Spyware / Malware / Virus Removal

[Resolved] spyware and malware attack. Please help!

13 min read

Looking for the outcome? Ask AI

ussurplus Topic Starter

Post #1December 5, 2007, 5:30 PM UTC last edited December 5, 2007, 8:10 PM UTC

Hi, I'm very new to this and this is my 1st time here! I'm so glad I found this forum. Of what i have read so far….it seems that there are a lot of good people who are trying to help with their time and effort and that is just so great. It seems that I have the same problem which many who post here do have. my laptop is infected with spyware/malware and maybe viruses. My IE opens up with this web site "savetheinformation.com" or "protectroom.com" and I get all kinds of popups telling me that I have spyware, malware, backdoor trojans and on and on…they all want me to download their software to resolve my issues. Of course, I was very suspeciouse of all this and that is why I'm turning to you for help. I'm not that computer savy, so please keep that in mind when you are trying to help me. Your help will be greatly appreciated. Thank you

Logfile of HijackThis v1.99.1
Scan saved at 11:31:24 AM, on 12/5/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\ibmpmsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe
C:\Program Files\ThinkPad\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\C4ebreg\isamsmt.exe
c:\sdwork\issimsvc.exe
C:\PROGRA~1\AT&TNE~1\NetCfgSv.EXE
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\System32\TPHDEXLG.EXE
C:\WINDOWS\system32\TpKmpSVC.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe
C:\WINDOWS\system32\acs.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\winlogon.exe
C:\Program Files\C4ebreg\isamtray.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe
C:\WINDOWS\system32\TpShocks.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\C4ebreg\c4ebreg.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\Program Files\eFax Messenger 4.3\J2GDllCmd.exe
C:\WINDOWS\mrofinu72.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\Lenovo\PkgMgr\HOTKEY\TPONSCR.exe
C:\DOCUME~1\ACTION~1\APPLIC~1\MANTEC~1\csrss.exe
C:\Program Files\Lenovo\PkgMgr\HOTKEY_1\TpScrex.exe
C:\Program Files\QdrModule\QdrModule10.exe
C:\Documents and Settings\Actionnet\My Documents\s?mbols\?hkdsk.exe
C:\Program Files\WinAble\winable.exe
C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe
C:\Program Files\eFax Messenger 4.3\J2GTray.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Southwest Airlines\Ding\Ding.exe
C:\PROGRA~1\ThinkPad\BLUETO~1\BTSTAC~1.EXE
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\Java\jre1.6.0_02\bin\jucheck.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://w3.ibm.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://w3.ibm.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = ;
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Security Toolbar - {11A69AE4-FBED-4832-A2BF-45AF82825583} - C:\WINDOWS\system32\waiwnjlm.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [ISAM SMT Service] "C:\Program Files\C4ebreg\isamsmt.exe"
O4 - HKLM\..\Run: [ISAMTray] "C:\Program Files\C4ebreg\isamtray.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe
O4 - HKLM\..\Run: [PWRMGRTR] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL,PwrMgrBkGndMonitor
O4 - HKLM\..\Run: [BLOG] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\BatLogEx.DLL,StartBattLog
O4 - HKLM\..\Run: [ACTray] C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe
O4 - HKLM\..\Run: [ACWLIcon] C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe
O4 - HKLM\..\Run: [TpShocks] TpShocks.exe
O4 - HKLM\..\Run: [TP4EX] tp4ex.exe
O4 - HKLM\..\Run: [TPKMAPHELPER] C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe -helper
O4 - HKLM\..\Run: [ISSI EZUpdate Service] "c:\sdwork\issimsvc.exe"
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [deldvrw] cmd.exe /c rmdir /s /q C:\ibmtools\apps\dvdwrite
O4 - HKLM\..\Run: [w32msgr] C:\SDWORK\W32MAIN2.exe /log C:\SDWORK\MSGR.TXT OSPDB.POK.IBM.COM
O4 - HKLM\..\Run: [C4EBReg] "C:\Program Files\C4ebreg\c4ebreg.exe" /q
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [eFax 4.3] "C:\Program Files\eFax Messenger 4.3\J2GDllCmd.exe" /R
O4 - HKLM\..\Run: [runner1] C:\WINDOWS\mrofinu72.exe 61A847B5BBF72815308B2B27128065E9C084320161C4661227A755E9C2933154389A
O4 - HKLM\..\Run: [8017f807] rundll32.exe "C:\WINDOWS\system32\kcwcvlxa.dll",b
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Orsm] "C:\DOCUME~1\ACTION~1\APPLIC~1\MANTEC~1\csrss.exe" -vt yazb
O4 - HKCU\..\Run: [QdrModule10] "C:\Program Files\QdrModule\QdrModule10.exe"
O4 - HKCU\..\Run: [Hsj] "C:\Documents and Settings\Actionnet\My Documents\s?mbols\?hkdsk.exe"
O4 - HKCU\..\Run: [WinAble] C:\Program Files\WinAble\winable.exe
O4 - Startup: DING!.lnk = C:\Program Files\Southwest Airlines\Ding\Ding.exe
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: eFax 4.3.lnk = C:\Program Files\eFax Messenger 4.3\J2GTray.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm
O14 - IERESET.INF: START_PAGE_URL=http://w3.ibm.com
O16 - DPF: {DECEAAA2-370A-49BB-9362-68C3A58DDC62} - http://static.zangocash.com/cab/Zango/ie/b…b7009011a32ce0f
O16 - DPF: {FDD6CEF8-3C6E-42E0-BC7B-D730085CFABC} (Jaxtr Outlook Importer) - http://www.jaxtr.com/user/activex/JaxtrOutlookImporter.CAB
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = IBM.COM
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = IBM.COM
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = IBM.COM
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Ac Profile Manager Service (AcPrfMgrSvc) - Unknown owner - C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe
O23 - Service: ACU Configuration Service (ACS) - Unknown owner - C:\WINDOWS\system32\acs.exe
O23 - Service: Access Connections Main Service (AcSvc) - Lenovo - C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\ThinkPad\Bluetooth Software\bin\btwdins.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: ThinkPad PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\system32\ibmpmsvc.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ISAM SMT Service (ISAMsmt) - IBM Global Services - C:\Program Files\C4ebreg\isamsmt.exe
O23 - Service: ISSI EZUpdate (ISSIMon) - IBM Global Services - c:\sdwork\issimsvc.exe
O23 - Service: Network Configuration Service (NetCfgSvr) - AT&T - C:\PROGRA~1\AT&TNE~1\NetCfgSv.EXE
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: ThinkPad HDD APS Logging Service (TPHDEXLGSVC) - Lenovo. - C:\WINDOWS\System32\TPHDEXLG.EXE
O23 - Service: IBM KCU Service (TpKmpSVC) - Unknown owner - C:\WINDOWS\system32\TpKmpSVC.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

IndiGenus

Post #2December 7, 2007, 10:59 PM UTC

Hi ussurplus and welcome to the forums. You do have a very nice collection of Malware there. Let's get to it…

Please download SDFix and save it to your Desktop.

You should print out these instructions, or copy them to a NotePad file for reading while in Safe Mode, because you will not be able to connect to the Internet to read from this site.

Double click on SDFix.exe. It should automatically extract a folder called SDFix to your system drive (usually C:\). Please reboot your computer in Safe Mode by doing the following :

Restart your computer
After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
Instead of Windows loading as normal, a menu with options should appear;
Select the first option, to run Windows in Safe Mode, then press "Enter".
Choose your usual account.

Open the SDFix folder and double click on RunThis.bat to start the script.
Type Y and press Enter to begin the script.
It will start cleaning your PC and then prompt you to press any key to Reboot.
Press any key to restart the PC.
Your system will take longer than normal to restart as the fixtool will be removing files.
When the desktop loads the Fixtool will complete the removal and display Finished.
Press any key to end the script and to load your desktop icons.
A text file should automatically open, so please copy the contents and post them here.

———————————————

Please download ComboFix by sUBs from HERE or HERE

You must download it to and run it from your Desktop
Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.
Double click combofix.exe & follow the prompts.
When finished, it will produce a log. Please save that log to post in your next reply along with a fresh HJT log
Re-enable all the programs that were disabled during the running of ComboFix..

Note:
Do not mouse-click combofix's window while it is running. That may cause it to stall.

CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

ussurplus

Post #3December 8, 2007, 3:27 PM UTC

Hello and thank you for your time and effort in trying to help me out. I followd your instruction up to restarting my computer in safe mode. I get the black safe mode screen, but somehow my descktop top screen does not show up and therefore I can't perform the rest of what you instructed me to do. I will keep trying….and if you have any tips on overcoming the feezing problem that would be great! I'll keep checking the post. Thanks

IndiGenus

Post #4December 8, 2007, 4:06 PM UTC

Hi, Is the PC actually freezing or is it just that the desktop is blank? One thing you could try is reversing the order of tools. Run combofix first in Normal Mode then try SDFix. You do have a pretty badly infected PC. Try that and we can go from there.

ussurplus

Post #5December 8, 2007, 4:59 PM UTC

Hi, I got it….here is the log.

SDFix: Version 1.117

Run by [removed] on Sat 12/08/2007 at 10:39 AM

Microsoft Windows XP [Version 5.1.2600]

Running From: C:\SDFix

Safe Mode:
Checking Services:

Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting…

Normal Mode:
Checking Files:

Trojan Files Found:

C:\Documents and Settings\Actionnet\Desktop\Live Safety Center.lnk - Deleted
C:\Documents and Settings\Actionnet\Desktop\Online Security Guide.lnk - Deleted
C:\Documents and Settings\Actionnet\Favorites\Online Security Guide.lnk - Deleted
C:\Program Files\Temporary\wininstall.exe - Deleted
C:\Program Files\WinAble\winable.exe - Deleted
C:\Program Files\Common Files\Yazzle1552OinAdmin.exe - Deleted
C:\Program Files\Common Files\Yazzle1552OinUninstaller.exe - Deleted
C:\WINDOWS\b122.exe - Deleted
C:\WINDOWS\mrofinu72.exe - Deleted

Folder C:\Program Files\Temporary - Removed
Folder C:\Program Files\WinAble - Removed

Removing Temp Files…

ADS Check:

C:\WINDOWS
No streams found.

C:\WINDOWS\system32
No streams found.

C:\WINDOWS\system32\svchost.exe
No streams found.

C:\WINDOWS\system32\ntoskrnl.exe
No streams found.

Final Check:

catchme 0.3.1262.1 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-08 10:46:42
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden services & system hive …

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{31972BA0-EA1C-46FA-AF63-F8776C54B4DE}]
"DhcpRetryTime"=dword:00000000

scanning hidden registry entries …

scanning hidden files …

C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{B48EFD94-4247-8220-6FC9-8D7B7FD5C011}\01\12-{B48EFD94-4247-8220-6FC9-8D7B7FD5C011}-v1-{050D58D3-A1D1-4976-B5C6-68EEB6AEE712}-v12-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 8 bytes hidden from API
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{B48EFD94-4247-8220-6FC9-8D7B7FD5C011}\13\13-{CE89F725-CA16-4E03-BB53-3500053CD669}-v13-{CE89F725-CA16-4E03-BB53-3500053CD669}-v13-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 1504 bytes hidden from API
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\HDI67OOS\v5[5].htm 8519 bytes

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 3

Remaining Services:
——————

Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Google\\Google Talk\\googletalk.exe"="C:\\Program Files\\Google\\Google Talk\\googletalk.exe:*:Enabled:Google Talk"
"C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"
"C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"="C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe:*:Enabled:AOL Loader"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\\WINDOWS\\system32\\nbfpittu.exe"="C:\\WINDOWS\\system32\\nbf"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

Remaining Files:
—————

File Backups: - C:\SDFix\backups\backups.zip

Files with Hidden Attributes:

Fri 9 Jun 2006 224 A.SHR — "C:\BOOT.BAK"
Tue 3 Aug 2004 60,416 A.SH. — "C:\Program Files\Outlook Express\msimn.exe"
Sat 8 Dec 2007 20,810 ..SH. — "C:\WINDOWS\system32\waiwnjlm.dllbox"
Sun 2 Dec 2007 22,016 …H. — "C:\Documents and Settings\Administrator\My Documents\~WRL0049.tmp"
Sun 2 Dec 2007 20,480 …H. — "C:\Documents and Settings\Administrator\My Documents\~WRL0535.tmp"
Sun 2 Dec 2007 21,504 …H. — "C:\Documents and Settings\Administrator\My Documents\~WRL2936.tmp"
Tue 25 Jul 2006 4,348 ..SH. — "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Sun 3 Sep 2006 273 A..H. — "C:\Program Files\InterActual\InterActual Player\iti9.tmp"
Sun 2 Dec 2007 72,704 ..SHR — "C:\Documents and Settings\Actionnet\Application Data\??mantec\csrss.exe"
Sun 2 Dec 2007 46,030 …H. — "C:\Documents and Settings\Actionnet\My Documents\eFax Messenger 4.3\J2GPlus.exe-BarState"
Thu 1 Nov 2007 230,400 ..SHR — "C:\Documents and Settings\Actionnet\My Documents\s?mbols\?hkdsk.exe"
Mon 3 Dec 2007 71,168 ..SH. — "C:\Documents and Settings\Administrator\Local Settings\Temp\fpersebo.exe"
Tue 4 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico1.tmp"
Tue 4 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico10.tmp"
Tue 4 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico11.tmp"
Tue 4 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico12.tmp"
Tue 4 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico13.tmp"
Tue 4 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico14.tmp"
Wed 5 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico15.tmp"
Wed 5 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico16.tmp"
Wed 5 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico17.tmp"
Wed 5 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico18.tmp"
Wed 5 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico19.tmp"
Wed 5 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico1A.tmp"
Mon 3 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico1B.tmp"
Mon 3 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico1C.tmp"
Mon 3 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico1D.tmp"
Mon 3 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico1E.tmp"
Mon 3 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico1F.tmp"
Tue 4 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico2.tmp"
Tue 4 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico20.tmp"
Tue 4 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico21.tmp"
Tue 4 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico22.tmp"
Tue 4 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico23.tmp"
Tue 4 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico24.tmp"
Tue 4 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico25.tmp"
Tue 4 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico26.tmp"
Tue 4 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico27.tmp"
Tue 4 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico28.tmp"
Tue 4 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico29.tmp"
Tue 4 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico2A.tmp"
Tue 4 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico2B.tmp"
Tue 4 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico2C.tmp"
Tue 4 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico2D.tmp"
Tue 4 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico2E.tmp"
Tue 4 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico2F.tmp"
Tue 4 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico3.tmp"
Tue 4 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico30.tmp"
Tue 4 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico31.tmp"
Tue 4 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico32.tmp"
Tue 4 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico33.tmp"
Tue 4 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico34.tmp"
Tue 4 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico35.tmp"
Tue 4 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico36.tmp"
Tue 4 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico37.tmp"
Tue 4 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico38.tmp"
Wed 5 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico39.tmp"
Wed 5 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico3A.tmp"
Wed 5 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico3B.tmp"
Wed 5 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico3C.tmp"
Wed 5 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico3D.tmp"
Wed 5 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico3E.tmp"
Wed 5 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico3F.tmp"
Tue 4 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico4.tmp"
Wed 5 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico40.tmp"
Wed 5 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico41.tmp"
Wed 5 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico42.tmp"
Wed 5 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico43.tmp"
Wed 5 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico44.tmp"
Wed 5 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico45.tmp"
Wed 5 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico46.tmp"
Wed 5 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico47.tmp"
Wed 5 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico48.tmp"
Wed 5 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico49.tmp"
Wed 5 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico4A.tmp"
Wed 5 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico4B.tmp"
Wed 5 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico4C.tmp"
Wed 5 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico4D.tmp"
Wed 5 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico4E.tmp"
Wed 5 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico4F.tmp"
Tue 4 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico5.tmp"
Wed 5 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico50.tmp"
Thu 6 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico51.tmp"
Thu 6 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico52.tmp"
Wed 5 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico53.tmp"
Wed 5 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico54.tmp"
Wed 5 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico55.tmp"
Wed 5 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico56.tmp"
Wed 5 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico57.tmp"
Wed 5 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico58.tmp"
Wed 5 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico59.tmp"
Wed 5 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico5A.tmp"
Wed 5 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico5B.tmp"
Wed 5 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico5C.tmp"
Thu 6 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico5D.tmp"
Thu 6 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico5E.tmp"
Thu 6 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico5F.tmp"
Tue 4 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico6.tmp"
Thu 6 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico60.tmp"
Thu 6 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico61.tmp"
Thu 6 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico62.tmp"
Thu 6 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico63.tmp"
Thu 6 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico64.tmp"
Thu 6 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico65.tmp"
Thu 6 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico66.tmp"
Thu 6 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico67.tmp"
Thu 6 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico68.tmp"
Thu 6 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico69.tmp"
Thu 6 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico6A.tmp"
Thu 6 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico6B.tmp"
Thu 6 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico6C.tmp"
Thu 6 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico6D.tmp"
Thu 6 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico6E.tmp"
Thu 6 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico6F.tmp"
Tue 4 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico7.tmp"
Thu 6 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico70.tmp"
Thu 6 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico71.tmp"
Thu 6 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico72.tmp"
Thu 6 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico73.tmp"
Thu 6 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico74.tmp"
Thu 6 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico75.tmp"
Thu 6 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico76.tmp"
Thu 6 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico77.tmp"
Thu 6 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico78.tmp"
Fri 7 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico79.tmp"
Fri 7 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico7A.tmp"
Fri 7 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico7B.tmp"
Fri 7 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico7C.tmp"
Fri 7 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico7D.tmp"
Fri 7 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico7E.tmp"
Fri 7 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico7F.tmp"
Tue 4 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico8.tmp"
Fri 7 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico80.tmp"
Fri 7 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico81.tmp"
Fri 7 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico82.tmp"
Fri 7 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico83.tmp"
Fri 7 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico84.tmp"
Fri 7 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico85.tmp"
Fri 7 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico86.tmp"
Fri 7 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico87.tmp"
Fri 7 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico88.tmp"
Fri 7 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico89.tmp"
Fri 7 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico8A.tmp"
Fri 7 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico8B.tmp"
Fri 7 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico8C.tmp"
Fri 7 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico8D.tmp"
Fri 7 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico8E.tmp"
Fri 7 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico8F.tmp"
Tue 4 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico9.tmp"
Fri 7 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico90.tmp"
Fri 7 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico91.tmp"
Sat 8 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico92.tmp"
Sat 8 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico93.tmp"
Sat 8 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico94.tmp"
Sat 8 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico95.tmp"
Sat 8 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico96.tmp"
Sat 8 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico97.tmp"
Sat 8 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico98.tmp"
Sat 8 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico99.tmp"
Sat 8 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico9A.tmp"
Sat 8 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico9B.tmp"
Sat 8 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico9C.tmp"
Sat 8 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico9D.tmp"
Sat 8 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico9E.tmp"
Sat 8 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\ico9F.tmp"
Tue 4 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\icoA.tmp"
Sat 8 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\icoA0.tmp"
Tue 4 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\icoB.tmp"
Tue 4 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\icoC.tmp"
Tue 4 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\icoD.tmp"
Tue 4 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\icoE.tmp"
Tue 4 Dec 2007 4,286 A..H. — "C:\Documents and Settings\Administrator\Local Settings\Temp\icoF.tmp"
Tue 27 Nov 2007 0 A..H. — "C:\WINDOWS\SoftwareDistribution\Download\a53bf224a188f23c622431aa5c569c34\BIT3.tmp"
Wed 19 Sep 2007 0 A..H. — "C:\WINDOWS\SoftwareDistribution\Download\cf7ced0e70c80a1e476f1abf49afecb1\BIT1.tmp"
Tue 25 Jul 2006 4,348 …H. — "C:\Documents and Settings\Administrator\My Documents\My Music\License Backup\drmv1key.bak"
Fri 4 Aug 2006 20 A..H. — "C:\Documents and Settings\Administrator\My Documents\My Music\License Backup\drmv1lic.bak"
Tue 25 Jul 2006 400 …H. — "C:\Documents and Settings\Administrator\My Documents\My Music\License Backup\drmv2key.bak"
Fri 4 Aug 2006 1,536 A..H. — "C:\Documents and Settings\Administrator\My Documents\My Music\License Backup\drmv2lic.bak"

Finished!

IndiGenus

Post #6December 9, 2007, 12:11 PM UTC

Hi, Are you able to run Combofix also? If so please run and post that log and I'll get back to you with the next set of instructions. thanks, Dave

ussurplus

Post #7December 9, 2007, 4:14 PM UTC

Dave, thank you for getting back with me. here is the combo.fix log. I will also post a fresh Hjt.log.

Ray

ComboFix 07-12-08.1 - Actionnet 2007-12-09 8:05:33.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.488 [GMT -6:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Actionnet\Application Data\MANTEC~1
C:\Documents and Settings\Actionnet\Application Data\MANTEC~1\??mantec\
C:\Documents and Settings\Actionnet\Application Data\MANTEC~1\csrss.exe
C:\Documents and Settings\Actionnet\My Documents\SMBOLS~1
C:\Documents and Settings\Actionnet\My Documents\SMBOLS~1\?hkdsk.exe
C:\Documents and Settings\Actionnet\Start Menu\Programs\Internet Speed Monitor
C:\Documents and Settings\Actionnet\Start Menu\Programs\Internet Speed Monitor\Check Now.lnk
C:\Documents and Settings\Actionnet\Start Menu\Programs\Internet Speed Monitor\Uninstall.lnk
C:\Documents and Settings\Actionnet\Start Menu\Programs\Outerinfo
C:\Documents and Settings\Actionnet\Start Menu\Programs\Outerinfo\Terms.lnk
C:\Documents and Settings\Actionnet\Start Menu\Programs\Outerinfo\Uninstall.lnk
C:\Documents and Settings\Administrator\Desktop\Live Safety Center.lnk
C:\Documents and Settings\Administrator\Desktop\Online Security Guide.lnk
C:\Documents and Settings\Administrator\Favorites\Online Security Guide.lnk
C:\Documents and Settings\All Users\Start Menu\Live Safety Center.lnk
C:\Documents and Settings\All Users\Start Menu\Online Security Guide.lnk
C:\Program Files\ISM
C:\Program Files\ISM\ism.exe
C:\Program Files\ISM\Uninstall.exe
C:\Program Files\outerinfo
C:\Program Files\outerinfo\FF\chrome.manifest
C:\Program Files\outerinfo\FF\components\FF.dll
C:\Program Files\outerinfo\FF\components\OuterinfoAds.xpt
C:\Program Files\outerinfo\FF\install.rdf
C:\Program Files\outerinfo\Terms.rtf
C:\Program Files\QdrDrive
C:\Program Files\QdrDrive\QdrDrive8.dll
C:\Program Files\QdrDrive\qdrloader.exe
C:\Program Files\QdrModule
C:\Program Files\QdrModule\dic.gz
C:\Program Files\QdrModule\kwd.gz
C:\Program Files\QdrModule\QdrModule10.exe
C:\WINDOWS\cookies.ini
C:\WINDOWS\system32\awvtu.dll
C:\WINDOWS\system32\bbadd.ini
C:\WINDOWS\system32\bbadd.ini2
C:\WINDOWS\system32\bdeeg.ini
C:\WINDOWS\system32\bdeeg.ini2
C:\WINDOWS\system32\clhlp.dll
C:\WINDOWS\system32\dccdd.ini
C:\WINDOWS\system32\dccdd.ini2
C:\WINDOWS\system32\ddabb.dll
C:\WINDOWS\system32\ddccd.dll
C:\WINDOWS\system32\ficdgait.exe
C:\WINDOWS\system32\geedb.dll
C:\WINDOWS\system32\gfhkj.ini
C:\WINDOWS\system32\gfhkj.ini2
C:\WINDOWS\system32\gjkmp.ini
C:\WINDOWS\system32\gjkmp.ini2
C:\WINDOWS\system32\heiipluu.ini
C:\WINDOWS\system32\iiffddc.dll
C:\WINDOWS\system32\jkhfg.dll
C:\WINDOWS\system32\jkkll.dll
C:\WINDOWS\system32\jowuhyck.dll
C:\WINDOWS\system32\kcyhuwoj.ini
C:\WINDOWS\system32\llkkj.ini
C:\WINDOWS\system32\llkkj.ini2
C:\WINDOWS\system32\lqcjafuc.dll
C:\WINDOWS\system32\lqqsnmvq.dll
C:\WINDOWS\system32\moefjdae.dll
C:\WINDOWS\system32\pmkjg.dll
C:\WINDOWS\system32\pmnll.dll
C:\WINDOWS\system32\prqss.ini
C:\WINDOWS\system32\prqss.ini2
C:\WINDOWS\system32\qdymhemt.ini
C:\WINDOWS\system32\qrqss.ini
C:\WINDOWS\system32\qrqss.ini2
C:\WINDOWS\system32\qtutv.ini
C:\WINDOWS\system32\qtutv.ini2
C:\WINDOWS\system32\qvmnsqql.ini
C:\WINDOWS\system32\ssqrp.dll
C:\WINDOWS\system32\ssqrq.dll
C:\WINDOWS\system32\tapebfed.dll
C:\WINDOWS\system32\tmehmydq.dll
C:\WINDOWS\system32\utvwa.ini
C:\WINDOWS\system32\utvwa.ini2
C:\WINDOWS\system32\uulpiieh.dll
C:\WINDOWS\system32\vgepiswb.dll
C:\WINDOWS\system32\vtutq.dll
C:\WINDOWS\system32\waiwnjlm.dll
C:\WINDOWS\system32\waiwnjlm.dllbox
C:\WINDOWS\system32\wnscpsv.exe
C:\WINDOWS\system32\xymtbjpa.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
——-\LEGACY_DOMAINSERVICE
——-\DomainService

((((((((((((((((((((((((( Files Created from 2007-11-09 to 2007-12-09 )))))))))))))))))))))))))))))))
.

2007-12-08 10:38 . 2007-12-08 10:38 d——– C:\WINDOWS\ERUNT
2007-12-06 18:03 . 2007-12-06 18:03 74,304 –a—— C:\WINDOWS\system32\nbfpittu.exe
2007-12-05 19:33 . 2007-12-05 19:33 d——– C:\Documents and Settings\Administrator\Application Data\Grisoft
2007-12-05 18:55 . 2007-12-05 18:55 d——– C:\Documents and Settings\Actionnet\Application Data\Grisoft
2007-12-05 18:53 . 2007-12-05 18:53 d——– C:\Documents and Settings\All Users\Application Data\Grisoft
2007-12-05 18:53 . 2007-05-30 06:10 10,872 –a—— C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-12-05 10:53 . 2007-12-06 18:03 807,648 –ahs—- C:\WINDOWS\system32\axlvcwck.ini
2007-12-02 22:17 . 2007-12-02 22:17 d——– C:\Program Files\Lavasoft
2007-12-02 22:17 . 2007-12-02 22:17 d——– C:\Documents and Settings\All Users\Application Data\Lavasoft
2007-12-02 21:50 . 2007-12-02 22:11 d——– C:\Program Files\NoAdware5.0
2007-12-02 20:52 . 2007-12-02 20:53 d——– C:\Documents and Settings\All Users\Application Data\WinZip
2007-12-02 20:38 . 2007-12-02 20:38 54,156 –ah—– C:\WINDOWS\QTFont.qfn
2007-12-02 20:38 . 2007-12-02 20:38 1,409 –a—— C:\WINDOWS\QTFont.for
2007-12-02 16:29 . 2006-11-29 13:06 3,426,072 –a—— C:\WINDOWS\system32\d3dx9_32.dll
2007-12-02 16:28 . 2007-12-02 16:28 d——– C:\Program Files\Microsoft SQL Server Compact Edition
2007-12-02 16:19 . 2007-12-02 16:21 d–hsc— C:\Program Files\Common Files\WindowsLiveInstaller
2007-12-02 16:18 . 2007-12-02 16:30 d——– C:\Program Files\Windows Live
2007-12-02 16:18 . 2007-12-02 20:29 d——– C:\Documents and Settings\All Users\Application Data\WLInstaller
2007-12-02 10:40 . 2007-12-02 10:40 d——– C:\Documents and Settings\Administrator\Application Data\eFax Messenger
2007-11-20 21:43 . 2007-11-20 21:43 d——– C:\Documents and Settings\Administrator\Application Data\acccore
2007-11-17 18:57 . 2007-11-17 18:57 d——– C:\Program Files\Disney

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-09 15:52 ——— d—–w C:\Program Files\C4ebreg
2007-12-09 15:49 ——— d—–w C:\Program Files\Symantec AntiVirus
2007-12-03 04:16 ——— d—–w C:\Program Files\Common Files\Wise Installation Wizard
2007-12-02 23:42 ——— d—–w C:\Program Files\MSN Messenger
2007-11-30 06:17 ——— d—–w C:\Program Files\Windows Live Toolbar
2007-10-28 20:54 ——— d—–w C:\Program Files\ABC Amber PDF Converter
2007-10-23 23:06 585,728 —-a-w C:\WINDOWS\WLXPGSS.SCR
2007-10-15 22:21 ——— d—–w C:\Program Files\iPod
2007-10-14 13:32 ——— d—–w C:\Documents and Settings\Administrator\Application Data\Leadertech
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2007-03-03 20:08]
"Orsm"="C:\DOCUME~1\ACTION~1\APPLIC~1\MANTEC~1\csrss.exe" []
"QdrModule10"="C:\Program Files\QdrModule\QdrModule10.exe" []
"Hsj"="C:\Documents and Settings\Actionnet\My Documents\s?mbols\?hkdsk.exe" []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-03 23:00]
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-03 23:00]
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-03 23:00]
"ISAM SMT Service"="C:\Program Files\C4ebreg\isamsmt.exe" [2005-12-06 10:57]
"ISAMTray"="C:\Program Files\C4ebreg\isamtray.exe" [2005-12-06 10:57]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2005-08-02 15:00]
"vptray"="C:\PROGRA~1\SYMANT~1\VPTray.exe" [2005-08-18 06:50]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2006-03-30 12:28]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-30 12:28]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2006-03-30 12:34]
"TPHOTKEY"="C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe" [2006-03-30 12:29]
"PWRMGRTR"="C:\PROGRA~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL" [2006-03-30 12:30]
"BLOG"="C:\PROGRA~1\ThinkPad\UTILIT~1\BatLogEx.DLL" [2006-03-30 12:30]
"ACTray"="C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe" [2006-01-31 16:19]
"ACWLIcon"="C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe" [2006-01-31 16:12]
"TpShocks"="TpShocks.exe" [2005-11-07 05:14 C:\WINDOWS\system32\TpShocks.exe]
"TP4EX"="tp4ex.exe" [2005-10-16 19:11 C:\WINDOWS\system32\TP4EX.exe]
"TPKMAPHELPER"="C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe" [2005-10-28 13:04]
"ISSI EZUpdate Service"="c:\sdwork\issimsvc.exe" [2006-01-18 03:00]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2006-03-30 12:34]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2006-03-30 12:33]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2006-03-30 12:34]
"deldvrw"="cmd.exe" [2004-08-03 23:00 C:\WINDOWS\system32\cmd.exe]
"w32msgr"="C:\SDWORK\W32MAIN2.exe" [2006-03-21 06:54]
"C4EBReg"="C:\Program Files\C4ebreg\c4ebreg.exe" [2005-12-06 10:57]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-09-24 02:24]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 03:00]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2006-09-25 13:54]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 10:09]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 02:06]
"eFax 4.3"="C:\Program Files\eFax Messenger 4.3\J2GDllCmd.exe" [2007-03-06 11:21]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 03:25]

C:\Documents and Settings\Nadia\Start Menu\Programs\Startup\
LimeWire On Startup.lnk - C:\Program Files\LimeWire\LimeWire.exe [2006-08-22 09:45:55]

C:\Documents and Settings\Actionnet\Start Menu\Programs\Startup\
DING!.lnk - C:\Program Files\Southwest Airlines\Ding\Ding.exe [2006-06-22 13:15:48]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Bluetooth.lnk - C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe [2005-11-01 08:10:32]
eFax 4.3.lnk - C:\Program Files\eFax Messenger 4.3\J2GTray.exe [2007-09-27 18:56:00]
WinZip Quick Pick.lnk - C:\Program Files\WinZip\WZQKPICK.EXE [2007-08-03 11:10:00]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDevMgrUpdate"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ACNotify]
ACNotify.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tpfnf2]
notifyf2.dll 2006-03-30 12:29 28672 C:\WINDOWS\system32\notifyf2.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tphotkey]
tphklock.dll 2006-03-30 12:29 24576 C:\WINDOWS\system32\tphklock.dll

R0 Shockprf;Shockprf;C:\WINDOWS\system32\drivers\Shockprf.sys
R1 ANC;ANC;C:\WINDOWS\system32\drivers\ANC.SYS
R1 IBMTPCHK;IBMTPCHK;\??\C:\WINDOWS\system32\Drivers\IBMBLDID.sys
R1 ShockMgr;ShockMgr;C:\WINDOWS\system32\drivers\ShockMgr.sys
R1 TPPWRIF;TPPWRIF;C:\WINDOWS\system32\drivers\Tppwrif.sys
R3 ABVPN2K;Net Firewall Miniport Interface;C:\WINDOWS\system32\DRIVERS\abvpn2k.sys
R3 AEAudioService;AEAudio Service;C:\WINDOWS\system32\drivers\AEAudio.sys
R3 atmeltpm;atmeltpm;C:\WINDOWS\system32\DRIVERS\atmeltpm.sys
R3 avpnnic;AGN Virtual Network Adapter;C:\WINDOWS\system32\DRIVERS\avpnnic.sys

.
Contents of the 'Scheduled Tasks' folder
"2007-10-09 17:33:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2007-12-09 15:33:02 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job"
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
"2007-12-09 15:52:02 C:\WINDOWS\Tasks\PMTask.job"
- C:\PROGRA~1\ThinkPad\UTILIT~1\PWMIDTSK.EXE
.
——————— DLLs Loaded Under Running Processes ———————

PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\Program Files\ThinkPad\ConnectUtilities\AcSvcStub.dll
-> C:\Program Files\ThinkPad\ConnectUtilities\AcLocSettings.dll
-> C:\Program Files\ThinkPad\ConnectUtilities\ACHelper.dll
-> C:\WINDOWS\system32\tphklock.dll
-> C:\WINDOWS\system32\notifyf2.dll
PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\Program Files\ThinkPad\ConnectUtilities\AcSvcStub.dll
-> C:\Program Files\ThinkPad\ConnectUtilities\AcLocSettings.dll
-> C:\Program Files\ThinkPad\ConnectUtilities\ACHelper.dll
-> C:\WINDOWS\system32\tphklock.dll

PROCESS: C:\WINDOWS\Explorer.EXE [6.00.2900.3156]
-> C:\PROGRA~1\ThinkPad\UTILIT~1\US\PWRMGRRT.DLL
-> C:\PROGRA~1\ThinkPad\UTILIT~1\PWRMGRIF.DLL
PROCESS: C:\WINDOWS\Explorer.EXE [6.00.2900.3156]
-> C:\PROGRA~1\ThinkPad\UTILIT~1\US\PWRMGRRT.DLL
-> C:\PROGRA~1\ThinkPad\UTILIT~1\PWRMGRIF.DLL
-> C:\DOCUME~1\ACTION~1\LOCALS~1\Temp\xieibkxpC68EB81.dll
.
**************************************************************************

catchme 0.3.1331 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-09 09:52:51
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-12-09 9:53:49 - machine was rebooted
.
— E O F —

Here is a fresh Hjt.log:

Logfile of HijackThis v1.99.1
Scan saved at 10:08:32 AM, on 12/9/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\ibmpmsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\ThinkPad\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\C4ebreg\isamsmt.exe
c:\sdwork\issimsvc.exe
C:\PROGRA~1\AT&TNE~1\NetCfgSv.EXE
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\System32\TPHDEXLG.EXE
C:\WINDOWS\system32\TpKmpSVC.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe
C:\WINDOWS\system32\acs.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\C4ebreg\isamtray.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe
C:\WINDOWS\system32\TpShocks.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\C4ebreg\c4ebreg.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\Program Files\eFax Messenger 4.3\J2GDllCmd.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Lenovo\PkgMgr\HOTKEY\TPONSCR.exe
C:\Program Files\Lenovo\PkgMgr\HOTKEY_1\TpScrex.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe
C:\Program Files\eFax Messenger 4.3\J2GTray.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Southwest Airlines\Ding\Ding.exe
C:\PROGRA~1\ThinkPad\BLUETO~1\BTSTAC~1.EXE
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Java\jre1.6.0_02\bin\jucheck.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://w3.ibm.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://w3.ibm.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = ;
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [ISAM SMT Service] "C:\Program Files\C4ebreg\isamsmt.exe"
O4 - HKLM\..\Run: [ISAMTray] "C:\Program Files\C4ebreg\isamtray.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe
O4 - HKLM\..\Run: [PWRMGRTR] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL,PwrMgrBkGndMonitor
O4 - HKLM\..\Run: [BLOG] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\BatLogEx.DLL,StartBattLog
O4 - HKLM\..\Run: [ACTray] C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe
O4 - HKLM\..\Run: [ACWLIcon] C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe
O4 - HKLM\..\Run: [TpShocks] TpShocks.exe
O4 - HKLM\..\Run: [TP4EX] tp4ex.exe
O4 - HKLM\..\Run: [TPKMAPHELPER] C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe -helper
O4 - HKLM\..\Run: [ISSI EZUpdate Service] "c:\sdwork\issimsvc.exe"
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [deldvrw] cmd.exe /c rmdir /s /q C:\ibmtools\apps\dvdwrite
O4 - HKLM\..\Run: [w32msgr] C:\SDWORK\W32MAIN2.exe /log C:\SDWORK\MSGR.TXT OSPDB.POK.IBM.COM
O4 - HKLM\..\Run: [C4EBReg] "C:\Program Files\C4ebreg\c4ebreg.exe" /q
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [eFax 4.3] "C:\Program Files\eFax Messenger 4.3\J2GDllCmd.exe" /R
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Orsm] "C:\DOCUME~1\ACTION~1\APPLIC~1\MANTEC~1\csrss.exe" -vt yazb
O4 - HKCU\..\Run: [QdrModule10] "C:\Program Files\QdrModule\QdrModule10.exe"
O4 - HKCU\..\Run: [Hsj] "C:\Documents and Settings\Actionnet\My Documents\s?mbols\?hkdsk.exe"
O4 - Startup: DING!.lnk = C:\Program Files\Southwest Airlines\Ding\Ding.exe
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: eFax 4.3.lnk = C:\Program Files\eFax Messenger 4.3\J2GTray.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm
O14 - IERESET.INF: START_PAGE_URL=http://w3.ibm.com
O16 - DPF: {DECEAAA2-370A-49BB-9362-68C3A58DDC62} - http://static.zangocash.com/cab/Zango/ie/b…b7009011a32ce0f
O16 - DPF: {FDD6CEF8-3C6E-42E0-BC7B-D730085CFABC} (Jaxtr Outlook Importer) - http://www.jaxtr.com/user/activex/JaxtrOutlookImporter.CAB
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = IBM.COM
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = IBM.COM
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = IBM.COM
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll
O20 - Winlogon Notify: ACNotify - ACNotify.dll (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O20 - Winlogon Notify: tpfnf2 - C:\WINDOWS\SYSTEM32\notifyf2.dll
O20 - Winlogon Notify: tphotkey - C:\WINDOWS\SYSTEM32\tphklock.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Ac Profile Manager Service (AcPrfMgrSvc) - Unknown owner - C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe
O23 - Service: ACU Configuration Service (ACS) - Unknown owner - C:\WINDOWS\system32\acs.exe
O23 - Service: Access Connections Main Service (AcSvc) - Lenovo - C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\ThinkPad\Bluetooth Software\bin\btwdins.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: ThinkPad PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\system32\ibmpmsvc.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ISAM SMT Service (ISAMsmt) - IBM Global Services - C:\Program Files\C4ebreg\isamsmt.exe
O23 - Service: ISSI EZUpdate (ISSIMon) - IBM Global Services - c:\sdwork\issimsvc.exe
O23 - Service: Network Configuration Service (NetCfgSvr) - AT&T - C:\PROGRA~1\AT&TNE~1\NetCfgSv.EXE
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: ThinkPad HDD APS Logging Service (TPHDEXLGSVC) - Lenovo. - C:\WINDOWS\System32\TPHDEXLG.EXE
O23 - Service: IBM KCU Service (TpKmpSVC) - Unknown owner - C:\WINDOWS\system32\TpKmpSVC.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

ussurplus

Post #8December 11, 2007, 3:57 AM UTC

Hello IndiGenus. I'm sorry for being a pest, but do you think I'm clear now? My computer seems to be working fine now, and I don't have that "savethisinformation.com" any more! I just need to hear from you if I'm ok ! Please let me know. Thanks, Ray

IndiGenus

Post #9December 11, 2007, 2:13 PM UTC

You're much closer. I am tied up most of the day today but will get back to you later this afternoon or evening (eastern time). We still have some cleanup to to. But yes, it does look a lot better and glad to hear it's running better. You had a pretty seriously infected PC here, as shown by all the baddies deleted with the tools so far, just a bit more work to do though to make sure it doesn't rear it's ugly head again. dave

IndiGenus

Post #10December 12, 2007, 12:20 AM UTC

First, I would recommend you remove the NoAdware program. It was once on the rogue program list and although it has been removed there are still more robust, free, effective AntiMalware programs.

1. Please open Notepad

Click Start , then Run
Type notepad .exe in the Run Box.

2. Now copy/paste the entire content of the codebox below into the Notepad window:

File::
C:\WINDOWS\system32\nbfpittu.exe
C:\WINDOWS\system32\axlvcwck.ini

Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Orsm"=-
"Hsj"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

3. Save the above as CFScript.txt

4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

[external image: Posted Image]

5. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:

Combofix.txt
A new HijackThis log.

The following folders are from a Purity Scan infection. Please delete them using windows explorer.

You will need to identify what the ? and the ~ are delete the correct folder.

C:\Documents and Settings\Actionnet\My Documents\s?mbols
C:\DOCUME~1\ACTION~1\APPLIC~1\MANTEC~1

———————————————-

Using Internet Explorer, click on Kaspersky Online Scanner * Click 'Accept' in the window that pops up.
* You will be prompted to install an ActiveX component from Kaspersky, Click on the information bar and select Install ActiveX Control if so. This may happen more than once. That is OK. You also may get a warning from your Windows Firewall. You can tell it to unblock.
* The program will launch and then start to download the latest definition files.
* Once the scanner is installed and the definitions downloaded, click 'Next'.
* Now click on 'Scan Settings'
* In the scan settings make sure that the following are selected:
o Scan using the following Anti-Virus database: 'Extended' (If available, otherwise 'Standard')
o Scan Options: 'Scan Archives' and 'Scan Mail Bases'
* Click 'OK'
* Now under 'Select a target to scan' select 'My Computer'
* The scan will take a while, so be patient and let it run. Once the scan is complete, it will display whether your system has been infected.
* Now click on the 'Save Report As…' button:
* Make sure it says Save as a text file - change it if not
* Save the file to your desktop.
Please post the Kaspersky report and a new HijackThis log.

ussurplus

Post #11December 12, 2007, 1:55 AM UTC

Thank you very much for replying to me. Unfortunately, I'm leaving town this evening and I will not be back till Thursday evening. I want to give the instructions you provided me full anttention so that it is done right. I will talk to you very soon. Thanks Again IndiGenus. You Rock! Ray

IndiGenus

Post #12December 12, 2007, 2:22 AM UTC

No problem Ray, have a good trip. Dave

ussurplus

Post #13December 19, 2007, 4:06 AM UTC

Hello IndiGenus. I'm back!! took longer than I thought. When I went to drag CFscript.txt into the combofix.exe, a pop up said that my combofix.exe is old and therefore was not able to continue the procedure. I went back and downloaded combofix to get a fresh copy, but I did not save the log on the notepad thinking that you did not need the results again. I restarted my computer since I did not get my desktop back, but I was not able to find combofix.exe on the desktop!!! where did I go wronge? Thank you, Ray

IndiGenus

Post #14December 19, 2007, 11:28 AM UTC

Hi Ray, Not quite sure what happened there. CF does have a time limit built in for expiration because it is always updated by the developer, so that part is normal and expected. But not sure why when you removed it downloaded a fresh copy you can't find it. Did you download it to the desktop? Well anyway, just download a fresh copy, making sure to your desktop, then follow my instructions from post #10 to create and run the CFScript. Then post the log. Dave

ussurplus

Post #15December 21, 2007, 11:13 PM UTC

Hello IndiGenus.

Wow, it is taking for ever to write to you now!!!!! I did run a fresh copy of combofix and a Hijack this log and here they are. My computer is running very slowwwwwwwww. I don't know what happend!!! This just happend after I ran the combofix. Your feedback as alwyas much appreciated. also Should I do other steps in post #10? This computer is going extremley slow!

Thank you,

Ray

Logfile of HijackThis v1.99.1
Scan saved at 4:34:38 PM, on 12/21/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\ibmpmsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\ThinkPad\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\C4ebreg\isamsmt.exe
c:\sdwork\issimsvc.exe
C:\PROGRA~1\AT&TNE~1\NetCfgSv.EXE
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\System32\TPHDEXLG.EXE
C:\WINDOWS\system32\TpKmpSVC.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe
C:\WINDOWS\system32\acs.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\C4ebreg\isamtray.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe
C:\WINDOWS\system32\TpShocks.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\C4ebreg\c4ebreg.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\eFax Messenger 4.3\J2GDllCmd.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Lenovo\PkgMgr\HOTKEY\TPONSCR.exe
C:\Program Files\Lenovo\PkgMgr\HOTKEY_1\TpScrex.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe
C:\Program Files\eFax Messenger 4.3\J2GTray.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Southwest Airlines\Ding\Ding.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\ThinkPad\BLUETO~1\BTSTAC~1.EXE
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://w3.ibm.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://w3.ibm.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = ;
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [ISAM SMT Service] "C:\Program Files\C4ebreg\isamsmt.exe"
O4 - HKLM\..\Run: [ISAMTray] "C:\Program Files\C4ebreg\isamtray.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe
O4 - HKLM\..\Run: [PWRMGRTR] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL,PwrMgrBkGndMonitor
O4 - HKLM\..\Run: [BLOG] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\BatLogEx.DLL,StartBattLog
O4 - HKLM\..\Run: [ACTray] C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe
O4 - HKLM\..\Run: [ACWLIcon] C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe
O4 - HKLM\..\Run: [TpShocks] TpShocks.exe
O4 - HKLM\..\Run: [TP4EX] tp4ex.exe
O4 - HKLM\..\Run: [TPKMAPHELPER] C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe -helper
O4 - HKLM\..\Run: [ISSI EZUpdate Service] "c:\sdwork\issimsvc.exe"
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [deldvrw] cmd.exe /c rmdir /s /q C:\ibmtools\apps\dvdwrite
O4 - HKLM\..\Run: [w32msgr] C:\SDWORK\W32MAIN2.exe /log C:\SDWORK\MSGR.TXT OSPDB.POK.IBM.COM
O4 - HKLM\..\Run: [C4EBReg] "C:\Program Files\C4ebreg\c4ebreg.exe" /q
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [eFax 4.3] "C:\Program Files\eFax Messenger 4.3\J2GDllCmd.exe" /R
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [QdrModule10] "C:\Program Files\QdrModule\QdrModule10.exe"
O4 - Startup: DING!.lnk = C:\Program Files\Southwest Airlines\Ding\Ding.exe
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: eFax 4.3.lnk = C:\Program Files\eFax Messenger 4.3\J2GTray.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm
O14 - IERESET.INF: START_PAGE_URL=http://w3.ibm.com
O16 - DPF: {DECEAAA2-370A-49BB-9362-68C3A58DDC62} - http://static.zangocash.com/cab/Zango/ie/b…b7009011a32ce0f
O16 - DPF: {FDD6CEF8-3C6E-42E0-BC7B-D730085CFABC} (Jaxtr Outlook Importer) - http://www.jaxtr.com/user/activex/JaxtrOutlookImporter.CAB
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = IBM.COM
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = IBM.COM
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = IBM.COM
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll
O20 - Winlogon Notify: ACNotify - ACNotify.dll (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O20 - Winlogon Notify: tpfnf2 - C:\WINDOWS\SYSTEM32\notifyf2.dll
O20 - Winlogon Notify: tphotkey - C:\WINDOWS\SYSTEM32\tphklock.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Ac Profile Manager Service (AcPrfMgrSvc) - Unknown owner - C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe
O23 - Service: ACU Configuration Service (ACS) - Unknown owner - C:\WINDOWS\system32\acs.exe
O23 - Service: Access Connections Main Service (AcSvc) - Lenovo - C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\ThinkPad\Bluetooth Software\bin\btwdins.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: ThinkPad PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\system32\ibmpmsvc.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ISAM SMT Service (ISAMsmt) - IBM Global Services - C:\Program Files\C4ebreg\isamsmt.exe
O23 - Service: ISSI EZUpdate (ISSIMon) - IBM Global Services - c:\sdwork\issimsvc.exe
O23 - Service: Network Configuration Service (NetCfgSvr) - AT&T - C:\PROGRA~1\AT&TNE~1\NetCfgSv.EXE
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: ThinkPad HDD APS Logging Service (TPHDEXLGSVC) - Lenovo. - C:\WINDOWS\System32\TPHDEXLG.EXE
O23 - Service: IBM KCU Service (TpKmpSVC) - Unknown owner - C:\WINDOWS\system32\TpKmpSVC.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Here is the combofix report:

ComboFix 07-12-21.4 - Actionnet 2007-12-21 16:19:33.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.587 [GMT -6:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Actionnet\Desktop\cfscript.txt
* Created a new restore point

FILE
C:\WINDOWS\system32\axlvcwck.ini
C:\WINDOWS\system32\nbfpittu.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\axlvcwck.ini

.
((((((((((((((((((((((((( Files Created from 2007-11-21 to 2007-12-21 )))))))))))))))))))))))))))))))
.

2007-12-10 17:52 . 2007-12-10 17:52 d——– C:\Documents and Settings\Guest\Application Data\Grisoft
2007-12-08 10:38 . 2007-12-08 10:38 d——– C:\WINDOWS\ERUNT
2007-12-05 19:33 . 2007-12-05 19:33 d——– C:\Documents and Settings\Administrator\Application Data\Grisoft
2007-12-05 18:55 . 2007-12-05 18:55 d——– C:\Documents and Settings\Actionnet\Application Data\Grisoft
2007-12-05 18:53 . 2007-12-05 18:53 d——– C:\Documents and Settings\All Users\Application Data\Grisoft
2007-12-05 18:53 . 2007-05-30 06:10 10,872 –a—— C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-12-02 21:50 . 2007-12-02 22:11 d——– C:\Program Files\NoAdware5.0
2007-12-02 20:52 . 2007-12-02 20:53 d——– C:\Documents and Settings\All Users\Application Data\WinZip
2007-12-02 20:38 . 2007-12-02 20:38 54,156 –ah—– C:\WINDOWS\QTFont.qfn
2007-12-02 20:38 . 2007-12-02 20:38 1,409 –a—— C:\WINDOWS\QTFont.for
2007-12-02 16:29 . 2006-11-29 13:06 3,426,072 –a—— C:\WINDOWS\system32\d3dx9_32.dll
2007-12-02 16:28 . 2007-12-02 16:28 d——– C:\Program Files\Microsoft SQL Server Compact Edition
2007-12-02 16:19 . 2007-12-02 16:21 d–hsc— C:\Program Files\Common Files\WindowsLiveInstaller
2007-12-02 16:18 . 2007-12-02 16:30 d——– C:\Program Files\Windows Live
2007-12-02 16:18 . 2007-12-02 20:29 d——– C:\Documents and Settings\All Users\Application Data\WLInstaller
2007-12-02 10:40 . 2007-12-02 10:40 d——– C:\Documents and Settings\Administrator\Application Data\eFax Messenger

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-21 22:07 ——— d—–w C:\Program Files\C4ebreg
2007-12-21 22:03 ——— d—–w C:\Program Files\Symantec AntiVirus
2007-12-19 03:03 ——— d—–w C:\Program Files\Common Files\Wise Installation Wizard
2007-12-18 02:45 ——— d—–w C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2007-12-02 23:42 ——— d—–w C:\Program Files\MSN Messenger
2007-11-30 06:17 ——— d—–w C:\Program Files\Windows Live Toolbar
2007-11-27 05:23 1,887,887 —-a-w C:\WINDOWS\Internet Logs\tvDebug.zip
2007-11-21 03:43 ——— d—–w C:\Documents and Settings\Administrator\Application Data\acccore
2007-11-18 00:57 ——— d—–w C:\Program Files\Disney
2007-11-13 10:25 20,480 —-a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-10-29 22:43 1,287,680 —-a-w C:\WINDOWS\system32\quartz.dll
2007-10-28 20:54 ——— d—–w C:\Program Files\ABC Amber PDF Converter
2007-10-27 23:39 230,912 —-a-w C:\WINDOWS\system32\wmasf.dll
2007-10-23 23:06 585,728 —-a-w C:\WINDOWS\WLXPGSS.SCR
2007-10-18 17:31 51,224 —-a-w C:\WINDOWS\system32\sirenacm.dll
.

((((((((((((((((((((((((((((( snapshot@2007-12-18_21.44.51.48 )))))))))))))))))))))))))))))))))))))))))
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2007-03-03 20:08]
"QdrModule10"="C:\Program Files\QdrModule\QdrModule10.exe" []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-03 23:00]
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-03 23:00]
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-03 23:00]
"ISAM SMT Service"="C:\Program Files\C4ebreg\isamsmt.exe" [2005-12-06 10:57]
"ISAMTray"="C:\Program Files\C4ebreg\isamtray.exe" [2005-12-06 10:57]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2005-08-02 15:00]
"vptray"="C:\PROGRA~1\SYMANT~1\VPTray.exe" [2005-08-18 06:50]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2006-03-30 12:28]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-30 12:28]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2006-03-30 12:34]
"TPHOTKEY"="C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe" [2006-03-30 12:29]
"PWRMGRTR"="C:\PROGRA~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL" [2006-03-30 12:30]
"BLOG"="C:\PROGRA~1\ThinkPad\UTILIT~1\BatLogEx.DLL" [2006-03-30 12:30]
"ACTray"="C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe" [2006-01-31 16:19]
"ACWLIcon"="C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe" [2006-01-31 16:12]
"TpShocks"="TpShocks.exe" [2005-11-07 05:14 C:\WINDOWS\system32\TpShocks.exe]
"TP4EX"="tp4ex.exe" [2005-10-16 19:11 C:\WINDOWS\system32\TP4EX.exe]
"TPKMAPHELPER"="C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe" [2005-10-28 13:04]
"ISSI EZUpdate Service"="c:\sdwork\issimsvc.exe" [2006-01-18 03:00]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2006-03-30 12:34]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2006-03-30 12:33]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2006-03-30 12:34]
"deldvrw"="cmd.exe" [2004-08-03 23:00 C:\WINDOWS\system32\cmd.exe]
"w32msgr"="C:\SDWORK\W32MAIN2.exe" [2006-03-21 06:54]
"C4EBReg"="C:\Program Files\C4ebreg\c4ebreg.exe" [2005-12-06 10:57]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-09-24 02:24]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 03:00]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2006-09-25 13:54]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 10:09]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 02:06]
"eFax 4.3"="C:\Program Files\eFax Messenger 4.3\J2GDllCmd.exe" [2007-03-06 11:21]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 03:25]

C:\Documents and Settings\Nadia\Start Menu\Programs\Startup\
LimeWire On Startup.lnk - C:\Program Files\LimeWire\LimeWire.exe [2006-08-22 09:45:55]

C:\Documents and Settings\Actionnet\Start Menu\Programs\Startup\
DING!.lnk - C:\Program Files\Southwest Airlines\Ding\Ding.exe [2006-06-22 13:15:48]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Bluetooth.lnk - C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe [2005-11-01 08:10:32]
eFax 4.3.lnk - C:\Program Files\eFax Messenger 4.3\J2GTray.exe [2007-09-27 18:56:00]
WinZip Quick Pick.lnk - C:\Program Files\WinZip\WZQKPICK.EXE [2007-08-03 11:10:00]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDevMgrUpdate"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ACNotify]
ACNotify.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tpfnf2]
notifyf2.dll 2006-03-30 12:29 28672 C:\WINDOWS\system32\notifyf2.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tphotkey]
tphklock.dll 2006-03-30 12:29 24576 C:\WINDOWS\system32\tphklock.dll

R0 Shockprf;Shockprf;C:\WINDOWS\system32\drivers\Shockprf.sys [2005-11-30 09:58]
R1 ANC;ANC;C:\WINDOWS\system32\drivers\ANC.SYS [2005-11-08 03:27]
R1 IBMTPCHK;IBMTPCHK;C:\WINDOWS\system32\Drivers\IBMBLDID.sys [2006-01-12 18:33]
R1 ShockMgr;ShockMgr;C:\WINDOWS\system32\drivers\ShockMgr.sys [2005-06-20 06:18]
R1 TPPWRIF;TPPWRIF;C:\WINDOWS\system32\drivers\Tppwrif.sys [2006-03-30 12:30]
R3 ABVPN2K;Net Firewall Miniport Interface;C:\WINDOWS\system32\DRIVERS\abvpn2k.sys [2004-06-03 11:47]
R3 AEAudioService;AEAudio Service;C:\WINDOWS\system32\drivers\AEAudio.sys [2006-03-30 12:34]
R3 atmeltpm;atmeltpm;C:\WINDOWS\system32\DRIVERS\atmeltpm.sys [2006-03-30 12:37]
R3 avpnnic;AGN Virtual Network Adapter;C:\WINDOWS\system32\DRIVERS\avpnnic.sys [2003-04-04 06:48]

.
Contents of the 'Scheduled Tasks' folder
"2007-10-09 17:33:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2007-12-21 18:33:02 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job"
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
"2007-12-21 22:06:56 C:\WINDOWS\Tasks\PMTask.job"
- C:\PROGRA~1\ThinkPad\UTILIT~1\PWMIDTSK.EXE
.
**************************************************************************

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-21 16:21:45
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\Program Files\ThinkPad\ConnectUtilities\AcSvcStub.dll
-> C:\Program Files\ThinkPad\ConnectUtilities\AcLocSettings.dll
-> C:\Program Files\ThinkPad\ConnectUtilities\ACHelper.dll
-> C:\WINDOWS\system32\tphklock.dll
-> C:\WINDOWS\system32\notifyf2.dll

PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\Program Files\ThinkPad\ConnectUtilities\AcSvcStub.dll
-> C:\Program Files\ThinkPad\ConnectUtilities\AcLocSettings.dll
-> C:\Program Files\ThinkPad\ConnectUtilities\ACHelper.dll
-> C:\WINDOWS\system32\tphklock.dll

PROCESS: C:\WINDOWS\Explorer.EXE [6.00.2900.3156]
-> C:\PROGRA~1\ThinkPad\UTILIT~1\US\PWRMGRRT.DLL
-> C:\PROGRA~1\ThinkPad\UTILIT~1\PWRMGRIF.DLL
.
Completion time: 2007-12-21 16:22:28
C:\ComboFix2.txt … 2007-12-18 21:45
C:\ComboFix3.txt … 2007-12-09 09:53
.
2007-12-21 14:05:46 — E O F —

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] spyware and malware attack. Please help!

✨ Ask AI

Ask AI