
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18595EA8-3D2A-4097-ABCF-D3E00D6ED4C8}
[HKEY_CURRENT_USER\software\microsoft\windows nt\currentversion\windows]
"load"=-]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"=hex(7):6d,73,76,31,5f,30,00,00

Save this as CFScript.txt, in the same location as ComboFix.exe

[external image: Posted Image]

Referring to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:ComboFix.txt which I will need in your next reply.

_____________________________________

You need to update SunJava for security reasons.
Updating Java:
Download the latest version of Java from
Java Updates

Your looking for
(JRE) update 3

Scroll down to where it says "Java Runtime Environment (JRE) 6 Update 3
… allows end-users to run Java applications".
Click the "Download" button to the right.
Check the box that says: "Accept License Agreement".
Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
Close any programs you may have running - especially your web browser.
Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
Check any item with Java Runtime Environment (JRE or J2SE) in the name. It should have the [external image: Posted Image] icon next to it.
Click the Remove or Change/Remove button.
Repeat as many times as necessary to remove each Java versions.
Reboot your computer once all Java components are removed.
Then from your desktop double-click on jre-6u3-windows-i586-p.exe
to install the newest version.

_________________________________
I see no evidence of a fire wall. I suggest you get one in place now to help from this happening again.

A few words on Microsofts firewall. It only works in one direction. Incoming.
That means if something gets by it you would never know it was trying
to contact the internet.
Example: A bad program installs itself. You would never know it was contacting the internet.
Downloading other nasties and so forth.

If you decide to run one of these you should be certain Microsofts firewall is disabled.
To disable it.

I will list a few free firewalls for you. These are good (free) firewalls:

Never run 2 firewalls together. They will interfere with each other.
So just download and install one!

Comodo

Zone Alarm

_________________________
In your next reply I would like to see:

A new HJT log
The report from Combofix
Let me know how things are running.

hdmanley

Post #7December 4, 2007, 3:00 AM UTC

Ok so my computer I think is getting worse. It took me a million manual reboots to get my windows to load properly. I still get the messages about not being able to load because componant was not found please try reinstalling to fix. It even happens on new programs I install. I think somthing is latching on to .exe files and I am getting stressed. Here are the logs you requested

HIJACK THIS

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:57:49 PM, on 12/3/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\DOCUME~1\DA967~1.JAN\LOCALS~1\Temp\jusched.exe
C:\DOCUME~1\DA967~1.JAN\LOCALS~1\Temp\SearchProtection.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\DOCUME~1\DA967~1.JAN\LOCALS~1\Temp\ctfmon.exe
C:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe
c:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\internet explorer\iexplore.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
F3 - REG:win.ini: load=C:\WINDOWS\system32\awvvt.exe
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Security Toolbar - {11A69AE4-FBED-4832-A2BF-45AF82825583} - C:\WINDOWS\system32\vbgxdpae.dll
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [MSKDetectorExe] "C:\Program Files\McAfee\SpamKiller\MSKDetct.exe" /uninstall
O4 - HKLM\..\Run: [YSearchProtection] "C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0\bin\jusched.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\RunOnce: [Authentium] http://www3.authentium.com/cssrelease/cvus/mlprestart.html
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [YSearchProtection] "C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe"
O4 - HKCU\..\Run: [AdobeUpdater] "C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe"
O4 - HKCU\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user')
O4 - Global Startup: ymetray.lnk = C:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\D.J and Heather\Start Menu\Programs\IMVU\Run IMVU.lnk (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://support.cox.com/sdccommon/download/tgctlcm.cab
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=58813
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15030/CTSUEng.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/u…can_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1A1F56AA-3401-46F9-B277-D57F3421F821} (FunGamesLoader Object) - http://www.worldwinner.com/games/v46/share…GamesLoader.cab
O16 - DPF: {1B4F9DD7-2D7C-44B5-9126-73206DA0AE75} (CNavigationManager Object) - http://www3.authentium.com/cssrelease/bin/wizard.exe
O16 - DPF: {2C153C75-8476-434B-B3C3-57B63A3D1939} (Brickout Control) - http://www.worldwinner.com/games/v48/brickout/brickout.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst20040510.cab
O16 - DPF: {33E54F7F-561C-49E6-929B-D7E76D3AFEB1} (Pool Control) - http://www.worldwinner.com/games/v50/pool/pool.cab
O16 - DPF: {45A0A292-ECC6-4D8F-9EA9-A4BD411D24C1} (king.com) - http://www.king.com/ctl/kingcomie.cab
O16 - DPF: {6C6FE41A-0DA6-42A1-9AD8-792026B2B2A7} (FreeCell Control) - http://www.worldwinner.com/games/v41/freecell/freecell.cab
O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - http://www.worldwinner.com/games/shared/wwlaunch.cab
O16 - DPF: {9903F4ED-B673-456A-A15F-ED90C7DE9EF5} (Sol Control) - http://www.worldwinner.com/games/v46/sol/sol.cab
O16 - DPF: {A2E05F45-F127-4092-B9F7-9A02C3E04C77} (HGPlugin7USA Class) - http://gamedownload.ijjimax.com/gamedownlo…GPlugin7USA.cab
O16 - DPF: {C93C1C34-CEA9-49B1-9046-040F59E0E0D8} (Paint Control) - http://www.worldwinner.com/games/v43/paint/paint.cab
O16 - DPF: {CC32D4D8-2A0B-4CEB-B105-C9B968379105} (CGameManagerCtrl Object) - https://disney.go.com/games/downloads/gamem…GameManager.cab
O16 - DPF: {CF969D51-F764-4FBF-9E90-475248601C8A} (FamilyFeud Control) - http://www.worldwinner.com/games/v47/famil…/familyfeud.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15030/CTPID.cab
O16 - DPF: {FFFFFFFF-CACE-BABE-BABE-00AA0055595A} - http://www.trueswitch.com/sbcyahoo/TrueInstallSBC.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: DvpApi (dvpapi) - Authentium, Inc. - c:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe
O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

–
End of file - 9556 bytes

COMBO FIX

ComboFix 07-12-02.5 - D.J and Heather 2007-12-03 19:28:48.5 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.89 [GMT -6:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\D.J and Heather\Desktop\CFScript.txt
* Created a new restore point

FILE
C:\Documents and Settings\D.J and Heather\Shared\Rare Recording.wma
C:\WINDOWS\mrofinu1000140.exe.tmp
C:\WINDOWS\system32\1E167A62E3.sys
C:\WINDOWS\system32\awvvt.dll
C:\WINDOWS\system32\daSgo18
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\RCX24.tmp
C:\WINDOWS\system32\RCX25.tmp
C:\WINDOWS\system32\RCX3B.tmp
C:\WINDOWS\system32\RCX42.tmp
C:\WINDOWS\system32\RCX43.tmp
C:\WINDOWS\system32\RCX44.tmp
C:\WINDOWS\system32\RCX49.tmp
C:\WINDOWS\system32\RCX50.tmp
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Administrator\Desktop\Live Safety Center.lnk
C:\Documents and Settings\Administrator\Desktop\Online Security Guide.lnk
C:\Documents and Settings\Administrator\Favorites\Online Security Guide.lnk
C:\Documents and Settings\All Users\Start Menu\Live Safety Center.lnk
C:\Documents and Settings\All Users\Start Menu\Online Security Guide.lnk
C:\Documents and Settings\D.J and Heather\Desktop\Live Safety Center.lnk
C:\Documents and Settings\D.J and Heather\Desktop\Online Security Guide.lnk
C:\Documents and Settings\D.J and Heather\Favorites\Online Security Guide.lnk
C:\Documents and Settings\D.J and Heather\Shared\Rare Recording.wma
C:\Documents and Settings\dj\Desktop\Live Safety Center.lnk
C:\Documents and Settings\dj\Desktop\Online Security Guide.lnk
C:\Documents and Settings\dj\Favorites\Online Security Guide.lnk
C:\WINDOWS\mrofinu1000140.exe.tmp
C:\WINDOWS\system32\1E167A62E3.sys
C:\WINDOWS\system32\awvvt.dll
C:\WINDOWS\system32\bughkmrg.dll
C:\WINDOWS\system32\delete\
C:\WINDOWS\system32\dr1
C:\WINDOWS\system32\ft21
C:\WINDOWS\system32\grmkhgub.ini
C:\WINDOWS\system32\hv2
C:\WINDOWS\system32\lfmmcegt.dll
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\mm6
C:\WINDOWS\system32\mm6\ncstdb33.exe
C:\WINDOWS\system32\qavggmef.exe
C:\WINDOWS\system32\RCX24.tmp
C:\WINDOWS\system32\RCX25.tmp
C:\WINDOWS\system32\RCX3B.tmp
C:\WINDOWS\system32\RCX42.tmp
C:\WINDOWS\system32\RCX43.tmp
C:\WINDOWS\system32\RCX44.tmp
C:\WINDOWS\system32\RCX49.tmp
C:\WINDOWS\system32\RCX50.tmp
C:\WINDOWS\system32\tvvwa.ini
C:\WINDOWS\system32\tvvwa.ini2
C:\WINDOWS\system32\vbgxdpae.dllbox

.
((((((((((((((((((((((((( Files Created from 2007-11-04 to 2007-12-04 )))))))))))))))))))))))))))))))
.

2007-12-03 19:32 . 2007-12-03 19:32 20,608 —hs—- C:\WINDOWS\system32\vbgxdpae.dllbox
2007-12-03 19:31 . 2007-12-03 19:31 329,824 ——— C:\WINDOWS\system32\awvvt.dll
2007-12-03 18:40 . 2007-12-03 18:40 d——– C:\Documents and Settings\dj\Application Data\Yahoo!
2007-12-03 16:01 . 2007-12-03 16:01 145,984 –a—— C:\WINDOWS\system32\vbgxdpae.dll
2007-12-03 16:00 . 2007-12-03 16:00 145,984 –a—— C:\WINDOWS\system32\unpkyddh.dll
2007-12-02 16:21 . 2007-12-02 16:21 d——– C:\WINDOWS\system32\Kaspersky Lab
2007-12-02 16:21 . 2007-12-02 16:21 d——– C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2007-12-02 16:04 . 2007-12-02 16:04 d——– C:\Program Files\CCleaner
2007-12-02 15:55 . 2007-12-03 19:32 333,312 –a—— C:\WINDOWS\system32\awvvt.exe
2007-12-02 13:03 . 2007-12-02 13:03 d——– C:\Documents and Settings\D.J and Heather\Application Data\Jane s Hotel
2007-12-01 21:48 . 2007-12-01 21:48 d——– C:\VundoFix Backups
2007-12-01 20:39 . 2007-12-01 20:39 d——– C:\Program Files\Trend Micro
2007-12-01 20:34 . 2007-12-02 09:45 d——– C:\Program Files\SUPERAntiSpyware
2007-12-01 20:34 . 2007-12-01 20:34 d——– C:\Documents and Settings\D.J and Heather\Application Data\SUPERAntiSpyware.com
2007-12-01 20:34 . 2007-12-01 20:34 d——– C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2007-12-01 00:01 . 2007-12-01 00:01 d——– C:\Program Files\Common Files\Scanner
2007-11-30 23:42 . 2007-11-30 23:42 d–h—– C:\WINDOWS\$hf_mig$
2007-11-30 22:26 . 2007-12-02 09:46 d——– C:\Program Files\AxBx
2007-11-30 22:22 . 2007-11-30 22:22 d——– C:\Program Files\Digital Locker Assistant
2007-11-30 22:09 . 2007-12-03 19:32 d——– C:\Program Files\Windows Defender
2007-11-30 22:03 . 2007-12-01 20:21 333,312 –a—— C:\WINDOWS\system32\delete
2007-11-30 20:59 . 2007-10-01 16:24 23,864 –a—— C:\WINDOWS\system32\drivers\sskbfd.sys
2007-11-30 20:49 . 2007-08-13 18:54 33,792 –a—— C:\WINDOWS\system32\dllcache\custsat.dll
2007-11-30 18:42 . 2007-11-30 18:42 d——– C:\Documents and Settings\D.J and Heather\Application Data\eAcceleration
2007-11-29 20:38 . 2007-11-29 20:38 d——– C:\Documents and Settings\D.J and Heather\Application Data\Skype
2007-11-29 18:57 . 2007-11-29 18:57 d——– C:\Program Files\ReflexiveArcade
2007-11-29 17:20 . 2007-11-29 17:20 d——– C:\Documents and Settings\D.J and Heather\Application Data\Simply Super Software
2007-11-29 17:13 . 2007-11-30 18:41 d——– C:\Program Files\eAcceleration
2007-11-29 17:02 . 2007-11-29 17:02 d——– C:\WINDOWS\McAfee.com
2007-11-29 16:08 . 2007-11-29 16:08 d——– C:\Program Files\Common Files\Authentium
2007-11-29 15:53 . 2007-11-29 16:08 d——– C:\Program Files\Common Files\Aluria(2)
2007-11-29 15:34 . 2007-11-29 15:34 147,456 –a—— C:\WINDOWS\system32\vbzip10.dll
2007-11-29 15:30 . 2007-11-29 15:30 d——– C:\WINDOWS\system32\daSgo18
2007-11-29 15:30 . 2007-11-30 20:01 d——– C:\Temp
2007-11-29 15:30 . 2007-11-29 15:30 134 –a—— C:\n.bat
2007-11-29 15:27 . 2007-11-29 16:18 d——– C:\Program Files\Shockwave.com
2007-11-18 14:13 . 2007-11-18 14:13 d——– C:\Documents and Settings\D.J and Heather\Application Data\Souptoys
2007-11-07 20:14 . 2007-11-07 20:14 d——– C:\Program Files\Resource Kit
2007-11-07 19:55 . 2007-11-07 19:55 d–h—– C:\WINDOWS\system32\GroupPolicy
2007-11-04 18:18 . 2007-11-04 18:18 d——– C:\Documents and Settings\All Users\Application Data\PrettyGoodGames

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-04 01:31 350,208 —-a-w C:\WINDOWS\system32\ctfmon.exe
2007-12-04 01:31 ——— d—–w C:\Program Files\MSN Messenger
2007-12-04 00:54 ——— d—–w C:\Program Files\Dell Support
2007-12-02 21:48 ——— d—a-w C:\Documents and Settings\All Users\Application Data\TEMP
2007-12-02 19:02 ——— d—–w C:\Program Files\Oberon Media
2007-12-02 16:19 ——— d—–w C:\Documents and Settings\D.J and Heather\Application Data\LimeWire
2007-12-02 02:19 ——— d—–w C:\Program Files\Common Files\Authentium Shared
2007-12-02 02:13 ——— d–h–w C:\Program Files\InstallShield Installation Information
2007-12-02 02:12 ——— d—–w C:\Program Files\MyHeritage
2007-12-02 02:09 ——— d—–w C:\Program Files\Creative
2007-12-01 06:01 ——— d—–w C:\Program Files\Yahoo!
2007-12-01 02:06 ——— d—–w C:\Program Files\BAE
2007-11-30 03:21 ——— d—–w C:\Program Files\Microsoft ActiveSync
2007-11-20 22:47 ——— d—–w C:\Program Files\MySpace
2007-11-10 01:34 ——— d—–w C:\Documents and Settings\D.J and Heather\Application Data\U3
2007-11-03 01:11 ——— d—–w C:\Documents and Settings\All Users\Application Data\MinigolfAdventures
2007-10-28 00:00 ——— d–h–r C:\Documents and Settings\D.J and Heather\Application Data\yahoo!
2007-10-27 23:59 ——— d—–w C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2007-10-27 21:27 ——— d—–w C:\Documents and Settings\All Users\Application Data\yahoo!
2007-10-27 15:43 ——— d—–w C:\Program Files\PartyGaming
2007-10-26 03:34 8,460,288 —-a-w C:\WINDOWS\system32\dllcache\shell32.dll
2007-10-11 00:57 ——— d—–w C:\Documents and Settings\D.J and Heather\Application Data\Move Networks
2007-10-07 17:04 ——— d—–w C:\Documents and Settings\All Users\Application Data\HipSoft
2007-09-20 02:33 374 —-a-w C:\Documents and Settings\D.J and Heather\Application Data\internaldb6334.dat
2007-09-20 02:18 556 —-a-w C:\Documents and Settings\D.J and Heather\Application Data\internaldb8467.dat
2007-09-20 02:18 18,432 —-a-w C:\Documents and Settings\D.J and Heather\Application Data\internaldb41.dat
2007-04-25 22:21 92,064 —-a-w C:\Documents and Settings\D.J and Heather\mqdmmdm.sys
2007-04-25 22:21 9,232 —-a-w C:\Documents and Settings\D.J and Heather\mqdmmdfl.sys
2007-04-25 22:21 79,328 —-a-w C:\Documents and Settings\D.J and Heather\mqdmserd.sys
2007-04-25 22:21 66,656 —-a-w C:\Documents and Settings\D.J and Heather\mqdmbus.sys
2007-04-25 22:21 6,208 —-a-w C:\Documents and Settings\D.J and Heather\mqdmcmnt.sys
2007-04-25 22:21 5,936 —-a-w C:\Documents and Settings\D.J and Heather\mqdmwhnt.sys
2007-04-25 22:21 4,048 —-a-w C:\Documents and Settings\D.J and Heather\mqdmcr.sys
2007-04-25 22:21 25,600 —-a-w C:\Documents and Settings\D.J and Heather\usbsermptxp.sys
2007-04-25 22:21 22,768 —-a-w C:\Documents and Settings\D.J and Heather\usbsermpt.sys
2006-06-11 19:45 164 —ha-w C:\Documents and Settings\All Users\hpothb07.dat
2006-04-27 02:46 0 —ha-w C:\Documents and Settings\Guest\hpothb07.dat
2006-04-27 02:46 0 —ha-w C:\Documents and Settings\dj\hpothb07.dat
2006-04-27 02:46 0 —ha-w C:\Documents and Settings\Default User\hpothb07.dat
2006-04-27 02:46 0 —ha-w C:\Documents and Settings\D.J and Heather\hpothb07.dat
2006-07-23 20:21 5,852 –sha-w C:\WINDOWS\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((( snapshot@2007-12-02_10.02.50.51 )))))))))))))))))))))))))))))))))))))))))
.
+ 2005-05-24 18:27:16 213,048 —-a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavss.dll
+ 2007-08-29 21:47:20 94,208 —-a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavuninstall.exe
+ 2007-08-29 21:49:54 950,272 —-a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavwebscan.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6E62EF33-8C0E-42DC-8E2D-D63712E6034F}]
2007-12-03 19:31 329824 ——— C:\WINDOWS\system32\awvvt.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A95B2816-1D7E-4561-A202-68C0DE02353A}]
2007-12-03 16:01 145984 –a—— C:\WINDOWS\system32\vbgxdpae.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{11A69AE4-FBED-4832-A2BF-45AF82825583}"= C:\WINDOWS\system32\vbgxdpae.dll [2007-12-03 16:01 145984]

[HKEY_CLASSES_ROOT\clsid\{11a69ae4-fbed-4832-a2bf-45af82825583}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-10 04:00]
"H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe" []
"msnmsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-12-03 19:25]
"Creative Detector"="C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" [2007-12-03 19:25]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2007-12-03 19:25]
"YSearchProtection"="C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe" [2007-12-03 18:48]
"AdobeUpdater"="C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [2007-12-03 19:25]
"MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe" [2007-12-03 19:25]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-12-03 18:48]
"MSKDetectorExe"="C:\Program Files\McAfee\SpamKiller\MSKDetct.exe" [2007-12-03 18:48]
"YSearchProtection"="C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe" [2007-12-03 18:48]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2007-12-03 18:48]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe" [2007-12-03 19:25]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
ymetray.lnk - C:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe [2007-10-03 12:56:10]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\vbgxdpae]
vbgxdpae.dll 2007-12-03 16:01 145984 C:\WINDOWS\system32\vbgxdpae.dll

[HKEY_CURRENT_USER\software\microsoft\windows nt\currentversion\windows]
"load"=C:\WINDOWS\system32\awvvt.exe

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"= msv1_0 C:\WINDOWS\system32\awvvt.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 9.0 Tray Icon.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\America Online 9.0 Tray Icon.lnk
backup=C:\WINDOWS\pss\America Online 9.0 Tray Icon.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk
backup=C:\WINDOWS\pss\Digital Line Detect.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^hp psc 2000 Series.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hp psc 2000 Series.lnk
backup=C:\WINDOWS\pss\hp psc 2000 Series.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^hpoddt01.exe.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hpoddt01.exe.lnk
backup=C:\WINDOWS\pss\hpoddt01.exe.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^ymetray.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ymetray.lnk
backup=C:\WINDOWS\pss\ymetray.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^D.J and Heather^Start Menu^Programs^Startup^Morpheus.lnk]
path=C:\Documents and Settings\D.J and Heather\Start Menu\Programs\Startup\Morpheus.lnk
backup=C:\WINDOWS\pss\Morpheus.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AnyDVD]
C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp]
C:\Program Files\Common Files\Symantec Shared\ccApp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTDVDDET]
2003-06-18 00:00 45056 –a—— C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDET.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2004-08-10 04:00 15360 –a—— C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTHelper]
CTHELPER.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTSysVol]
C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe /r

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellHelp]
C:\Dell\DellHelp\DellHelp.exe /c

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupport]
C:\Program Files\Dell Support\DSAgnt.exe /startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DLA]
2005-09-08 04:20 122940 –a—— C:\WINDOWS\System32\DLA\DLACTRLW.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DMXLauncher]
2005-10-05 02:12 94208 –a—— C:\Program Files\Dell\Media Experience\DMXLauncher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray]
2005-09-29 13:01 67584 –a—— C:\WINDOWS\ehome\ehtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H/PC Connection Agent]
C:\PROGRA~1\MI3AA1~1\wcescomm.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IAAnotif]
2005-06-17 06:56 139264 –a—— C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe -startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe -start

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCAgentExe]
c:\PROGRA~1\mcafee.com\agent\mcagent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCUpdateExe]
C:\PROGRA~1\mcafee.com\agent\mcupdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MPFExe]
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSKAGENTEXE]
C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSKDetectorExe]
C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe /startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
C:\Program Files\MSN Messenger\MsnMsgr.Exe /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2001-07-09 10:50 155648 –a—— C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Norton Ghost 10.0]
C:\Program Files\Norton Ghost\Agent\GhostTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OASClnt]
C:\Program Files\McAfee.com\VSO\oasclnt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2006-05-20 18:40 36972 –a—— C:\Program Files\Java\jre1.5.0\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg]
2000-05-11 00:00 90112 ——— C:\WINDOWS\UpdReg.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VirusScan Online]
C:\Program Files\McAfee.com\VSO\mcvsshld.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VSOCheckTask]
C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe /checktask

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE -quiet

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\YOP]
C:\PROGRA~1\Yahoo!\YOP\yop.exe /autostart

R2 CdaD10BA;CdaD10BA;\??\C:\WINDOWS\system32\drivers\CdaD10BA.SYS
S3 tj2knd5;Terayon Cable Modem (NDIS);C:\WINDOWS\system32\DRIVERS\tj2knd5.sys
S3 tj2kunic;Terayon Cable Modem (WDM);C:\WINDOWS\system32\DRIVERS\tj2kunic.sys
S3 usbsermptxp;Motorola USB Modem Driver for MPT XP;C:\WINDOWS\system32\DRIVERS\usbsermptxp.sys

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}]
\Shell\AutoRun\command - E:\setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f7bc7804-ae11-11db-bba2-00038a000015}]
\Shell\AutoRun\command - I:\LaunchU3.exe -a

.
Contents of the 'Scheduled Tasks' folder
"2006-07-15 01:40:08 C:\WINDOWS\Tasks\FRU Task #Hewlett-Packard#hp psc 2170 series#1145055879.job"
- C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe4-I
"2007-12-04 01:28:40 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
.
**************************************************************************

catchme 0.3.1318 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-03 19:32:19
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-12-03 19:33:08 - machine was rebooted
C:\ComboFix2.txt … 2007-12-02 15:55
C:\ComboFix3.txt … 2007-12-02 10:03
.
— E O F —

bob4

Post #8December 4, 2007, 12:09 PM UTC last edited December 4, 2007, 12:23 PM UTC

It looks like you have been infected by a backdoor trojan.

This allows hackers to remotely control your computer, steal critical system information and Download and Execute files

Its very possible that anything could have been installed on your computer by the remote attacker, including opening other backdoors and installing rootkits. While we can attempt to clean what we see in your logs, we can't guarantee that your computer will be completely in the clear since we have no way of knowing that has been done to the computer. Your computer could be completely compromised at this moment. It may be prudent to backup your information, reformat, and reinstall.

More information on Remote Access Trojans can be found
here

I suggest you do the following immediately:

Call all of your banks, credit card companies, financial institutions and inform them that you may be a victim of identity theft and to put a watch on your accounts or change all your account numbers.
From a clean computer, change *all* your online passwords – for email, for banks, financial accounts, PayPal, eBay, online companies, any online forums or groups you belong to.
Do NOT change passwords or do any transactions while using the infected computer because the attacker will get the new passords and transaction information.

If, however, you decide that the computer is not used for any sensitive work, or if you do not wish to reformat at this time, I can help you clean your computer to the best of my abilities.

Should you have any questions, please feel free to ask.

Please let me know what you decide to do in your next post.

Should you decide to clean this machine start by doing the following.

___________________________________________

It's very possible your flash drive is infected. Please do not use it on any other machines untill we know and clean it.
and may be why this infection is being so stubborn

You have a file some of our experts would like to anylyze. Please take a moment of your time to submit this for us.
It will help us and other greatly.

Go to this link.

In the Link to topic where this file was requested:

Place this in
http://forums.whatthetech.com/Helo_t85931.html#entry421149
In the:
Browse to the file you want to submit:
Copy and paste this in:
E:/setup.exe

In the comments box
Place this in.
requested by Bob4

Click send file.
Thank you .

_____________________________
Submit a file to Jotti
Please go here : http://virusscan.jotti.org/
On top of the page there is a field to add the filepath, copy and paste these filepaths: 1 at a time.

Your flash drive has to be in place to do this.

e:/setup.exe

Then hit Submit
The scan will take a while before the result comes up so please be patient.
Then copy the result and post it here in this thread.

If Jotti's service load is too high, you can use the following scanner instead:
http://www.virustotal.com/xhtml/index_en.html

_________________________________

You need to update SunJava for security reasons.
Updating Java:
Download the latest version of Java from
Java Updates

Your looking for
(JRE) update 3

Scroll down to where it says "Java Runtime Environment (JRE) 6 Update 3
… allows end-users to run Java applications".
Click the "Download" button to the right.
Check the box that says: "Accept License Agreement".
Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
Close any programs you may have running - especially your web browser.
Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
Check any item with Java Runtime Environment (JRE or J2SE) in the name. It should have the [external image: Posted Image] icon next to it.
Click the Remove or Change/Remove button.
Repeat as many times as necessary to remove each Java versions.
Reboot your computer once all Java components are removed.
Then from your desktop double-click on jre-6u3-windows-i586-p.exe
to install the newest version.

______________________________
HJT
Run hijackthis and choose scan only and place a check by the following lines if present.
Close all other windows and browsers except HJT before clicking on Fix Checked

F3 - REG:win.ini: load=C:\WINDOWS\system32\awvvt.exe
O3 - Toolbar: Security Toolbar - {11A69AE4-FBED-4832-A2BF-45AF82825583} - C:\WINDOWS\system32\vbgxdpae.dll

________________________________________
Open notepad and copy/paste the text in the quotebox below into it:

File::
C:\WINDOWS\system32\vbgxdpae.dllbox
C:\WINDOWS\system32\awvvt.dll
C:\WINDOWS\system32\vbgxdpae.dll
C:\WINDOWS\system32\unpkyddh.dll
C:\WINDOWS\system32\awvvt.exe

Folder::
C:\WINDOWS\system32\delete
C:\WINDOWS\system32\daSgo18

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6E62EF33-8C0E-42DC-8E2D-D63712E6034F}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A95B2816-1D7E-4561-A202-68C0DE02353A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]"{11A69AE4-FBED-4832-A2BF-45AF82825583}"= -
[-HKEY_CLASSES_ROOT\clsid\{11a69ae4-fbed-4832-a2bf-45af82825583}]
[-HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{6E62EF33-8C0E-42DC-8E2D-D63712E6034F}]
[-HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{A95B2816-1D7E-4561-A202-68C0DE02353A}]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\vbgxdpae]
[HKEY_CURRENT_USER\software\microsoft\windows nt\currentversion\windows]
"load"=-
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"=hex(7):6d,73,76,31,5f,30,00,00

A new HJT log
The report from Jottis
The report from combofix

hdmanley

Post #9December 4, 2007, 2:31 PM UTC

I uploaded that file to bleeping computer for you. Good luck at decyphering it. Here are the logs you requested. I would LOVE to fix this computer. I do not have sensative information on it just sentimental.

HIjack this

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:28:18 AM, on 12/4/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe
C:\WINDOWS\system32\spoolsv.exe
c:\Program Files\Cox\Applications\App\syssvcnt.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe
C:\WINDOWS\system32\CTsvcCDA.exe
c:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\DOCUME~1\DA967~1.JAN\LOCALS~1\Temp\SearchProtection.exe
C:\DOCUME~1\DA967~1.JAN\LOCALS~1\Temp\jusched.exe
C:\WINDOWS\system32\rundll32.exe
C:\DOCUME~1\DA967~1.JAN\LOCALS~1\Temp\ctfmon.exe
C:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
F3 - REG:win.ini: load=C:\WINDOWS\system32\awvvt.exe
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Cox Popup Blocker - {2C0A5F28-48D8-408B-9172-9C6121025BCE} - c:\Program Files\Cox\Applications\App\popupbho01.dll
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [MSKDetectorExe] "C:\Program Files\McAfee\SpamKiller\MSKDetct.exe" /uninstall
O4 - HKLM\..\Run: [YSearchProtection] "C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0\bin\jusched.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [ESP] c:\Program Files\Cox\Applications\app\start.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [YSearchProtection] "C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe"
O4 - HKCU\..\Run: [AdobeUpdater] "C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe"
O4 - HKCU\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\RunOnce: [SpybotDeletingD4052] cmd /c del "C:\WINDOWS\system32\vbgxdpae.dllbox"
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user')
O4 - Global Startup: ymetray.lnk = C:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\D.J and Heather\Start Menu\Programs\IMVU\Run IMVU.lnk (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://support.cox.com/sdccommon/download/tgctlcm.cab
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=58813
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15030/CTSUEng.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/u…can_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1A1F56AA-3401-46F9-B277-D57F3421F821} (FunGamesLoader Object) - http://www.worldwinner.com/games/v46/share…GamesLoader.cab
O16 - DPF: {1B4F9DD7-2D7C-44B5-9126-73206DA0AE75} (CNavigationManager Object) - http://www3.authentium.com/cssrelease/bin/wizard.exe
O16 - DPF: {2C153C75-8476-434B-B3C3-57B63A3D1939} (Brickout Control) - http://www.worldwinner.com/games/v48/brickout/brickout.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst20040510.cab
O16 - DPF: {33E54F7F-561C-49E6-929B-D7E76D3AFEB1} (Pool Control) - http://www.worldwinner.com/games/v50/pool/pool.cab
O16 - DPF: {45A0A292-ECC6-4D8F-9EA9-A4BD411D24C1} (king.com) - http://www.king.com/ctl/kingcomie.cab
O16 - DPF: {6C6FE41A-0DA6-42A1-9AD8-792026B2B2A7} (FreeCell Control) - http://www.worldwinner.com/games/v41/freecell/freecell.cab
O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - http://www.worldwinner.com/games/shared/wwlaunch.cab
O16 - DPF: {9903F4ED-B673-456A-A15F-ED90C7DE9EF5} (Sol Control) - http://www.worldwinner.com/games/v46/sol/sol.cab
O16 - DPF: {A2E05F45-F127-4092-B9F7-9A02C3E04C77} (HGPlugin7USA Class) - http://gamedownload.ijjimax.com/gamedownlo…GPlugin7USA.cab
O16 - DPF: {C93C1C34-CEA9-49B1-9046-040F59E0E0D8} (Paint Control) - http://www.worldwinner.com/games/v43/paint/paint.cab
O16 - DPF: {CC32D4D8-2A0B-4CEB-B105-C9B968379105} (CGameManagerCtrl Object) - https://disney.go.com/games/downloads/gamem…GameManager.cab
O16 - DPF: {CF969D51-F764-4FBF-9E90-475248601C8A} (FamilyFeud Control) - http://www.worldwinner.com/games/v47/famil…/familyfeud.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15030/CTPID.cab
O16 - DPF: {FFFFFFFF-CACE-BABE-BABE-00AA0055595A} - http://www.trueswitch.com/sbcyahoo/TrueInstallSBC.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Cox High Speed Internet Security Suite System Service (AuthSysSvc) - Authentium, Inc. - c:\Program Files\Cox\Applications\App\syssvcnt.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG7 Resident Shield Service (AvgCoreSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: DvpApi (dvpapi) - Authentium, Inc. - c:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe
O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

–
End of file - 11003 bytes

Jottis
The file you uploaded is 0 bytes. It is very likely a firewall or a piece of malware is prohibiting you from uploading this file

Combofix

ComboFix 07-12-02.5 - D.J and Heather 2007-12-04 8:10:16.6 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.118 [GMT -6:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\D.J and Heather\Desktop\CFScript.txt
* Created a new restore point

FILE
C:\WINDOWS\system32\awvvt.dll
C:\WINDOWS\system32\awvvt.exe
C:\WINDOWS\system32\unpkyddh.dll
C:\WINDOWS\system32\vbgxdpae.dll
C:\WINDOWS\system32\vbgxdpae.dllbox
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Start Menu\Live Safety Center.lnk
C:\Documents and Settings\All Users\Start Menu\Online Security Guide.lnk
C:\Documents and Settings\D.J and Heather\Desktop\Live Safety Center.lnk
C:\Documents and Settings\D.J and Heather\Desktop\Online Security Guide.lnk
C:\Documents and Settings\D.J and Heather\Favorites\Online Security Guide.lnk
C:\Documents and Settings\dj\Desktop\Live Safety Center.lnk
C:\Documents and Settings\dj\Desktop\Online Security Guide.lnk
C:\Documents and Settings\dj\Favorites\Online Security Guide.lnk
C:\WINDOWS\system32\awvvt.dll
C:\WINDOWS\system32\awvvt.exe
C:\WINDOWS\system32\daSgo18
C:\WINDOWS\system32\daSgo18\daSgo182328.exe
C:\WINDOWS\system32\delete\
C:\WINDOWS\system32\tvvwa.ini
C:\WINDOWS\system32\tvvwa.ini2

.
((((((((((((((((((((((((( Files Created from 2007-11-04 to 2007-12-04 )))))))))))))))))))))))))))))))
.

2007-12-03 22:17 . 2007-12-03 22:32 d——– C:\Documents and Settings\D.J and Heather\Application Data\AVG7
2007-12-03 22:17 . 2007-12-03 22:34 d——– C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-12-03 22:16 . 2007-12-03 22:16 d——– C:\Documents and Settings\LocalService\Application Data\AVG7
2007-12-03 22:16 . 2007-12-03 23:12 d——– C:\Documents and Settings\All Users\Application Data\avg7
2007-12-03 22:16 . 2007-12-03 22:16 9,216 –a—— C:\WINDOWS\system32\avgwlntf.dll
2007-12-03 22:03 . 2007-12-03 22:03 333,312 –a—— C:\WINDOWS\system32\RCX74.tmp
2007-12-03 22:01 . 2007-12-03 22:01 d——– C:\Program Files\MSXML 4.0
2007-12-03 21:45 . 2007-12-03 21:45 333,312 –a—— C:\WINDOWS\system32\RCX73.tmp
2007-12-03 21:36 . 2007-12-03 21:36 333,312 –a—— C:\WINDOWS\system32\RCX50.tmp
2007-12-03 21:27 . 2007-12-03 21:27 333,312 –a—— C:\WINDOWS\system32\RCX4C.tmp
2007-12-03 21:16 . 2007-12-04 08:18 2,439,200 –ahs—- C:\WINDOWS\system32\drivers\fidbox.dat
2007-12-03 21:16 . 2007-12-04 08:14 30,632 –ahs—- C:\WINDOWS\system32\drivers\fidbox.idx
2007-12-03 21:05 . 2007-12-03 21:05 d——– C:\Program Files\Common Files\Aluria
2007-12-03 20:54 . 2007-12-03 20:54 d——– C:\Documents and Settings\All Users\Application Data\MailFrontier
2007-12-03 20:54 . 2007-12-03 20:55 4,212 –ah—– C:\WINDOWS\system32\zllictbl.dat
2007-12-03 20:42 . 2007-12-03 20:42 333,312 –a—— C:\WINDOWS\system32\RCX3A.tmp
2007-12-03 20:39 . 2007-12-03 20:39 333,312 –a—— C:\WINDOWS\system32\RCX36.tmp
2007-12-03 20:13 . 2007-12-03 20:13 333,312 –a—— C:\WINDOWS\system32\RCX35.tmp
2007-12-03 20:05 . 2007-12-03 20:05 333,312 –a—— C:\WINDOWS\system32\RCX2B.tmp
2007-12-03 19:49 . 2007-12-03 19:49 333,312 –a—— C:\WINDOWS\system32\RCX2A.tmp
2007-12-03 19:45 . 2006-11-26 18:49 209 –a—— C:\boot.ini.comodofirewall
2007-12-03 19:42 . 2007-12-03 19:42 333,312 –a—— C:\WINDOWS\system32\RCX26.tmp
2007-12-03 18:40 . 2007-12-03 18:40 d——– C:\Documents and Settings\dj\Application Data\Yahoo!
2007-12-02 16:21 . 2007-12-02 16:21 d——– C:\WINDOWS\system32\Kaspersky Lab
2007-12-02 16:21 . 2007-12-02 16:21 d——– C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2007-12-02 16:04 . 2007-12-02 16:04 d——– C:\Program Files\CCleaner
2007-12-02 13:03 . 2007-12-02 13:03 d——– C:\Documents and Settings\D.J and Heather\Application Data\Jane s Hotel
2007-12-01 21:48 . 2007-12-01 21:48 d——– C:\VundoFix Backups
2007-12-01 20:39 . 2007-12-01 20:39 d——– C:\Program Files\Trend Micro
2007-12-01 20:34 . 2007-12-02 09:45 d——– C:\Program Files\SUPERAntiSpyware
2007-12-01 20:34 . 2007-12-01 20:34 d——– C:\Documents and Settings\D.J and Heather\Application Data\SUPERAntiSpyware.com
2007-12-01 20:34 . 2007-12-01 20:34 d——– C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2007-12-01 00:01 . 2007-12-01 00:01 d——– C:\Program Files\Common Files\Scanner
2007-11-30 23:42 . 2007-11-30 23:42 d–h—– C:\WINDOWS\$hf_mig$
2007-11-30 22:26 . 2007-12-03 22:20 d——– C:\Program Files\AxBx
2007-11-30 22:22 . 2007-11-30 22:22 d——– C:\Program Files\Digital Locker Assistant
2007-11-30 22:09 . 2007-12-03 23:30 d——– C:\Program Files\Windows Defender
2007-11-30 22:03 . 2007-12-01 20:21 333,312 –a—— C:\WINDOWS\system32\delete
2007-11-30 20:59 . 2007-10-01 16:24 23,864 –a—— C:\WINDOWS\system32\drivers\sskbfd.sys
2007-11-30 20:49 . 2007-08-13 18:54 33,792 –a—— C:\WINDOWS\system32\dllcache\custsat.dll
2007-11-29 20:38 . 2007-11-29 20:38 d——– C:\Documents and Settings\D.J and Heather\Application Data\Skype
2007-11-29 18:57 . 2007-11-29 18:57 d——– C:\Program Files\ReflexiveArcade
2007-11-29 17:20 . 2007-11-29 17:20 d——– C:\Documents and Settings\D.J and Heather\Application Data\Simply Super Software
2007-11-29 17:02 . 2007-11-29 17:02 d——– C:\WINDOWS\McAfee.com
2007-11-29 16:08 . 2007-11-29 16:08 d——– C:\Program Files\Common Files\Authentium
2007-11-29 15:53 . 2007-11-29 16:08 d——– C:\Program Files\Common Files\Aluria(2)
2007-11-29 15:34 . 2007-11-29 15:34 147,456 –a—— C:\WINDOWS\system32\vbzip10.dll
2007-11-29 15:30 . 2007-11-30 20:01 d——– C:\Temp
2007-11-29 15:30 . 2007-11-29 15:30 134 –a—— C:\n.bat
2007-11-29 15:27 . 2007-11-29 16:18 d——– C:\Program Files\Shockwave.com
2007-11-18 14:13 . 2007-11-18 14:13 d——– C:\Documents and Settings\D.J and Heather\Application Data\Souptoys
2007-11-07 20:14 . 2007-11-07 20:14 d——– C:\Program Files\Resource Kit
2007-11-07 19:55 . 2007-11-07 19:55 d–h—– C:\WINDOWS\system32\GroupPolicy
2007-11-04 18:18 . 2007-11-04 18:18 d——– C:\Documents and Settings\All Users\Application Data\PrettyGoodGames

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-04 05:30 ——— d—–w C:\Program Files\MSN Messenger
2007-12-04 04:16 ——— d—–w C:\Documents and Settings\All Users\Application Data\Grisoft
2007-12-04 03:26 ——— d—–w C:\Program Files\Common Files\Authentium Shared
2007-12-04 02:36 ——— d—–w C:\Program Files\Oberon Media
2007-12-04 02:29 ——— d—–w C:\Program Files\Dell Support
2007-12-04 01:43 ——— d—–w C:\Program Files\Java
2007-12-02 21:48 ——— d—a-w C:\Documents and Settings\All Users\Application Data\TEMP
2007-12-02 16:19 ——— d—–w C:\Documents and Settings\D.J and Heather\Application Data\LimeWire
2007-12-02 02:13 ——— d–h–w C:\Program Files\InstallShield Installation Information
2007-12-02 02:12 ——— d—–w C:\Program Files\MyHeritage
2007-12-02 02:09 ——— d—–w C:\Program Files\Creative
2007-12-01 06:01 ——— d—–w C:\Program Files\Yahoo!
2007-12-01 02:06 ——— d—–w C:\Program Files\BAE
2007-11-30 03:21 ——— d—–w C:\Program Files\Microsoft ActiveSync
2007-11-20 22:47 ——— d—–w C:\Program Files\MySpace
2007-11-10 01:34 ——— d—–w C:\Documents and Settings\D.J and Heather\Application Data\U3
2007-11-03 01:11 ——— d—–w C:\Documents and Settings\All Users\Application Data\MinigolfAdventures
2007-10-28 00:00 ——— d–h–r C:\Documents and Settings\D.J and Heather\Application Data\yahoo!
2007-10-27 23:59 ——— d—–w C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2007-10-27 21:27 ——— d—–w C:\Documents and Settings\All Users\Application Data\yahoo!
2007-10-27 15:43 ——— d—–w C:\Program Files\PartyGaming
2007-10-26 03:34 8,460,288 —-a-w C:\WINDOWS\system32\dllcache\shell32.dll
2007-10-11 00:57 ——— d—–w C:\Documents and Settings\D.J and Heather\Application Data\Move Networks
2007-10-07 17:04 ——— d—–w C:\Documents and Settings\All Users\Application Data\HipSoft
2007-09-20 02:33 374 —-a-w C:\Documents and Settings\D.J and Heather\Application Data\internaldb6334.dat
2007-09-20 02:18 556 —-a-w C:\Documents and Settings\D.J and Heather\Application Data\internaldb8467.dat
2007-09-20 02:18 18,432 —-a-w C:\Documents and Settings\D.J and Heather\Application Data\internaldb41.dat
2007-09-06 22:14 75,248 —-a-w C:\WINDOWS\zllsputility.exe
2007-09-06 22:14 1,086,952 —-a-w C:\WINDOWS\system32\zpeng24.dll
2007-04-25 22:21 92,064 —-a-w C:\Documents and Settings\D.J and Heather\mqdmmdm.sys
2007-04-25 22:21 9,232 —-a-w C:\Documents and Settings\D.J and Heather\mqdmmdfl.sys
2007-04-25 22:21 79,328 —-a-w C:\Documents and Settings\D.J and Heather\mqdmserd.sys
2007-04-25 22:21 66,656 —-a-w C:\Documents and Settings\D.J and Heather\mqdmbus.sys
2007-04-25 22:21 6,208 —-a-w C:\Documents and Settings\D.J and Heather\mqdmcmnt.sys
2007-04-25 22:21 5,936 —-a-w C:\Documents and Settings\D.J and Heather\mqdmwhnt.sys
2007-04-25 22:21 4,048 —-a-w C:\Documents and Settings\D.J and Heather\mqdmcr.sys
2007-04-25 22:21 25,600 —-a-w C:\Documents and Settings\D.J and Heather\usbsermptxp.sys
2007-04-25 22:21 22,768 —-a-w C:\Documents and Settings\D.J and Heather\usbsermpt.sys
2006-06-11 19:45 164 —ha-w C:\Documents and Settings\All Users\hpothb07.dat
2006-04-27 02:46 0 —ha-w C:\Documents and Settings\Guest\hpothb07.dat
2006-04-27 02:46 0 —ha-w C:\Documents and Settings\dj\hpothb07.dat
2006-04-27 02:46 0 —ha-w C:\Documents and Settings\Default User\hpothb07.dat
2006-04-27 02:46 0 —ha-w C:\Documents and Settings\D.J and Heather\hpothb07.dat
2006-07-23 20:21 5,852 –sha-w C:\WINDOWS\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((( snapshot@2007-12-02_10.02.50.51 )))))))))))))))))))))))))))))))))))))))))
.
+ 2007-12-04 04:01:23 32,768 —-a-r C:\WINDOWS\Installer\{C04E32E0-0416-434D-AFB9-6969D703A9EF}\icon.exe
+ 2007-05-09 19:39:52 103,968 —-a-w C:\WINDOWS\system32\authcrypt.dll
+ 2007-05-09 19:40:10 79,336 —-a-w C:\WINDOWS\system32\AuthWSC.dll
+ 2006-07-30 18:04:40 221,184 —-a-w C:\WINDOWS\system32\DartSock.dll
+ 2007-12-04 04:16:42 821,856 —-a-w C:\WINDOWS\system32\drivers\avg7core.sys
+ 2007-12-04 04:16:42 4,224 —-a-w C:\WINDOWS\system32\drivers\avg7rsw.sys
+ 2007-12-04 04:16:42 27,776 —-a-w C:\WINDOWS\system32\drivers\avg7rsxp.sys
+ 2007-12-04 04:16:42 3,968 —-a-w C:\WINDOWS\system32\drivers\avgclean.sys
+ 2007-12-04 04:16:42 19,904 —-a-w C:\WINDOWS\system32\drivers\avgmfx86.sys
+ 2007-05-09 19:41:48 16,896 —-a-w C:\WINDOWS\system32\drivers\GRFilter.sys
+ 2007-05-09 19:41:48 36,864 —-a-w C:\WINDOWS\system32\drivers\GRTdiMon.sys
+ 2007-07-19 21:10:28 127,768 —-a-w C:\WINDOWS\system32\drivers\klif.sys
+ 2006-07-30 18:04:40 40,960 —-a-w C:\WINDOWS\system32\dwBkThrd.dll
+ 2006-07-30 18:04:40 200,704 —-a-w C:\WINDOWS\system32\dwSock6.dll
+ 2006-07-30 18:04:40 137,216 —-a-w C:\WINDOWS\system32\dwspy32.dll
+ 2006-07-30 18:04:40 77,312 —-a-w C:\WINDOWS\system32\DWSPY36.dll
+ 2006-07-30 18:04:40 122,880 —-a-w C:\WINDOWS\system32\dwspyvb6.dll
+ 2006-07-30 18:04:40 405,504 —-a-w C:\WINDOWS\system32\ExComboBox.dll
+ 2006-07-30 18:04:40 63,488 —-a-w C:\WINDOWS\system32\FlexBag.dll
+ 2007-05-09 19:51:06 214,504 —-a-w C:\WINDOWS\system32\grfilter.dll
+ 2006-07-30 18:04:40 331,776 —-a-w C:\WINDOWS\system32\IMDBvb.dll
+ 2005-05-24 18:27:16 213,048 —-a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavss.dll
+ 2007-08-29 21:47:20 94,208 —-a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavuninstall.exe
+ 2007-08-29 21:49:54 950,272 —-a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavwebscan.dll
+ 2007-09-06 22:13:58 796,048 —-a-w C:\WINDOWS\system32\libeay32_0.9.6l.dll
+ 2007-05-08 21:03:04 1,275,392 —-a-w C:\WINDOWS\system32\msxml4.dll
+ 2006-07-30 18:04:40 82,432 —-a-w C:\WINDOWS\system32\msxml4r.dll
- 2007-11-29 22:08:58 321,784 —-a-w C:\WINDOWS\system32\Restore\rstrlog.dat
+ 2007-12-04 02:15:47 178,712 —-a-w C:\WINDOWS\system32\Restore\rstrlog.dat
+ 2006-07-30 18:04:40 103,424 —-a-w C:\WINDOWS\system32\sgRegExp.dll
+ 2006-07-30 18:04:40 22,528 —-a-w C:\WINDOWS\system32\SockIntf.dll
+ 2004-04-27 10:40:52 11,264 —-a-w C:\WINDOWS\system32\SpOrder.dll
+ 2007-09-06 22:14:04 83,432 —-a-w C:\WINDOWS\system32\vsdata.dll
+ 2007-09-06 22:14:28 395,080 —-a-w C:\WINDOWS\system32\vsdatant.sys
+ 2007-09-06 22:14:04 157,160 —-a-w C:\WINDOWS\system32\vsinit.dll
+ 2007-09-06 22:14:04 103,912 —-a-w C:\WINDOWS\system32\vsmonapi.dll
+ 2007-09-06 22:14:04 275,944 —-a-w C:\WINDOWS\system32\vspubapi.dll
+ 2007-09-06 22:14:04 71,144 —-a-w C:\WINDOWS\system32\vsregexp.dll
+ 2007-09-06 22:14:06 472,552 —-a-w C:\WINDOWS\system32\vsutil.dll
+ 2007-09-06 22:14:06 46,568 —-a-w C:\WINDOWS\system32\vswmi.dll
+ 2007-09-06 22:14:06 99,816 —-a-w C:\WINDOWS\system32\vsxml.dll
+ 2007-05-09 19:40:10 79,336 —-a-w C:\WINDOWS\system32\wscapi.dll
+ 2006-07-30 18:04:42 456,536 —-a-w C:\WINDOWS\system32\XceedZip.dll
+ 2007-09-06 22:14:06 83,432 —-a-w C:\WINDOWS\system32\zlcomm.dll
+ 2007-09-06 22:14:08 71,144 —-a-w C:\WINDOWS\system32\zlcommdb.dll
+ 2007-09-06 22:13:56 370,208 —-a-w C:\WINDOWS\system32\ZoneLabs\av.dll
+ 2007-05-31 06:03:30 65,248 —-a-w C:\WINDOWS\system32\ZoneLabs\avsys\bases\aphish.dat
+ 2006-06-30 20:47:36 21,568 —-a-w C:\WINDOWS\system32\ZoneLabs\avsys\bases\avcmhk4.dll
+ 2007-05-31 06:03:16 77,824 —-a-w C:\WINDOWS\system32\ZoneLabs\avsys\CKAHComm.dll
+ 2007-05-31 06:03:16 110,592 —-a-w C:\WINDOWS\system32\ZoneLabs\avsys\CKAHrule.dll
+ 2007-05-31 06:03:16 331,776 —-a-w C:\WINDOWS\system32\ZoneLabs\avsys\CKAHUM.dll
+ 2007-05-31 06:03:16 38,400 —-a-w C:\WINDOWS\system32\ZoneLabs\avsys\FSSync.dll
+ 2007-07-19 21:10:32 110,360 —-a-w C:\WINDOWS\system32\ZoneLabs\avsys\instdrivers\w2kxp32\kl1.sys
+ 2007-07-19 21:10:32 186,128 —-a-w C:\WINDOWS\system32\ZoneLabs\avsys\instdrivers\w2kxp32\klif.sys
+ 2007-05-31 06:03:48 110,360 —-a-w C:\WINDOWS\system32\ZoneLabs\avsys\instdrivers\x32\kl1.sys
+ 2007-07-19 21:10:28 127,768 —-a-w C:\WINDOWS\system32\ZoneLabs\avsys\instdrivers\x32\klif.sys
+ 2007-05-31 06:03:50 45,056 —-a-w C:\WINDOWS\system32\ZoneLabs\avsys\instdrivers\x32\regcat.exe
+ 2006-09-20 05:12:14 208,960 —-a-w C:\WINDOWS\system32\ZoneLabs\avsys\inv.dll
+ 2007-08-25 01:31:48 274,432 —-a-w C:\WINDOWS\system32\ZoneLabs\avsys\kave.dll
+ 2006-12-20 00:13:52 1,093,632 —-a-w C:\WINDOWS\system32\ZoneLabs\avsys\libeay32.dll
+ 2007-05-31 06:03:20 548,864 —-a-w C:\WINDOWS\system32\ZoneLabs\avsys\msvcp80.dll
+ 2007-05-31 06:03:20 626,688 —-a-w C:\WINDOWS\system32\ZoneLabs\avsys\msvcr80.dll
+ 2007-05-31 06:03:18 184,320 —-a-w C:\WINDOWS\system32\ZoneLabs\avsys\prloader.dll
+ 2007-05-31 06:03:22 90,112 —-a-w C:\WINDOWS\system32\ZoneLabs\avsys\prremote.dll
+ 2007-08-25 01:31:48 135,168 —-a-w C:\WINDOWS\system32\ZoneLabs\avsys\ScanningProcess.exe
+ 2006-12-20 00:13:52 200,704 —-a-w C:\WINDOWS\system32\ZoneLabs\avsys\ssleay32.dll
+ 2007-09-06 22:13:56 99,816 —-a-w C:\WINDOWS\system32\ZoneLabs\camupd.dll
+ 2004-01-30 18:35:08 813,568 —-a-w C:\WINDOWS\system32\ZoneLabs\dbghelp.dll
+ 2007-09-06 22:13:58 128,480 —-a-w C:\WINDOWS\system32\ZoneLabs\fbl.dll
+ 2007-09-06 22:13:58 38,376 —-a-w C:\WINDOWS\system32\ZoneLabs\featuremap.dll
+ 2007-09-06 22:13:58 321,016 —-a-w C:\WINDOWS\system32\ZoneLabs\imsecure.dll
+ 2007-09-06 22:14:30 288,144 —-a-w C:\WINDOWS\system32\ZoneLabs\lib\ConfigWizard.zip.dll
+ 2007-09-06 22:14:30 152,976 —-a-w C:\WINDOWS\system32\ZoneLabs\lib\licenseui.zip.dll
+ 2007-09-06 22:14:30 26,000 —-a-w C:\WINDOWS\system32\ZoneLabs\lib\zlsvc.zip.dll
+ 2007-09-06 22:14:32 1,361,296 —-a-w C:\WINDOWS\system32\ZoneLabs\lib\zpy.zip.dll
+ 2007-09-06 22:14:32 71,056 —-a-w C:\WINDOWS\system32\ZoneLabs\lib\zui.zip.dll
+ 2007-09-06 22:15:50 30,184 —-a-w C:\WINDOWS\system32\ZoneLabs\plugins\rpc_server\rpc_server.dll
+ 2007-09-06 22:15:52 30,216 —-a-w C:\WINDOWS\system32\ZoneLabs\plugins\vsmon_plugin\vsmon_plugin.dll
+ 2007-08-15 21:45:42 714,208 —-a-w C:\WINDOWS\system32\ZoneLabs\qrbase.dll
+ 2007-08-15 21:45:44 787,936 —-a-w C:\WINDOWS\system32\ZoneLabs\qrsrecl.dll
+ 2007-09-06 22:14:00 173,544 —-a-w C:\WINDOWS\system32\ZoneLabs\scheduler.dll
+ 2007-01-11 17:12:08 2,432,259 —-a-w C:\WINDOWS\system32\ZoneLabs\spyware.dat
+ 2007-08-15 21:45:44 1,500,640 —-a-w C:\WINDOWS\system32\ZoneLabs\srescan.dll
+ 2007-06-11 18:44:10 50,416 —-a-w C:\WINDOWS\system32\ZoneLabs\srescan.sys
+ 2007-09-06 22:14:02 456,168 —-a-w C:\WINDOWS\system32\ZoneLabs\ssleay32.dll
+ 2007-09-06 22:15:52 214,528 —-a-w C:\WINDOWS\system32\ZoneLabs\streamapi\httpblocker\httpblocker.dll
+ 2007-09-06 22:15:54 3,266,040 —-a-w C:\WINDOWS\system32\ZoneLabs\streamapi\imslsp\imslsp.dll
+ 2006-09-05 02:59:14 503,875 —-a-w C:\WINDOWS\system32\ZoneLabs\upd_core.dll
+ 2007-08-01 12:30:04 833,248 —-a-w C:\WINDOWS\system32\ZoneLabs\updating.dll
+ 2007-09-06 22:14:18 149,032 —-a-w C:\WINDOWS\system32\ZoneLabs\updclient.exe
+ 2007-01-11 23:31:06 286,787 —-a-w C:\WINDOWS\system32\ZoneLabs\updtrsdk.dll
+ 2007-09-06 22:14:04 108,008 —-a-w C:\WINDOWS\system32\ZoneLabs\vsavpro.dll
+ 2007-09-06 22:14:04 79,336 —-a-w C:\WINDOWS\system32\ZoneLabs\vsdb.dll
+ 2007-09-06 22:14:18 75,304 —-a-w C:\WINDOWS\system32\ZoneLabs\vsmon.exe
+ 2007-09-06 22:14:04 2,024,936 —-a-w C:\WINDOWS\system32\ZoneLabs\vsmondll.dll
+ 2007-09-06 22:14:06 1,345,000 —-a-w C:\WINDOWS\system32\ZoneLabs\vsruledb.dll
+ 2007-09-06 22:14:06 239,080 —-a-w C:\WINDOWS\system32\ZoneLabs\vsvault.dll
+ 2007-01-11 17:12:08 2,432,259 —-a-w C:\WINDOWS\system32\ZoneLabs\zlasdbup.dat
+ 2007-09-06 22:14:08 177,640 —-a-w C:\WINDOWS\system32\ZoneLabs\zlparser.dll
+ 2007-09-06 22:14:08 79,344 —-a-w C:\WINDOWS\system32\ZoneLabs\zlquarantine.dll
+ 2007-09-06 22:14:08 382,440 —-a-w C:\WINDOWS\system32\ZoneLabs\zlsre.dll
+ 2007-09-06 22:14:08 120,296 —-a-w C:\WINDOWS\system32\ZoneLabs\zlupdate.dll
+ 2007-05-08 21:06:44 1,275,392 —-a-w C:\WINDOWS\WinSxS\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9848.0_x-ww_1b897e9a\msxml4.dll
+ 2007-04-18 16:36:40 82,432 —-a-w C:\WINDOWS\WinSxS\x86_Microsoft.MSXML2R_6bd6b9abf345378f_4.1.0.0_x-ww_29c3ad6a\msxml4r.dll
.
– Snapshot reset to current date –
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-10 04:00]
"H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe" []
"msnmsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-12-03 23:30]
"Creative Detector"="C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" [2007-12-03 23:30]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2007-12-03 23:30]
"YSearchProtection"="C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe" [2007-12-03 23:30]
"AdobeUpdater"="C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [2007-12-03 23:30]
"MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe" [2007-12-03 23:30]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" []
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2007-12-03 23:30]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"SpybotDeletingB789"="command /c del C:\WINDOWS\system32\vbgxdpae.dllbox" []
"SpybotDeletingD4052"="cmd /c del C:\WINDOWS\system32\vbgxdpae.dllbox" []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-12-03 23:30]
"MSKDetectorExe"="C:\Program Files\McAfee\SpamKiller\MSKDetct.exe" [2007-12-03 23:30]
"YSearchProtection"="C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe" [2007-12-03 23:30]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2007-12-03 23:30]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0\bin\jusched.exe" [2007-12-03 23:30]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-12-03 22:30]
"ESP"="c:\Program Files\Cox\Applications\app\start.exe" [2007-12-03 23:30]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-12-03 23:30]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"SpybotDeletingA8618"="command /c del C:\WINDOWS\system32\vbgxdpae.dllbox" []
"SpybotDeletingC297"="cmd /c del C:\WINDOWS\system32\vbgxdpae.dllbox" []

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe" [2007-12-03 23:30]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2007-12-03 22:16]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
ymetray.lnk - C:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe [2007-10-03 12:56:10]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgwlntf]
avgwlntf.dll 2007-12-03 22:16 9216 C:\WINDOWS\system32\avgwlntf.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 9.0 Tray Icon.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\America Online 9.0 Tray Icon.lnk
backup=C:\WINDOWS\pss\America Online 9.0 Tray Icon.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk
backup=C:\WINDOWS\pss\Digital Line Detect.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^hp psc 2000 Series.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hp psc 2000 Series.lnk
backup=C:\WINDOWS\pss\hp psc 2000 Series.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^hpoddt01.exe.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hpoddt01.exe.lnk
backup=C:\WINDOWS\pss\hpoddt01.exe.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^ymetray.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ymetray.lnk
backup=C:\WINDOWS\pss\ymetray.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^D.J and Heather^Start Menu^Programs^Startup^Morpheus.lnk]
path=C:\Documents and Settings\D.J and Heather\Start Menu\Programs\Startup\Morpheus.lnk
backup=C:\WINDOWS\pss\Morpheus.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AnyDVD]
C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp]
C:\Program Files\Common Files\Symantec Shared\ccApp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTDVDDET]
2003-06-18 00:00 45056 –a—— C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDET.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2004-08-10 04:00 15360 –a—— C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTHelper]
CTHELPER.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTSysVol]
C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe /r

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellHelp]
C:\Dell\DellHelp\DellHelp.exe /c

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupport]
C:\Program Files\Dell Support\DSAgnt.exe /startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DLA]
2005-09-08 04:20 122940 –a—— C:\WINDOWS\System32\DLA\DLACTRLW.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DMXLauncher]
2005-10-05 02:12 94208 –a—— C:\Program Files\Dell\Media Experience\DMXLauncher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray]
2005-09-29 13:01 67584 –a—— C:\WINDOWS\ehome\ehtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H/PC Connection Agent]
C:\PROGRA~1\MI3AA1~1\wcescomm.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IAAnotif]
2005-06-17 06:56 139264 –a—— C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe -startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe -start

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCAgentExe]
c:\PROGRA~1\mcafee.com\agent\mcagent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCUpdateExe]
C:\PROGRA~1\mcafee.com\agent\mcupdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MPFExe]
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSKAGENTEXE]
C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSKDetectorExe]
C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe /startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
C:\Program Files\MSN Messenger\MsnMsgr.Exe /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2001-07-09 10:50 155648 –a—— C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Norton Ghost 10.0]
C:\Program Files\Norton Ghost\Agent\GhostTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OASClnt]
C:\Program Files\McAfee.com\VSO\oasclnt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2007-12-03 23:30 371200 –a—— C:\Program Files\Java\jre1.5.0\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg]
2000-05-11 00:00 90112 ——— C:\WINDOWS\UpdReg.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VirusScan Online]
C:\Program Files\McAfee.com\VSO\mcvsshld.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VSOCheckTask]
C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe /checktask

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE -quiet

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\YOP]
C:\PROGRA~1\Yahoo!\YOP\yop.exe /autostart

R0 GRFILTER;Authentium NDIS Driver;C:\WINDOWS\system32\drivers\GRFILTER.sys
R2 CdaD10BA;CdaD10BA;\??\C:\WINDOWS\system32\drivers\CdaD10BA.SYS
R2 GRTdiMon;Authentium TDI Mon;C:\WINDOWS\system32\Drivers\GRTdiMon.sys
S3 tj2knd5;Terayon Cable Modem (NDIS);C:\WINDOWS\system32\DRIVERS\tj2knd5.sys
S3 tj2kunic;Terayon Cable Modem (WDM);C:\WINDOWS\system32\DRIVERS\tj2kunic.sys
S3 usbsermptxp;Motorola USB Modem Driver for MPT XP;C:\WINDOWS\system32\DRIVERS\usbsermptxp.sys

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f7bc7804-ae11-11db-bba2-00038a000015}]
\Shell\AutoRun\command - I:\LaunchU3.exe -a

.
Contents of the 'Scheduled Tasks' folder
"2006-07-15 01:40:08 C:\WINDOWS\Tasks\FRU Task #Hewlett-Packard#hp psc 2170 series#1145055879.job"
- C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe
"2007-12-04 07:31:00 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
.
**************************************************************************

catchme 0.3.1318 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-04 08:18:24
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-12-04 8:19:27 - machine was rebooted
C:\ComboFix2.txt … 2007-12-03 19:33
C:\ComboFix3.txt … 2007-12-02 15:55
.
— E O F —

bob4

Post #10December 5, 2007, 11:42 PM UTC last edited December 5, 2007, 11:43 PM UTC

Sorry for being late. Lost internet connection for a night.

Thanks for sending that file in.

Working on something for you.

open CCleaner
click on tools
highlight uninstall

down on the bottom click save to text file.
Save it to your desktop and post
the contents
of that log for me.

AVG Anti-Spyware:
________________________________________
Download the trial version of AVG Anti-Spyware from here and install it. When the program has been installed, and you click the Finish button, AVG Anti-Spyware will open. Do not run a scan yet.

If the program does not automatically update itself during installation, or you are unsure whether it has done so, please do the following:

Click the Update icon at the top and under Manual Update click the Start update button.
The program will either update or inform you that no update was available.
It is essential that you get the update - keep trying until successful. (Note: If you have problems getting the update, you can download an installer for the full database from here (save it on your desktop). Once you have downloaded the installer, make sure that AVG Anti-Spyware is closed and then double-click on avgas-signatures-full-current.exe to install the database).

Reboot your computer in Safe Mode.
If the computer is running, shut down Windows, and then turn off the power.
Wait 30 seconds, and then turn the computer on.
Start tapping the F8 key. The Windows Advanced Options Menu appears. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again.
Ensure that the Safe Mode option is selected.
Press Enter. The computer then begins to start in Safe mode.
Login on your usual account.
Open up AVG anti Malware

Please set up the program as follows:

Click the Shield icon at the top and under Resident shield is… click active. This should now change to inactive.
Click the Update icon and untick the automatic update option.
Click on Scanner on the toolbar.
Click on the Settings tab.
Under How to act? - make sure that Quarantine is selected.
Under How to scan? - All checkboxes should be ticked.
Under Possibly unwanted software - All checkboxes should be ticked.
Under Reports - Select Do not automatically generate reports.
Under What to scan? - Select Scan every file.

Close all open windows.

Click on Scanner on the toolbar.
Click on Complete System Scan to start the scan process.
Let the program scan your computer.
When the scan has finished, follow the instructions below:
Make sure that Set all elements to: shows Quarantine
Important: Click on the Apply all Actions button (*** This must done before saving the report ***)
When the program has finished, it will display the message All actions have been applied.
Then click the Save Scan Report button.
Click the Save Report as button.
Save the report to your Desktop.
Right-click the AVG Tray Icon and select Exit.
Reboot in normal mode.

Post the log from AVG antispyware.

and

The uninstall list from ccleaner

hdmanley

Post #11December 6, 2007, 1:23 AM UTC

I cannot get to the website to download that anti spyware. When I click the link the following page comes up The webpage cannot be found HTTP 404 Most likely causes: There might be a typing error in the address. If you clicked on a link, it may be out of date. What you can try: Retype the address. Go back to the previous page. Go to and look for the information you want. More information This error (HTTP 404 Not Found) means that Internet Explorer was able to connect to the website, but the page you wanted was not found. It's possible that the webpage is temporarily unavailable. Alternatively, the website might have changed or removed the webpage. For more information about HTTP errors, see Help. And to make sure we are on the same page you want me to run the AVG Anti Spyware not the Anti Malware correct? I see that you have named both in your last post here. Thank you

bob4

Post #12December 6, 2007, 1:59 AM UTC last edited December 6, 2007, 2:06 AM UTC

I'm sorry. My link is out of date. you can find it here .
Your looking for the AVG Anti-Spyware Free

http://free.grisoft.com/doc/5390/us/frt/0?prd=asf

I have to break the habit of calling it anti Malware

That's just wrong.

hdmanley

Post #13December 7, 2007, 2:18 AM UTC

Im sorry I am having a VERY hard time getting the avg anti spyware to update. I have followed your instructions to a TEE but it still wll not update. Please let me know what else I could do.

bob4

Post #14December 7, 2007, 12:09 PM UTC

Try this:
Go to this site and download the Full database to your desktop.

With Avg anti spyware closed double click the exe it downloads and follow the prompts to install the data base.

bob4

Post #15December 12, 2007, 11:15 PM UTC

Able to do this yet ?

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Closed] Helo

✨ Ask AI

Ask AI