What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] I think I got everything :(

5 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I had the following goodies on my system, Trojans: Backdoor.agent.PTA, Virtum-Gen and Adware: lopdotcom & virtumonde. I think I killed them all but I would like to make sure. Thank you so much for this service, I truly appreciate it! My computer is having problems with pop-ups and general sluggish behavior with Internet Explorer.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:49:51 PM, on 12/18/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Verizon\VSP\VerizonServicepoint.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Common Files\Command Software\dvpapi.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Install\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: {55c60bef-87e8-e18b-c8a4-2a312bb068c3} - {3c860bb2-13a2-4a8c-b81e-8e78feb06c55} - C:\WINDOWS\system32\awhsdbky.dll (file missing)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {598C3C27-1A77-4360-86FB-297E0A5AA48E} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {A1C05F95-DF30-4CE5-A646-D0761D685E83} - C:\WINDOWS\system32\ddabb.dll (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: (no name) - {ABB68206-5154-47D3-ABC5-611C1658ABA0} - (no file)
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [AVG7_CC] "C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" /STARTUP
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [VerizonServicepoint.exe] "C:\Program Files\Verizon\VSP\VerizonServicepoint.exe" /AUTORUN
O4 - HKCU\..\Run: [SpybotSD TeaTimer] "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe"
O4 - HKCU\..\Run: [DDC] C:\WINDOWS\system32\dmyywsab.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.emachines.com
O16 - DPF: vzTCPConfig - http://www2.verizon.net/help/fios_settings…vzTCPConfig.CAB
O16 - DPF: {49232000-16E4-426C-A231-62846947304B} (SysData Class) - http://ipgweb.cce.hp.com/rdqaio/downloads/sysinfo.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1196382177218
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1196391178406
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl-esd.sun.com/update/1.6.0/jin…ows-i586-jc.cab
O16 - DPF: {9D190AE6-C81E-4039-8061-978EBAD10073} (F-Secure Online Scanner 3.0) - http://runvirusscan.com/ols3/fscax.cab
O20 - Winlogon Notify: awtqqrr - awtqqrr.dll (file missing)
O20 - Winlogon Notify: wineij32 - C:\WINDOWS\
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe Active File Monitor V5 (AdobeActiveFileMonitor5.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: DvpApi (dvpapi) - Command Software Systems, Inc. - C:\Program Files\Common Files\Command Software\dvpapi.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe

–
End of file - 7725 bytes



StartupList report, 12/18/2007, 3:50:17 PM
StartupList version: 1.52.2
Started from : C:\Install\HiJackThis.EXE
Detected: Windows XP SP2 (WinNT 5.01.2600)
Detected: Internet Explorer v7.00 (7.00.6000.16574)
* Using default options
==================================================

Running processes:

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Verizon\VSP\VerizonServicepoint.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Common Files\Command Software\dvpapi.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Install\HiJackThis.exe
C:\WINDOWS\system32\NOTEPAD.EXE

————————————————–

Checking Windows NT UserInit:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS\system32\userinit.exe,

————————————————–

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

AVG7_CC = "C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" /STARTUP
SunJavaUpdateSched = "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
VerizonServicepoint.exe = "C:\Program Files\Verizon\VSP\VerizonServicepoint.exe" /AUTORUN

————————————————–

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

SpybotSD TeaTimer = "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe"
DDC = C:\WINDOWS\system32\dmyywsab.exe
ctfmon.exe = C:\WINDOWS\system32\ctfmon.exe

————————————————–

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

Shell=*INI section not found*
SCRNSAVE.EXE=*INI section not found*
drivers=*INI section not found*

Shell & screensaver key from Registry:

Shell=Explorer.exe
SCRNSAVE.EXE=C:\WINDOWS\System32\logon.scr
drivers=*Registry value not found*

Policies Shell key:

HKCU\..\Policies: Shell=*Registry value not found*
HKLM\..\Policies: Shell=*Registry value not found*

————————————————–


Enumerating Browser Helper Objects:

(no name) - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
{55c60bef-87e8-e18b-c8a4-2a312bb068c3} - C:\WINDOWS\system32\awhsdbky.dll (file missing) - {3c860bb2-13a2-4a8c-b81e-8e78feb06c55}
(no name) - C:\PROGRA~1\SPYBOT~1\SDHelper.dll - {53707962-6F74-2D53-2644-206D7942484F}
(no name) - (no file) - {598C3C27-1A77-4360-86FB-297E0A5AA48E}
(no name) - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}
(no name) - C:\WINDOWS\system32\ddabb.dll (file missing) - {A1C05F95-DF30-4CE5-A646-D0761D685E83}
(no name) - c:\program files\google\googletoolbar1.dll - {AA58ED58-01DD-4d91-8333-CF10577473F7}
(no name) - (no file) - {ABB68206-5154-47D3-ABC5-611C1658ABA0}
(no name) - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D}

————————————————–

Enumerating Task Scheduler jobs:

AppleSoftwareUpdate.job
HP Usg Daily.job
Norton Security Scan.job
Spybot - Search & Destroy - Scheduled Task.job

————————————————–

Enumerating Download Program Files:

[vzTCPConfig]
CODEBASE = http://www2.verizon.net/help/fios_settings…vzTCPConfig.CAB
OSD = C:\WINDOWS\Downloaded Program Files\OSD7C0.OSD

[Office Genuine Advantage Validation Tool]
InProcServer32 = C:\WINDOWS\system32\OGACheckControl.DLL
CODEBASE = http://download.microsoft.com/download/e/7…/OGAControl.cab

[SysData Class]
InProcServer32 = C:\WINDOWS\DOWNLO~1\SysInfo.dll
CODEBASE = http://ipgweb.cce.hp.com/rdqaio/downloads/sysinfo.cab

[WUWebControl Class]
InProcServer32 = C:\WINDOWS\System32\wuweb.dll
CODEBASE = http://www.update.microsoft.com/windowsupd…b?1196382177218

[MUWebControl Class]
InProcServer32 = C:\WINDOWS\system32\muweb.dll
CODEBASE = http://www.update.microsoft.com/microsoftu…b?1196391178406

[HP Download Manager]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\HPDEXAXO.dll
CODEBASE = https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab

[Java Plug-in 1.6.0_03]
InProcServer32 = C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
CODEBASE = http://javadl-esd.sun.com/update/1.6.0/jin…ows-i586-jc.cab

[{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}]
CODEBASE = http://fpdownload.macromedia.com/get/flash…t/ultrashim.cab

[F-Secure Online Scanner 3.0]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\fscax.dll
CODEBASE = http://runvirusscan.com/ols3/fscax.cab

[Office Update Installation Engine]
InProcServer32 = C:\WINDOWS\opuc.dll
CODEBASE = http://office.microsoft.com/officeupdate/content/opuc4.cab

————————————————–

Enumerating ShellServiceObjectDelayLoad items:

PostBootReminder: C:\WINDOWS\system32\SHELL32.dll
CDBurn: C:\WINDOWS\system32\SHELL32.dll
WebCheck: C:\WINDOWS\system32\webcheck.dll
SysTray: C:\WINDOWS\System32\stobject.dll
WPDShServiceObj: C:\WINDOWS\system32\WPDShServiceObj.dll

————————————————–
End of report, 6,847 bytes
Report generated in 0.062 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only
Post #2
tdoran70,

Welcome to the forum, sorry for the delay but it gets a little busy around here. If you have not resolved your issue do this.

C:\Install\HiJackThis.exe <– Right click on the HJT icon ( looks like a man with a spyglass ) and rename it to Scanner.exe and post a new log please
Post #3
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:40:28 AM, on 12/25/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Verizon\VSP\VerizonServicepoint.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Common Files\Command Software\dvpapi.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Install\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: {55c60bef-87e8-e18b-c8a4-2a312bb068c3} - {3c860bb2-13a2-4a8c-b81e-8e78feb06c55} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {598C3C27-1A77-4360-86FB-297E0A5AA48E} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {A1C05F95-DF30-4CE5-A646-D0761D685E83} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: (no name) - {ABB68206-5154-47D3-ABC5-611C1658ABA0} - (no file)
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [AVG7_CC] "C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" /STARTUP
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [VerizonServicepoint.exe] "C:\Program Files\Verizon\VSP\VerizonServicepoint.exe" /AUTORUN
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [SpybotSD TeaTimer] "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.emachines.com
O16 - DPF: vzTCPConfig - http://www2.verizon.net/help/fios_settings…vzTCPConfig.CAB
O16 - DPF: {49232000-16E4-426C-A231-62846947304B} (SysData Class) - http://ipgweb.cce.hp.com/rdqaio/downloads/sysinfo.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1196382177218
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1196391178406
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl-esd.sun.com/update/1.6.0/jin…ows-i586-jc.cab
O16 - DPF: {9D190AE6-C81E-4039-8061-978EBAD10073} (F-Secure Online Scanner 3.0) - http://runvirusscan.com/ols3/fscax.cab
O20 - Winlogon Notify: awtqqrr - awtqqrr.dll (file missing)
O20 - Winlogon Notify: wineij32 - C:\WINDOWS\
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe Active File Monitor V5 (AdobeActiveFileMonitor5.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: DvpApi (dvpapi) - Command Software Systems, Inc. - C:\Program Files\Common Files\Command Software\dvpapi.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe

–
End of file - 7650 bytes
Post #4
Merry Christmas, Everything we ask you to do is for a purpose, please re read my post about renaming Hijackthis and post a new log please. With the holidays, my replies may be a little tardy.
Post #5
Sorry about that! I changed it on my desktop, not the Install folder :0

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:08:27 PM, on 12/25/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Verizon\VSP\VerizonServicepoint.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Common Files\Command Software\dvpapi.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
C:\Install\Scanner.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: {55c60bef-87e8-e18b-c8a4-2a312bb068c3} - {3c860bb2-13a2-4a8c-b81e-8e78feb06c55} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {598C3C27-1A77-4360-86FB-297E0A5AA48E} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {A1C05F95-DF30-4CE5-A646-D0761D685E83} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: (no name) - {ABB68206-5154-47D3-ABC5-611C1658ABA0} - (no file)
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [AVG7_CC] "C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" /STARTUP
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [VerizonServicepoint.exe] "C:\Program Files\Verizon\VSP\VerizonServicepoint.exe" /AUTORUN
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [SpybotSD TeaTimer] "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.emachines.com
O16 - DPF: vzTCPConfig - http://www2.verizon.net/help/fios_settings…vzTCPConfig.CAB
O16 - DPF: {49232000-16E4-426C-A231-62846947304B} (SysData Class) - http://ipgweb.cce.hp.com/rdqaio/downloads/sysinfo.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1196382177218
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1196391178406
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl-esd.sun.com/update/1.6.0/jin…ows-i586-jc.cab
O16 - DPF: {9D190AE6-C81E-4039-8061-978EBAD10073} (F-Secure Online Scanner 3.0) - http://runvirusscan.com/ols3/fscax.cab
O20 - Winlogon Notify: awtqqrr - awtqqrr.dll (file missing)
O20 - Winlogon Notify: wineij32 - C:\WINDOWS\
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe Active File Monitor V5 (AdobeActiveFileMonitor5.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: DvpApi (dvpapi) - Command Software Systems, Inc. - C:\Program Files\Common Files\Command Software\dvpapi.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe

–
End of file - 7741 bytes
Post #6
Hello Again,

You need to disable the Tea Timer in Spybot Search and Destroy or it may prevent the fixes from taking.

1. Run Spybot-S&D in Advanced Mode.
2. If it is not already set to do this Go to the Mode menu select "Advanced Mode"
3. On the left hand side, Click on Tools
4. Then click on the Resident Icon in the List
5. Uncheck "Resident TeaTimer" and OK any prompts.
6. Restart your computer.




Open HijackThis > Do a System Scan Only, close your browser and all open windows including this one, the only program or window you should have open is HijackThis, check the following entries and click on Fix Checked.

O2 - BHO: {55c60bef-87e8-e18b-c8a4-2a312bb068c3} - {3c860bb2-13a2-4a8c-b81e-8e78feb06c55} - (no file)
O2 - BHO: (no name) - {598C3C27-1A77-4360-86FB-297E0A5AA48E} - (no file)
O2 - BHO: (no name) - {A1C05F95-DF30-4CE5-A646-D0761D685E83} - (no file)
O2 - BHO: (no name) - {ABB68206-5154-47D3-ABC5-611C1658ABA0} - (no file)

O20 - Winlogon Notify: awtqqrr - awtqqrr.dll (file missing)
O20 - Winlogon Notify: wineij32 - C:\WINDOWS\





Download ComboFix from Here or Here to your Desktop.
  • Double click combofix.exe and follow the prompts.
  • When finished, it shall produce a log for you. Post the Combofix log and a HiJackthis log in your next reply
Note: Do not mouseclick combofix's window while its running. That may cause it to stall





Please download ATF Cleaner by Atribune to your desktop.
  • This program is for XP and Windows 2000 only
  • Double-click ATF-Cleaner.exe to run the program.
  • Under Main choose: Select All
  • Click the Empty Selected button.

Your system may start up slower after running ATF Cleaner, this is expected but will be back to normal after the first or second boot up





Let me see the Combofix log and a New HJT log please
Post #7
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:41:37 AM, on 12/26/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Common Files\Command Software\dvpapi.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Verizon\VSP\VerizonServicepoint.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\Install\Scanner.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [AVG7_CC] "C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" /STARTUP
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [VerizonServicepoint.exe] "C:\Program Files\Verizon\VSP\VerizonServicepoint.exe" /AUTORUN
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.emachines.com
O16 - DPF: vzTCPConfig - http://www2.verizon.net/help/fios_settings…vzTCPConfig.CAB
O16 - DPF: {49232000-16E4-426C-A231-62846947304B} (SysData Class) - http://ipgweb.cce.hp.com/rdqaio/downloads/sysinfo.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1196382177218
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1196391178406
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl-esd.sun.com/update/1.6.0/jin…ows-i586-jc.cab
O16 - DPF: {9D190AE6-C81E-4039-8061-978EBAD10073} (F-Secure Online Scanner 3.0) - http://runvirusscan.com/ols3/fscax.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe Active File Monitor V5 (AdobeActiveFileMonitor5.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: DvpApi (dvpapi) - Command Software Systems, Inc. - C:\Program Files\Common Files\Command Software\dvpapi.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe

–
End of file - 7059 bytes


ComboFix 07-12-21.4 - jess 2007-12-26 9:27:27.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.347 [GMT -5:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((( Files Created from 2007-11-26 to 2007-12-26 )))))))))))))))))))))))))))))))
.

2007-12-25 19:27 . 2007-12-25 19:28 d——– C:\New Folder
2007-12-18 13:25 . 2007-12-18 14:33 d——– C:\Program Files\Spyware Doctor
2007-12-18 13:25 . 2005-09-23 07:29 626,688 –a—— C:\WINDOWS\system32\msvcr80.dll
2007-12-17 22:53 . 2007-12-17 22:53 d——– C:\Documents and Settings\jess\Application Data\Lavasoft
2007-12-17 22:33 . 2007-12-17 22:33 d——– C:\Documents and Settings\All Users\Application Data\Geek Squad
2007-12-17 16:54 . 2007-12-17 16:54 164 –a—— C:\install.dat
2007-12-17 16:52 . 2007-12-17 16:54 d——– C:\Documents and Settings\jess\Application Data\GetRightToGo
2007-12-17 11:20 . 2007-12-17 11:20 294 —hs—- C:\WINDOWS\system32\cqdicblh.ini
2007-12-17 09:48 . 2007-12-16 19:24 102,664 –ah—– C:\WINDOWS\system32\drivers\tmcomm.sys
2007-12-16 19:45 . 2007-12-17 22:50 328,090 —hs—- C:\WINDOWS\system32\bbadd.ini2
2007-12-16 19:24 . 2007-12-17 11:19 d——– C:\Documents and Settings\jess\.housecall6.6
2007-12-16 19:18 . 2007-12-16 19:18 d——– C:\Documents and Settings\jess\Application Data\Verizon
2007-12-16 13:43 . 2007-12-16 13:42 343,896 –ahs—- C:\WINDOWS\system32\bbadd.ini
2007-12-16 13:13 . 2007-12-16 13:18 343,055 —hs—- C:\WINDOWS\system32\bbadd.tmp
2007-12-16 12:55 . 2007-12-21 15:01 d——– C:\Program Files\Common Files\Symantec Shared
2007-12-16 10:02 . 2007-12-20 12:54 69 –a—— C:\WINDOWS\NeroDigital.ini
2007-12-14 23:23 . 2007-12-14 23:23 d——– C:\WINDOWS\Sun
2007-12-14 23:23 . 2007-09-24 23:31 69,632 –a—— C:\WINDOWS\system32\javacpl.cpl
2007-12-14 23:22 . 2007-12-14 23:23 d——– C:\Program Files\Java
2007-12-14 23:21 . 2007-12-14 23:21 d——– C:\Program Files\Common Files\Java
2007-12-14 23:06 . 2007-12-20 10:01 d——– C:\Torrent Files
2007-12-14 09:32 . 2007-12-16 19:18 d——– C:\Program Files\Verizon
2007-12-14 09:32 . 2007-12-14 09:33 d——– C:\Program Files\Common Files\PestPatrol
2007-12-14 09:32 . 2007-12-14 09:33 d——– C:\Program Files\Common Files\Command Software
2007-12-07 19:54 . 2007-12-07 19:54 d–h—– C:\WINDOWS\PIF
2007-12-07 19:49 . 2007-12-07 19:49 d——– C:\Documents and Settings\All Users\Application Data\Freedom
2007-12-07 19:45 . 2007-12-07 19:45 d——– C:\WINDOWS\Downloaded Installations
2007-12-07 19:45 . 2007-12-16 19:18 d——– C:\Documents and Settings\All Users\Application Data\Verizon
2007-12-06 18:28 . 2007-12-16 18:42 0 –a—— C:\WINDOWS\system32\mcrh.tmp
2007-12-06 07:52 . 2007-12-17 22:44 343,720 —hs—- C:\WINDOWS\system32\bbadd.bak2
2007-12-05 19:36 . 2007-12-05 19:36 d——– C:\Documents and Settings\jess\Application Data\Nero
2007-12-05 19:26 . 2007-12-05 19:26 d——– C:\Program Files\Nero
2007-12-05 19:26 . 2007-12-05 19:29 d——– C:\Program Files\Common Files\Nero
2007-12-05 19:26 . 2007-12-05 19:27 d——– C:\Documents and Settings\All Users\Application Data\Nero
2007-12-05 19:15 . 2007-12-05 19:15 d——– C:\Program Files\MagicISO
2007-12-05 19:07 . 2007-12-05 19:07 685,816 –a—— C:\WINDOWS\system32\drivers\sptd.sys
2007-12-04 19:49 . 2007-12-12 19:53 69,622 —hs—- C:\WINDOWS\system32\bbadd.bak1
2007-12-03 13:31 . 2007-12-03 13:31 d——– C:\Program Files\iTunes
2007-12-03 13:31 . 2007-12-03 13:31 d——– C:\Program Files\iPod
2007-12-03 13:31 . 2007-12-03 13:31 d——– C:\Documents and Settings\jess\Application Data\Apple Computer
2007-12-03 13:31 . 2007-12-23 15:58 54,156 –ah—– C:\WINDOWS\QTFont.qfn
2007-12-03 13:31 . 2007-12-03 13:32 1,409 –a—— C:\WINDOWS\QTFont.for
2007-12-03 13:30 . 2007-12-03 13:30 d——– C:\Program Files\QuickTime
2007-12-03 13:30 . 2007-12-03 13:31 d——– C:\Documents and Settings\All Users\Application Data\Apple Computer
2007-12-03 13:27 . 2007-12-03 13:27 d——– C:\Program Files\Common Files\Apple
2007-12-02 13:49 . 2007-12-21 14:56 d——– C:\Program Files\SpywareBlaster
2007-12-02 13:10 . 2007-12-02 13:10 d——– C:\Program Files\Abexo
2007-12-01 21:41 . 2003-06-25 16:05 266,360 –a—— C:\WINDOWS\system32\TweakUI.exe
2007-12-01 21:41 . 2002-06-21 15:09 160,217 –a—— C:\WINDOWS\system32\PowerToysLicense.rtf
2007-12-01 18:04 . 2007-12-01 18:04 d——– C:\Documents and Settings\All Users\Application Data\espionServerData
2007-12-01 15:29 . 2007-12-01 15:29 0 –ah—– C:\WINDOWS\SwSys2.bmp
2007-12-01 15:29 . 2007-12-01 15:29 0 –ah—– C:\WINDOWS\SwSys1.bmp
2007-12-01 15:28 . 2007-12-01 15:32 d——– C:\Program Files\Blubster
2007-12-01 15:28 . 2006-06-12 18:06 662,288 –a—— C:\WINDOWS\system32\MSComCt2.ocx
2007-12-01 15:28 . 2006-06-12 18:06 608,448 –a—— C:\WINDOWS\system32\ComCtl32.ocx
2007-12-01 15:28 . 2006-06-12 18:06 416,528 –a—— C:\WINDOWS\system32\Comct332.ocx
2007-12-01 15:28 . 2006-06-12 18:06 152,848 –a—— C:\WINDOWS\system32\COMDLG32.OCX
2007-12-01 15:28 . 2006-06-12 18:06 132,880 –a—— C:\WINDOWS\system32\MSInet.ocx
2007-12-01 15:28 . 2006-06-12 18:06 124,688 –a—— C:\WINDOWS\system32\MSWinSck.ocx
2007-12-01 14:59 . 2007-12-01 14:59 d——– C:\Documents and Settings\All Users\Application Data\Azureus
2007-12-01 14:58 . 2007-12-19 08:57 d——– C:\Documents and Settings\jess\Application Data\Azureus
2007-12-01 14:55 . 2007-12-14 23:10 d——– C:\Program Files\Azureus
2007-11-30 17:38 . 2007-11-30 17:38 d——– C:\Program Files\Apple Software Update
2007-11-30 17:38 . 2007-11-30 17:38 d——– C:\Documents and Settings\All Users\Application Data\Apple
2007-11-30 13:36 . 2007-07-30 19:19 271,224 –a—— C:\WINDOWS\system32\mucltui.dll
2007-11-30 13:36 . 2007-07-30 19:19 30,072 –a—— C:\WINDOWS\system32\mucltui.dll.mui
2007-11-29 23:30 . 2007-11-29 23:51 d——– C:\Documents and Settings\jess\Application Data\OfficeUpdate12
2007-11-29 22:52 . 2007-11-29 22:52 d——– C:\Program Files\MSBuild
2007-11-29 22:45 . 2007-11-29 23:22 d——– C:\WINDOWS\system32\XPSViewer
2007-11-29 22:44 . 2007-11-29 22:44 d——– C:\Program Files\Reference Assemblies
2007-11-29 22:43 . 2007-11-29 22:43 d——– C:\cf4ccb9c16bab7492a6c7b2a4b4ccebb
2007-11-29 22:43 . 2006-06-29 13:07 14,048 –a—— C:\WINDOWS\system32\spmsg2.dll
2007-11-29 22:42 . 2007-11-29 22:42 d——– C:\Program Files\Windows Media Connect 2
2007-11-29 22:42 . 2007-11-29 22:42 d——– C:\Program Files\MSXML 6.0
2007-11-29 22:42 . 2006-10-04 09:06 1,197,294 —–c— C:\WINDOWS\system32\dllcache\sysmain.sdb
2007-11-29 22:42 . 2006-10-04 09:06 764,868 —–c— C:\WINDOWS\system32\dllcache\apph_sp.sdb
2007-11-29 22:42 . 2006-10-04 09:06 217,118 —–c— C:\WINDOWS\system32\dllcache\apphelp.sdb
2007-11-29 22:40 . 2007-11-29 22:40 d——– C:\WINDOWS\system32\LogFiles
2007-11-29 22:40 . 2007-11-29 22:41 d——– C:\WINDOWS\system32\drivers\UMDF
2007-11-29 22:27 . 2007-11-29 22:28 d——– C:\WINDOWS\system32\URTTemp
2007-11-29 22:25 . 2006-11-13 01:02 288,768 –a—— C:\WINDOWS\system32\rhttpaa.dll
2007-11-29 22:25 . 2006-11-13 01:02 116,736 –a—— C:\WINDOWS\system32\aaclient.dll
2007-11-29 22:25 . 2006-11-13 01:02 36,352 –a—— C:\WINDOWS\system32\tsgqec.dll
2007-11-29 22:14 . 2007-10-10 18:55 6,065,664 —–c— C:\WINDOWS\system32\dllcache\ieframe.dll
2007-11-29 22:14 . 2007-04-17 04:32 2,455,488 —–c— C:\WINDOWS\system32\dllcache\ieapfltr.dat
2007-11-29 22:14 . 2007-03-08 00:10 991,232 —–c— C:\WINDOWS\system32\dllcache\ieframe.dll.mui
2007-11-29 22:14 . 2007-10-10 18:55 459,264 —–c— C:\WINDOWS\system32\dllcache\msfeeds.dll
2007-11-29 22:14 . 2007-10-10 18:55 383,488 —–c— C:\WINDOWS\system32\dllcache\ieapfltr.dll
2007-11-29 22:14 . 2007-10-10 18:55 267,776 —–c— C:\WINDOWS\system32\dllcache\iertutil.dll
2007-11-29 22:14 . 2007-10-10 18:55 63,488 —–c— C:\WINDOWS\system32\dllcache\icardie.dll
2007-11-29 22:14 . 2007-10-10 18:55 52,224 —–c— C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2007-11-29 22:14 . 2007-10-10 05:59 13,824 —–c— C:\WINDOWS\system32\dllcache\ieudinit.exe
2007-11-29 22:10 . 2007-08-13 18:54 33,792 –a–c— C:\WINDOWS\system32\dllcache\custsat.dll
2007-11-29 21:52 . 2006-08-21 04:14 128,896 —–c— C:\WINDOWS\system32\dllcache\fltmgr.sys
2007-11-29 21:52 . 2006-08-21 04:14 23,040 —–c— C:\WINDOWS\system32\dllcache\fltmc.exe
2007-11-29 21:52 . 2006-08-21 07:21 16,896 —–c— C:\WINDOWS\system32\dllcache\fltlib.dll
2007-11-29 21:50 . 2007-11-29 21:50 d——– C:\Program Files\MSXML 4.0
2007-11-29 21:44 . 2007-07-09 08:09 584,192 —–c— C:\WINDOWS\system32\dllcache\rpcrt4.dll
2007-11-29 21:40 . 2007-11-29 21:40 d——– C:\Program Files\Lavasoft
2007-11-29 21:40 . 2007-11-29 21:40 d——– C:\Documents and Settings\All Users\Application Data\Lavasoft

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-26 09:00 ——— d—–w C:\Documents and Settings\All Users\Application Data\avg7
2007-12-14 14:01 ——— d–h–w C:\Program Files\InstallShield Installation Information
2007-12-08 00:44 ——— d—–w C:\Program Files\Common Files\InstallShield
2007-12-05 00:36 ——— d—–w C:\Program Files\Ahead
2007-12-02 03:32 ——— d—–w C:\Program Files\LINKSYS
2007-12-02 03:30 ——— d—–w C:\Program Files\ICQ
2007-12-02 01:42 631 —-a-w C:\WINDOWS\Fonts\readme.txt
2007-12-01 22:43 20,640 —-a-w C:\WINDOWS\system32\drivers\PxHelp20.sys
2007-11-30 02:51 ——— d—–w C:\Documents and Settings\jess\Application Data\AVG7
2007-11-13 10:25 20,480 —-a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-10-23 19:20 972,072 —-a-w C:\WINDOWS\UNNeroMediaHome.exe
2007-10-22 15:57 524,288 —-a-w C:\WINDOWS\opuc.dll
2007-10-22 13:51 972,072 —-a-w C:\WINDOWS\UNRecode.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:56]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" [2007-12-20 17:19]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11]
"VerizonServicepoint.exe"="C:\Program Files\Verizon\VSP\VerizonServicepoint.exe" [2007-05-11 15:20]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-11-14 23:43]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe" [2007-11-29 15:37]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2006-10-04 03:48 C:\WINDOWS\system32\narrator.exe]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Google Updater.lnk]
backup=C:\WINDOWS\pss\Google Updater.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Wireless PCI Card Config Utility.lnk]
backup=C:\WINDOWS\pss\Wireless PCI Card Config Utility.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
2006-12-22 07:29 67752 –a—— C:\Program Files\Adobe\Photoshop Elements 5.0\apdproxy.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
2007-10-23 14:18 202024 –a—— C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BluetoothAuthenticationAgent]
rundll32.exe irprops.cpl,,BluetoothAuthenticationAgent

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2004-08-04 02:56 15360 –a—— C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
2002-09-09 03:05 114688 –a—— C:\WINDOWS\System32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Component Manager]
2003-12-22 08:38 241664 –a—— C:\Program Files\HP\hpcoretech\hpcmpmgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2003-12-05 15:41 49152 –a—— C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPDJ Taskbar Utility]
2005-07-07 23:55 176128 –a—— C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPHmon05]
2005-07-07 23:55 491520 –a—— C:\WINDOWS\System32\hphmon05.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPHUPD05]
2005-07-07 23:55 49152 –a—— C:\Program Files\Hewlett-Packard\\{5372B9A6-6E51-4f90-9B40-E0A3B8475C4E}\hphupd05.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2007-11-15 13:11 267048 –a—— C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Update Detection]
2000-07-13 15:00 28739 –a—— C:\Program Files\Microsoft Works\WkDetect.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
C:\Program Files\Messenger\msmsgs.exe /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBKeyScan]
2007-09-20 08:51 1836328 –a—— C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2007-03-01 14:57 153136 –a—— C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PRISMSTA.EXE]
PRISMSTA.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\qttask.exe -atboottime

R2 Nero BackItUp Scheduler 3;Nero BackItUp Scheduler 3;C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe [2007-09-20 08:51]
S3 LSWLNDS;Instant Wireless Driver;C:\WINDOWS\system32\DRIVERS\LSWLNDS.sys []
S3 MR97310_VGA_DUAL_CAMERA;VGA Dual-Mode Camera;C:\WINDOWS\system32\DRIVERS\mr97310v.sys [2004-03-30 10:29]
S3 PRISM;Instant Wireless - Network PC CARD Driver;C:\WINDOWS\system32\DRIVERS\PRISMNDS.sys []

.
Contents of the 'Scheduled Tasks' folder
"2007-12-24 18:06:02 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2007-12-26 12:00:02 C:\WINDOWS\Tasks\HP Usg Daily.job"
"2007-12-26 14:12:30 C:\WINDOWS\Tasks\Spybot - Search & Destroy - Scheduled Task.job"
.
**************************************************************************

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-26 09:32:51
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-12-26 9:34:41 - machine was rebooted
.
2007-12-13 08:05:03 — E O F —
Post #8
Hello,

Your log looks good, :thumbup: just a few bad files to remove.

FYI - The thieves that have written the Vundo Trojan have written it to go undetected by Hijackthis and by renaming it to something else if your infected with Vundo it will then show up on your log. You did have a marker for Vundo but it looks like it did not get a good foothold on you, these files we are going to remove are most likely related to that infection.


Open Notepad and copy all the text inside the quote box by highlighting it all and pressing CTRL C on your keyboard, then paste it into Notepad, make sure there is no space before and above File::

File::
C:\WINDOWS\system32\cqdicblh.ini
C:\WINDOWS\system32\bbadd.ini2
C:\WINDOWS\system32\bbadd.ini
C:\WINDOWS\system32\bbadd.tmp
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\bbadd.bak2
C:\WINDOWS\system32\bbadd.bak1


Save this as CFScript to your desktop.

Then drag the CFScript into ComboFix.exe as you see in the screenshot below.

[external image: Posted Image]


This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThis log.


How are things running now????
Post #9 last edited
I really appreciate your help with this!!!!!!


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:16:46 PM, on 12/26/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Verizon\VSP\VerizonServicepoint.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Common Files\Command Software\dvpapi.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Install\Scanner.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [AVG7_CC] "C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" /STARTUP
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [VerizonServicepoint.exe] "C:\Program Files\Verizon\VSP\VerizonServicepoint.exe" /AUTORUN
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.emachines.com
O16 - DPF: vzTCPConfig - http://www2.verizon.net/help/fios_settings…vzTCPConfig.CAB
O16 - DPF: {49232000-16E4-426C-A231-62846947304B} (SysData Class) - http://ipgweb.cce.hp.com/rdqaio/downloads/sysinfo.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1196382177218
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1196391178406
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl-esd.sun.com/update/1.6.0/jin…ows-i586-jc.cab
O16 - DPF: {9D190AE6-C81E-4039-8061-978EBAD10073} (F-Secure Online Scanner 3.0) - http://runvirusscan.com/ols3/fscax.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe Active File Monitor V5 (AdobeActiveFileMonitor5.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: DvpApi (dvpapi) - Command Software Systems, Inc. - C:\Program Files\Common Files\Command Software\dvpapi.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe

–
End of file - 7092 bytes


ComboFix 07-12-21.4 - jess 2007-12-26 14:08:28.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.272 [GMT -5:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\jess\Desktop\CFScript.txt
* Created a new restore point

FILE
C:\WINDOWS\system32\bbadd.bak1
C:\WINDOWS\system32\bbadd.bak2
C:\WINDOWS\system32\bbadd.ini
C:\WINDOWS\system32\bbadd.ini2
C:\WINDOWS\system32\bbadd.tmp
C:\WINDOWS\system32\cqdicblh.ini
C:\WINDOWS\system32\mcrh.tmp
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\bbadd.bak1
C:\WINDOWS\system32\bbadd.bak2
C:\WINDOWS\system32\bbadd.ini
C:\WINDOWS\system32\bbadd.ini2
C:\WINDOWS\system32\bbadd.tmp
C:\WINDOWS\system32\cqdicblh.ini
C:\WINDOWS\system32\mcrh.tmp

.
((((((((((((((((((((((((( Files Created from 2007-11-26 to 2007-12-26 )))))))))))))))))))))))))))))))
.

2007-12-25 19:27 . 2007-12-25 19:28 d——– C:\New Folder
2007-12-18 13:25 . 2007-12-18 14:33 d——– C:\Program Files\Spyware Doctor
2007-12-18 13:25 . 2005-09-23 07:29 626,688 –a—— C:\WINDOWS\system32\msvcr80.dll
2007-12-17 22:53 . 2007-12-17 22:53 d——– C:\Documents and Settings\jess\Application Data\Lavasoft
2007-12-17 22:33 . 2007-12-17 22:33 d——– C:\Documents and Settings\All Users\Application Data\Geek Squad
2007-12-17 16:54 . 2007-12-17 16:54 164 –a—— C:\install.dat
2007-12-17 16:52 . 2007-12-17 16:54 d——– C:\Documents and Settings\jess\Application Data\GetRightToGo
2007-12-17 09:48 . 2007-12-16 19:24 102,664 –ah—– C:\WINDOWS\system32\drivers\tmcomm.sys
2007-12-16 19:24 . 2007-12-17 11:19 d——– C:\Documents and Settings\jess\.housecall6.6
2007-12-16 19:18 . 2007-12-16 19:18 d——– C:\Documents and Settings\jess\Application Data\Verizon
2007-12-16 12:55 . 2007-12-21 15:01 d——– C:\Program Files\Common Files\Symantec Shared
2007-12-16 10:02 . 2007-12-20 12:54 69 –a—— C:\WINDOWS\NeroDigital.ini
2007-12-14 23:23 . 2007-12-14 23:23 d——– C:\WINDOWS\Sun
2007-12-14 23:23 . 2007-09-24 23:31 69,632 –a—— C:\WINDOWS\system32\javacpl.cpl
2007-12-14 23:22 . 2007-12-14 23:23 d——– C:\Program Files\Java
2007-12-14 23:21 . 2007-12-14 23:21 d——– C:\Program Files\Common Files\Java
2007-12-14 23:06 . 2007-12-20 10:01 d——– C:\Torrent Files
2007-12-14 09:32 . 2007-12-16 19:18 d——– C:\Program Files\Verizon
2007-12-14 09:32 . 2007-12-14 09:33 d——– C:\Program Files\Common Files\PestPatrol
2007-12-14 09:32 . 2007-12-14 09:33 d——– C:\Program Files\Common Files\Command Software
2007-12-07 19:54 . 2007-12-07 19:54 d–h—– C:\WINDOWS\PIF
2007-12-07 19:49 . 2007-12-07 19:49 d——– C:\Documents and Settings\All Users\Application Data\Freedom
2007-12-07 19:45 . 2007-12-07 19:45 d——– C:\WINDOWS\Downloaded Installations
2007-12-07 19:45 . 2007-12-16 19:18 d——– C:\Documents and Settings\All Users\Application Data\Verizon
2007-12-05 19:36 . 2007-12-05 19:36 d——– C:\Documents and Settings\jess\Application Data\Nero
2007-12-05 19:26 . 2007-12-05 19:26 d——– C:\Program Files\Nero
2007-12-05 19:26 . 2007-12-05 19:29 d——– C:\Program Files\Common Files\Nero
2007-12-05 19:26 . 2007-12-05 19:27 d——– C:\Documents and Settings\All Users\Application Data\Nero
2007-12-05 19:15 . 2007-12-05 19:15 d——– C:\Program Files\MagicISO
2007-12-05 19:07 . 2007-12-05 19:07 685,816 –a—— C:\WINDOWS\system32\drivers\sptd.sys
2007-12-03 13:31 . 2007-12-03 13:31 d——– C:\Program Files\iTunes
2007-12-03 13:31 . 2007-12-03 13:31 d——– C:\Program Files\iPod
2007-12-03 13:31 . 2007-12-03 13:31 d——– C:\Documents and Settings\jess\Application Data\Apple Computer
2007-12-03 13:31 . 2007-12-23 15:58 54,156 –ah—– C:\WINDOWS\QTFont.qfn
2007-12-03 13:31 . 2007-12-03 13:32 1,409 –a—— C:\WINDOWS\QTFont.for
2007-12-03 13:30 . 2007-12-03 13:30 d——– C:\Program Files\QuickTime
2007-12-03 13:30 . 2007-12-03 13:31 d——– C:\Documents and Settings\All Users\Application Data\Apple Computer
2007-12-03 13:27 . 2007-12-03 13:27 d——– C:\Program Files\Common Files\Apple
2007-12-02 13:49 . 2007-12-21 14:56 d——– C:\Program Files\SpywareBlaster
2007-12-02 13:10 . 2007-12-02 13:10 d——– C:\Program Files\Abexo
2007-12-01 21:41 . 2003-06-25 16:05 266,360 –a—— C:\WINDOWS\system32\TweakUI.exe
2007-12-01 21:41 . 2002-06-21 15:09 160,217 –a—— C:\WINDOWS\system32\PowerToysLicense.rtf
2007-12-01 18:04 . 2007-12-01 18:04 d——– C:\Documents and Settings\All Users\Application Data\espionServerData
2007-12-01 15:29 . 2007-12-01 15:29 0 –ah—– C:\WINDOWS\SwSys2.bmp
2007-12-01 15:29 . 2007-12-01 15:29 0 –ah—– C:\WINDOWS\SwSys1.bmp
2007-12-01 15:28 . 2007-12-01 15:32 d——– C:\Program Files\Blubster
2007-12-01 15:28 . 2006-06-12 18:06 662,288 –a—— C:\WINDOWS\system32\MSComCt2.ocx
2007-12-01 15:28 . 2006-06-12 18:06 608,448 –a—— C:\WINDOWS\system32\ComCtl32.ocx
2007-12-01 15:28 . 2006-06-12 18:06 416,528 –a—— C:\WINDOWS\system32\Comct332.ocx
2007-12-01 15:28 . 2006-06-12 18:06 152,848 –a—— C:\WINDOWS\system32\COMDLG32.OCX
2007-12-01 15:28 . 2006-06-12 18:06 132,880 –a—— C:\WINDOWS\system32\MSInet.ocx
2007-12-01 15:28 . 2006-06-12 18:06 124,688 –a—— C:\WINDOWS\system32\MSWinSck.ocx
2007-12-01 14:59 . 2007-12-01 14:59 d——– C:\Documents and Settings\All Users\Application Data\Azureus
2007-12-01 14:58 . 2007-12-19 08:57 d——– C:\Documents and Settings\jess\Application Data\Azureus
2007-12-01 14:55 . 2007-12-14 23:10 d——– C:\Program Files\Azureus
2007-11-30 17:38 . 2007-11-30 17:38 d——– C:\Program Files\Apple Software Update
2007-11-30 17:38 . 2007-11-30 17:38 d——– C:\Documents and Settings\All Users\Application Data\Apple
2007-11-30 13:36 . 2007-07-30 19:19 271,224 –a—— C:\WINDOWS\system32\mucltui.dll
2007-11-30 13:36 . 2007-07-30 19:19 30,072 –a—— C:\WINDOWS\system32\mucltui.dll.mui
2007-11-29 23:30 . 2007-11-29 23:51 d——– C:\Documents and Settings\jess\Application Data\OfficeUpdate12
2007-11-29 22:52 . 2007-11-29 22:52 d——– C:\Program Files\MSBuild
2007-11-29 22:45 . 2007-11-29 23:22 d——– C:\WINDOWS\system32\XPSViewer
2007-11-29 22:44 . 2007-11-29 22:44 d——– C:\Program Files\Reference Assemblies
2007-11-29 22:43 . 2007-11-29 22:43 d——– C:\cf4ccb9c16bab7492a6c7b2a4b4ccebb
2007-11-29 22:43 . 2006-06-29 13:07 14,048 –a—— C:\WINDOWS\system32\spmsg2.dll
2007-11-29 22:42 . 2007-11-29 22:42 d——– C:\Program Files\Windows Media Connect 2
2007-11-29 22:42 . 2007-11-29 22:42 d——– C:\Program Files\MSXML 6.0
2007-11-29 22:42 . 2006-10-04 09:06 1,197,294 —–c— C:\WINDOWS\system32\dllcache\sysmain.sdb
2007-11-29 22:42 . 2006-10-04 09:06 764,868 —–c— C:\WINDOWS\system32\dllcache\apph_sp.sdb
2007-11-29 22:42 . 2006-10-04 09:06 217,118 —–c— C:\WINDOWS\system32\dllcache\apphelp.sdb
2007-11-29 22:40 . 2007-11-29 22:40 d——– C:\WINDOWS\system32\LogFiles
2007-11-29 22:40 . 2007-11-29 22:41 d——– C:\WINDOWS\system32\drivers\UMDF
2007-11-29 22:27 . 2007-11-29 22:28 d——– C:\WINDOWS\system32\URTTemp
2007-11-29 22:25 . 2006-11-13 01:02 288,768 –a—— C:\WINDOWS\system32\rhttpaa.dll
2007-11-29 22:25 . 2006-11-13 01:02 116,736 –a—— C:\WINDOWS\system32\aaclient.dll
2007-11-29 22:25 . 2006-11-13 01:02 36,352 –a—— C:\WINDOWS\system32\tsgqec.dll
2007-11-29 22:14 . 2007-10-10 18:55 6,065,664 —–c— C:\WINDOWS\system32\dllcache\ieframe.dll
2007-11-29 22:14 . 2007-04-17 04:32 2,455,488 —–c— C:\WINDOWS\system32\dllcache\ieapfltr.dat
2007-11-29 22:14 . 2007-03-08 00:10 991,232 —–c— C:\WINDOWS\system32\dllcache\ieframe.dll.mui
2007-11-29 22:14 . 2007-10-10 18:55 459,264 —–c— C:\WINDOWS\system32\dllcache\msfeeds.dll
2007-11-29 22:14 . 2007-10-10 18:55 383,488 —–c— C:\WINDOWS\system32\dllcache\ieapfltr.dll
2007-11-29 22:14 . 2007-10-10 18:55 267,776 —–c— C:\WINDOWS\system32\dllcache\iertutil.dll
2007-11-29 22:14 . 2007-10-10 18:55 63,488 —–c— C:\WINDOWS\system32\dllcache\icardie.dll
2007-11-29 22:14 . 2007-10-10 18:55 52,224 —–c— C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2007-11-29 22:14 . 2007-10-10 05:59 13,824 —–c— C:\WINDOWS\system32\dllcache\ieudinit.exe
2007-11-29 22:10 . 2007-08-13 18:54 33,792 –a–c— C:\WINDOWS\system32\dllcache\custsat.dll
2007-11-29 21:52 . 2006-08-21 04:14 128,896 —–c— C:\WINDOWS\system32\dllcache\fltmgr.sys
2007-11-29 21:52 . 2006-08-21 04:14 23,040 —–c— C:\WINDOWS\system32\dllcache\fltmc.exe
2007-11-29 21:52 . 2006-08-21 07:21 16,896 —–c— C:\WINDOWS\system32\dllcache\fltlib.dll
2007-11-29 21:50 . 2007-11-29 21:50 d——– C:\Program Files\MSXML 4.0
2007-11-29 21:44 . 2007-07-09 08:09 584,192 —–c— C:\WINDOWS\system32\dllcache\rpcrt4.dll
2007-11-29 21:40 . 2007-11-29 21:40 d——– C:\Program Files\Lavasoft
2007-11-29 21:40 . 2007-11-29 21:40 d——– C:\Documents and Settings\All Users\Application Data\Lavasoft
2007-11-29 21:39 . 2007-11-29 21:39 d——– C:\Program Files\Common Files\Wise Installation Wizard
2007-11-29 21:38 . 2007-12-08 13:44 d——– C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-11-29 21:36 . 2007-12-26 09:41 d——– C:\Install
2007-11-29 20:51 . 2007-11-29 20:51 d——– C:\WINDOWS\provisioning
2007-11-29 20:51 . 2007-11-29 20:51 d——– C:\WINDOWS\peernet
2007-11-29 20:48 . 2007-11-29 20:48 d——– C:\WINDOWS\ServicePackFiles
2007-11-29 20:41 . 2007-11-29 20:41 d——– C:\WINDOWS\EHome

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-26 09:00 ——— d—–w C:\Documents and Settings\All Users\Application Data\avg7
2007-12-14 14:01 ——— d–h–w C:\Program Files\InstallShield Installation Information
2007-12-08 00:44 ——— d—–w C:\Program Files\Common Files\InstallShield
2007-12-05 00:36 ——— d—–w C:\Program Files\Ahead
2007-12-02 03:32 ——— d—–w C:\Program Files\LINKSYS
2007-12-02 03:30 ——— d—–w C:\Program Files\ICQ
2007-12-02 01:42 631 —-a-w C:\WINDOWS\Fonts\readme.txt
2007-12-01 22:43 20,640 —-a-w C:\WINDOWS\system32\drivers\PxHelp20.sys
2007-12-01 22:43 109,568 —-a-w C:\WINDOWS\system32\pxinsi64.exe
2007-12-01 22:43 108,544 —-a-w C:\WINDOWS\system32\pxcpyi64.exe
2007-11-30 02:51 ——— d—–w C:\Documents and Settings\jess\Application Data\AVG7
2007-11-13 10:25 20,480 —-a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-10-29 22:43 1,287,680 —-a-w C:\WINDOWS\system32\quartz.dll
2007-10-27 22:40 222,720 —-a-w C:\WINDOWS\system32\wmasf.dll
2007-10-23 19:20 972,072 —-a-w C:\WINDOWS\UNNeroMediaHome.exe
2007-10-22 15:57 524,288 —-a-w C:\WINDOWS\opuc.dll
2007-10-22 13:51 972,072 —-a-w C:\WINDOWS\UNRecode.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:56]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" [2007-12-20 17:19]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11]
"VerizonServicepoint.exe"="C:\Program Files\Verizon\VSP\VerizonServicepoint.exe" [2007-05-11 15:20]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-11-14 23:43]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe" [2007-11-29 15:37]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2006-10-04 03:48 C:\WINDOWS\system32\narrator.exe]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Google Updater.lnk]
backup=C:\WINDOWS\pss\Google Updater.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Wireless PCI Card Config Utility.lnk]
backup=C:\WINDOWS\pss\Wireless PCI Card Config Utility.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
2006-12-22 07:29 67752 –a—— C:\Program Files\Adobe\Photoshop Elements 5.0\apdproxy.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
2007-10-23 14:18 202024 –a—— C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BluetoothAuthenticationAgent]
rundll32.exe irprops.cpl,,BluetoothAuthenticationAgent

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2004-08-04 02:56 15360 –a—— C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
2002-09-09 03:05 114688 –a—— C:\WINDOWS\System32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Component Manager]
2003-12-22 08:38 241664 –a—— C:\Program Files\HP\hpcoretech\hpcmpmgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2003-12-05 15:41 49152 –a—— C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPDJ Taskbar Utility]
2005-07-07 23:55 176128 –a—— C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPHmon05]
2005-07-07 23:55 491520 –a—— C:\WINDOWS\System32\hphmon05.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPHUPD05]
2005-07-07 23:55 49152 –a—— C:\Program Files\Hewlett-Packard\\{5372B9A6-6E51-4f90-9B40-E0A3B8475C4E}\hphupd05.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2007-11-15 13:11 267048 –a—— C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Update Detection]
2000-07-13 15:00 28739 –a—— C:\Program Files\Microsoft Works\WkDetect.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
C:\Program Files\Messenger\msmsgs.exe /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBKeyScan]
2007-09-20 08:51 1836328 –a—— C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2007-03-01 14:57 153136 –a—— C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PRISMSTA.EXE]
PRISMSTA.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\qttask.exe -atboottime

R2 Nero BackItUp Scheduler 3;Nero BackItUp Scheduler 3;C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe [2007-09-20 08:51]
S3 LSWLNDS;Instant Wireless Driver;C:\WINDOWS\system32\DRIVERS\LSWLNDS.sys []
S3 MR97310_VGA_DUAL_CAMERA;VGA Dual-Mode Camera;C:\WINDOWS\system32\DRIVERS\mr97310v.sys [2004-03-30 10:29]
S3 PRISM;Instant Wireless - Network PC CARD Driver;C:\WINDOWS\system32\DRIVERS\PRISMNDS.sys []

.
Contents of the 'Scheduled Tasks' folder
"2007-12-24 18:06:02 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2007-12-26 16:00:01 C:\WINDOWS\Tasks\HP Usg Daily.job"
"2007-12-26 14:12:30 C:\WINDOWS\Tasks\Spybot - Search & Destroy - Scheduled Task.job"
.
**************************************************************************

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-26 14:10:55
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-12-26 14:12:02
C:\ComboFix2.txt … 2007-12-26 09:34
.
2007-12-13 08:05:03 — E O F —
Post #11
Files Deleted. The PC seems to be running a little smoother now. I appreciate your help and have told a lot of my friends about you. Is that a good thing? :D Thanks again! Tom
Post #12

I appreciate your help and have told a lot of my friends about you. Is that a good thing?

Thats fine, we have a lot of knowledgeable people on this forum


Glad things are better :thumbup:

  • How did I get infected in the first place ? Read these links and find out how to prevent getting infected again.
  • Tutorial for System Restore <– Do this first to prevent yourself from being reinfected.
  • WhattheTech
  • TonyKlein CastleCops
  • Grinler BleepingComputer
  • GeeksTo Go
  • Dslreports

Keep in mind if you install some of these programs. Only ONE Anti Virus and only ONE Firewall is recommended, more is overkill and can cause you problems. You can install all the Spyware programs I have listed without any problems. If you install Spyware Blaster, you can still install Spybot Search and Destroy but do not enable the TeaTimer in Spybot.


Here are some free programs to install, all free and highly regarded by the fine people in the Malware Removal Community
  • Spybot Search and Destroy 1.5
    Check for Updates/ Immunize and run a Full System Scan on a regular basis. If you install Spyware Blaster ( Recommended ) then do not enable the TeaTimer in Spybot Search and Destroy.
  • Spyware Blaster It will prevent most spyware from ever being installed. No scan to run, just update about once a week and enable all protection.
  • Spyware Guard It offers realtime protection from spyware installation attempts, again, no scan to run, just install it and let it do its thing.
  • IE-Spyad
    IE-Spyad places over 6000 web sites and domains in the IE Restricted list which will severely impair attempts to infect your system. It basically prevents any downloads (cookies etc) from the sites listed, although you will still be able to connect to the sites.
  • Firefox 2.0.0.6 It has more features and is a lot more secure than IE. It is a very easy and painless download and install, it will no way interfere with IE, you can use them both.
  • Zone Alarm Here is a free Firewall from Zone Labs, I wouldn't access the internet without it.

Glad we could help

Safe Surfn
Ken
Post #13
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI