What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Closed] Win32/TrojanDropper.Agent.DGO virus

5 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Quite a nasty one causing all sorts of trouble. Please help! Thanks in advance! -Ian :thumbup:

Logfile of HijackThis v1.99.1
Scan saved at 3:43:03 PM, on 12/30/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Eset\nod32krn.exe
C:\Program Files\CyberLink\Shared files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\ESET\nod32kui .exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\mozilla.org\SeaMonkey\seamonkey.exe
C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://home.sirius.com/manageaccount.do
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O3 - Toolbar: My &Web Search - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL (file missing)
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: ATI TV - {44226DFF-747E-4edc-B30C-78752E50CD0C} - C:\Program Files\ATI Multimedia\tv\EXPLBAR.DLL
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Movies Extractor Scout LITE - {AD7D74D5-54E1-405F-8B7B-48915C29157F} - C:\Program Files\Movies Extractor Scout LITE\flashextract.exe
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/f…p1.0.0.15-3.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1137395833730
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl-esd.sun.com/update/1.6.0/jin…ows-i586-jc.cab
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
Post #2
Hello, and welcome to the forum.

My name is Simon V., and I'll be glad to help you with your computer problems.

Step 1

Please download and install CCleaner.

Open CCleaner. On the Windows tab, leave the default options alone.

  • On the Applications tab, check (tick) all the boxes except Saved Form Information. This will remove all your saved passwords if you leave this box checked.
  • Click on the Run Cleaner button at the bottom right hand corner.
  • Close CCleaner.

Step 2

Please download Combofix:

  • From BleepingComputer
  • From InfoSpyware
  • From GeeksToGo

Double-click on combofix.exe and follow the prompts.
When finished, it will produce a log for you. Save it to a convenient location.

Note: Do not mouseclick Combofix's window whilst it's running. That may cause it to stall.

Step 3

Open CCleaner. In the Left Pane, click Tools.

  • Verify that Uninstall is highlighted in color, or click on it.
  • In the lower right, click Save to Text File.
  • Pull down the arrow at the top of the Save dialog and choose Desktop as the location.
  • You can leave the filename as install.txt.
  • Click Save, then exit Ccleaner.

Step 4

In your next reply, please post:

  • the Combofix log (C:\Combofix.txt)
  • the CCleaner Uninstall List (install.txt)
  • a new HijackThis log
Post #3
Here is the combofix log…

ComboFix 07-12-31.4 - WSUSUpdateAdmin 2008-01-01 13:38:44.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.201 [GMT -5:00]
Running from: C:\ThisKind\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Slickparkdale\Start Menu\Programs\Internet Speed Monitor
C:\Documents and Settings\Slickparkdale\Start Menu\Programs\Internet Speed Monitor\Check Now.lnk
C:\Documents and Settings\Slickparkdale\Start Menu\Programs\Internet Speed Monitor\Uninstall.lnk
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\Program Files\ESET\nod32kui.exe
C:\Program Files\internet explorer\msimg32.dll
C:\WINDOWS\ooqtvw.ini
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\MSConfig.exe
C:\WINDOWS\system32\bbbprsgw.dll
C:\WINDOWS\system32\bcefe.ini
C:\WINDOWS\system32\bcefe.ini2
C:\WINDOWS\system32\conf.dat
C:\WINDOWS\system32\ctfmon.exe.tmp
C:\WINDOWS\system32\efecb.dll
C:\WINDOWS\system32\efecb.exe
C:\WINDOWS\system32\gebyywx.dll
C:\WINDOWS\system32\strike12.dll
C:\WINDOWS\system32\strike45.dll
C:\WINDOWS\system32\vxcgiuyv.dll
C:\WINDOWS\tsuwvw.ini
C:\WINDOWS\wvtqoo.dll
C:\WINDOWS\wvwust.dll

.
((((((((((((((((((((((((( Files Created from 2007-12-01 to 2008-01-01 )))))))))))))))))))))))))))))))
.

2008-01-01 13:28 . 2008-01-01 13:28 d——– C:\Program Files\CCleaner
2008-01-01 13:15 . 2008-01-01 13:15 512,096 –a—— C:\WINDOWS\system32\drivers\amon.sys
2008-01-01 13:15 . 2008-01-01 13:15 298,104 –a—— C:\WINDOWS\system32\imon.dll
2008-01-01 13:15 . 2008-01-01 13:15 15,424 –a—— C:\WINDOWS\system32\drivers\nod32drv.sys
2008-01-01 00:45 . 2008-01-01 00:46 1,031,199 –ahs—- C:\WINDOWS\system32\uhhideln.ini
2008-01-01 00:43 . 2008-01-01 00:46 1,031,139 –ahs—- C:\WINDOWS\system32\ugjptaqp.ini
2007-12-30 23:12 . 2007-12-30 23:12 1,917,926 –a—— C:\WINDOWS\evoexmas.bmp
2007-12-30 15:43 . 2007-12-30 15:43 d——– C:\HJT
2007-12-30 15:11 . 2007-12-30 15:11 1 –a—— C:\WINDOWS\system32\rc.dat
2007-12-30 15:11 . 2007-12-30 15:11 1 –a—— C:\WINDOWS\system32\ps1.dat
2007-12-30 12:55 . 2008-01-01 13:23 15,360 –a—— C:\WINDOWS\system32\ctfmon .exe
2007-12-25 09:51 . 2007-12-30 16:22 54,156 –ah—– C:\WINDOWS\QTFont.qfn
2007-12-25 09:51 . 2007-12-25 09:51 1,409 –a—— C:\WINDOWS\QTFont.for
2007-12-15 16:25 . 2007-12-15 16:25 d——– C:\Documents and Settings\All Users\Application Data\SimCity Societies
2007-12-15 15:22 . 2007-04-04 18:55 261,480 –a—— C:\WINDOWS\system32\xactengine2_7.dll
2007-12-15 15:22 . 2007-04-04 18:53 81,768 –a—— C:\WINDOWS\system32\xinput1_3.dll
2007-12-15 12:22 . 2007-12-15 12:27 d——– C:\SIMEARTH
2007-12-14 18:22 . 2007-12-14 18:22 2,360,294 –a—— C:\WINDOWS\Herve.bmp
2007-12-07 16:23 . 2007-12-07 16:23 d——– C:\Program Files\AutoHotkey
2007-12-04 17:12 . 2007-12-04 17:12 1,733,486 –a—— C:\WINDOWS\VenusTransit.bmp
2007-12-01 22:53 . 2007-12-01 22:53 10 –a—— C:\WINDOWS\WININIT.INI
2007-12-01 22:50 . 2007-12-01 22:50 0 –a—— C:\WINDOWS\ativpsrm.bin
2007-12-01 22:28 . 2007-12-01 22:29 d——– C:\Program Files\MultiRes
2007-12-01 22:26 . 2007-12-01 22:26 d——– C:\Program Files\Radeon Omega Drivers
2007-12-01 22:26 . 2007-12-01 22:26 451,072 –a—— C:\WINDOWS\Radeon Omega Drivers v3.8.421 Uninstall.exe
2007-12-01 16:04 . 2007-12-01 16:04 dr-h—– C:\Documents and Settings\WSUSUpdateAdmin\Application Data\SecuROM
2007-12-01 16:04 . 2007-12-01 16:04 107,888 –a—— C:\WINDOWS\system32\CmdLineExt.dll
2007-12-01 16:04 . 2007-12-01 16:08 664 –a—— C:\WINDOWS\system32\d3d9caps.dat
2007-12-01 15:50 . 2007-12-01 15:50 d——– C:\Documents and Settings\WSUSUpdateAdmin\Application Data\ATI
2007-12-01 15:38 . 2007-12-01 15:38 d——– C:\ATI
2007-12-01 15:06 . 2005-05-26 15:34 2,297,552 –a—— C:\WINDOWS\system32\d3dx9_26.dll
2007-12-01 15:05 . 2007-12-01 15:05 d—-c— C:\WINDOWS\system32\DRVSTORE
2007-12-01 15:05 . 2007-12-01 15:05 d——– C:\WINDOWS\system32\AGEIA
2007-12-01 15:05 . 2007-12-01 15:05 d——– C:\Program Files\Common Files\Wise Installation Wizard
2007-12-01 15:05 . 2007-12-01 15:05 d——– C:\Program Files\AGEIA Technologies
2007-12-01 14:48 . 2007-12-01 23:43 d——– C:\Program Files\Rail Simulator

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-30 17:50 ——— d—–w C:\Program Files\Pocket Tunes
2007-12-30 13:26 ——— d—–w C:\Program Files\AOL 9.0
2007-12-30 07:22 ——— d—–w C:\Documents and Settings\All Users\Application Data\AOL
2007-12-08 23:27 ——— d—–w C:\Documents and Settings\WSUSUpdateAdmin\Application Data\AdobeUM
2007-12-03 21:38 118,784 —-a-w C:\WINDOWS\SeaMonkeyUninstall.exe
2007-12-03 21:38 118,784 —-a-w C:\WINDOWS\GREUninstall.exe
2007-12-01 20:42 ——— d—–w C:\Program Files\ATI Technologies
2007-12-01 20:04 ——— d–h–w C:\Program Files\InstallShield Installation Information
2007-11-24 22:15 ——— d—–w C:\Documents and Settings\Slickparkdale\Application Data\AdobeUM
2007-11-15 20:57 ——— d—–w C:\Documents and Settings\WSUSUpdateAdmin\Application Data\ESET
2007-11-15 20:55 ——— d—–w C:\Documents and Settings\All Users\Application Data\ESET
2007-11-14 13:16 ——— d—–w C:\Program Files\Google
2007-11-10 06:15 ——— d—–w C:\Documents and Settings\WSUSUpdateAdmin\Application Data\Ableton
2007-11-10 06:14 ——— d—–w C:\Documents and Settings\All Users\Application Data\Ableton
2007-11-10 06:10 ——— d—–w C:\Program Files\Ableton
2007-11-02 14:32 ——— d—–w C:\Documents and Settings\WSUSUpdateAdmin\Application Data\Ulead Systems
2007-11-02 13:46 ——— d—–w C:\Program Files\Windows Media Connect 2
2007-11-02 13:40 ——— d—–w C:\Documents and Settings\All Users\Application Data\Office Genuine Advantage
2007-04-11 15:26 56 –sha-r C:\WINDOWS\system32\81F1E12EEA.sys
2007-09-20 00:42 3,350 –sha-w C:\WINDOWS\system32\KGyGaAvL.sys
.
—-a-w			81,920 2007-12-30 17:55:48  C:\Program Files\Common Files\InstallShield\UpdateService\issch .exe
—-a-w		   249,856 2007-12-30 18:39:12  C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM .exe
—-a-w		   949,376 2008-01-01 18:24:18  C:\Program Files\ESET\nod32kui .exe
—-a-w		   158,208 2008-01-01 18:14:28  C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\MSConfig .exe
—-a-w			15,360 2008-01-01 18:23:33  C:\WINDOWS\system32\ctfmon .exe


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1e9aea80-dd8c-4364-a1f0-ca614ede5b3a}]
C:\WINDOWS\system32\tsnrssnh.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{531BE052-76FC-4b05-9CCD-AF6AA265113C}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{e2f6ab96-6023-4669-bea1-e5534ba128ce}]
C:\WINDOWS\system32\lmrspl.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 17:56 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nod32kui"="C:\Program Files\Eset\nod32kui.exe" [ ]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2007-09-27 20:17 443968]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"tscuninstall"="C:\WINDOWS\system32\tscupgrd.exe" [2004-08-04 07:00 44544]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HotSync Manager.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HotSync Manager.lnk
backup=C:\WINDOWS\pss\HotSync Manager.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HOTSYNCSHORTCUTNAME.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HOTSYNCSHORTCUTNAME.lnk
backup=C:\WINDOWS\pss\HOTSYNCSHORTCUTNAME.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Palo Alto Software Update Manager 8.0.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Palo Alto Software Update Manager 8.0.lnk
backup=C:\WINDOWS\pss\Palo Alto Software Update Manager 8.0.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^ST Thumbnails Explorer 1.2.2195.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ST Thumbnails Explorer 1.2.2195.lnk
backup=C:\WINDOWS\pss\ST Thumbnails Explorer 1.2.2195.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Slickparkdale^Start Menu^Programs^Startup^Adobe Gamma.lnk]
backup=C:\WINDOWS\pss\Adobe Gamma.lnkStartup
path=C:\Documents and Settings\Slickparkdale\Start Menu\Programs\Startup\Adobe Gamma.lnk

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Slickparkdale^Start Menu^Programs^Startup^AOL OpenRide.lnk]
path=C:\Documents and Settings\Slickparkdale\Start Menu\Programs\Startup\AOL OpenRide.lnk
backup=C:\WINDOWS\pss\AOL OpenRide.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Slickparkdale^Start Menu^Programs^Startup^LimeWire On Startup.lnk]
backup=C:\WINDOWS\pss\LimeWire On Startup.lnkStartup
path=C:\Documents and Settings\Slickparkdale\Start Menu\Programs\Startup\LimeWire On Startup.lnk

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Slickparkdale^Start Menu^Programs^Startup^palmOne Registration.lnk]
backup=C:\WINDOWS\pss\palmOne Registration.lnkStartup
path=C:\Documents and Settings\Slickparkdale\Start Menu\Programs\Startup\palmOne Registration.lnk

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Slickparkdale^Start Menu^Programs^Startup^Stardock ObjectDock.lnk]
backup=C:\WINDOWS\pss\Stardock ObjectDock.lnkStartup
path=C:\Documents and Settings\Slickparkdale\Start Menu\Programs\Startup\Stardock ObjectDock.lnk

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^WSUSUpdateAdmin^Start Menu^Programs^Startup^Adobe Gamma.lnk]
path=C:\Documents and Settings\WSUSUpdateAdmin\Start Menu\Programs\Startup\Adobe Gamma.lnk
backup=C:\WINDOWS\pss\Adobe Gamma.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^WSUSUpdateAdmin^Start Menu^Programs^Startup^HotSync Manager.LNK]
path=C:\Documents and Settings\WSUSUpdateAdmin\Start Menu\Programs\Startup\HotSync Manager.LNK
backup=C:\WINDOWS\pss\HotSync Manager.LNKStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^WSUSUpdateAdmin^Start Menu^Programs^Startup^palmOne Registration.lnk]
path=C:\Documents and Settings\WSUSUpdateAdmin\Start Menu\Programs\Startup\palmOne Registration.lnk
backup=C:\WINDOWS\pss\palmOne Registration.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\!ewido]
C:\Program Files\ewido anti-spyware 4.0\ewido.exe /minimized

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AIM]
C:\Program Files\AIM\aim.exe -cnetwait.odl

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6]
C:\Program Files\AIM6\aim6.exe /d locale=en-US ee://aol/imApp

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOL Fast Start]
C:\Program Files\AOL 9.0\AOL.EXE -b

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOL Spyware Protection]
C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOLDialer]
2006-10-23 07:50 71216 -ra—— C:\Program Files\Common Files\AOL\ACS\AOLDial.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATI Launchpad]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATI Remote Control]
2002-10-22 13:55 159744 –a—— C:\Program Files\ATI Multimedia\RemCtrl\ATIX10.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATICCC]
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe runtime -Delay

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIModeChange]
Ati2mdxx.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
2003-01-25 00:00 315392 –a—— C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2004-08-03 17:56 15360 –a—— C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CursorXP]
C:\Program Files\CursorXP\CursorXP.exe -s

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EmailScan]
C:\Program Files\mcafee.com\antivirus\mcvsescn.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus CX4800 Series]
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIADA.EXE /P26 EPSON Stylus CX4800 Series /O6 USB001 /M Stylus CX4800

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe /startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager]
2006-09-25 19:52 50736 –a—— C:\Program Files\Common Files\AOL\1137808604\ee\AOLSoftware.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPDJ Taskbar Utility]
2002-11-05 13:34 188416 –a—— C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IpWins]
C:\Program Files\ipwins\ipwins.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM .exe -startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe -start

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Jet Detection]
2001-11-29 01:00 28672 –a—— C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
C:\WINDOWS\system32\dumprep 0 -k

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut]
2007-02-07 15:21 54832 –a—— C:\Program Files\CyberLink\PowerDVD\Language\Language.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Load]
C:\WINDOWS\system32\efecb.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MPFExe]
C:\Program Files\mcafee.com\personal firewall\MPfTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
C:\Program Files\Messenger\msmsgs.exe /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\My Web Search Bar Search Scope Monitor]
C:\PROGRA~1\MYWEBS~1\bar\1.bin\m3SrchMn.exe /m=0

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MySpaceIM]
C:\Program Files\MySpace\IM\MySpaceIM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MyWebSearch Email Plugin]
C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2001-07-09 11:50 155648 –a—— C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OASClnt]
C:\Program Files\mcafee.com\antivirus\oasclnt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Picasa Media Detector]
C:\Program Files\Picasa2\PicasaMediaDetector

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\qttask.exe -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray]
C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
2007-02-07 15:24 71216 ——— C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SeaMonkey Quick Launch]
C:\Program Files\mozilla.org\SeaMonkey\SeaMonkey.exe -turbo

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\setup]
rundll32.exe C:\WINDOWS\urpmll.dll,realset

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundService]
rundll32.exe C:\WINDOWS\wvtqoo.dll,setvm

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\sscRun]
C:\Program Files\Common Files\AOL\1137808604\ee\services\sscFirewallPlugin\ver1_205_1_1\SSCRun.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2007-03-14 02:43 83608 –a—— C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Uniblue Registry Booster]
C:\Program Files\Uniblue\Registry Booster\RegistryBooster.exe /S

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg]
2000-05-11 01:00 90112 –a—— C:\WINDOWS\UpdReg.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\wben]
2007-06-12 12:25 287704 –a—— C:\Program Files\Starfield\Desktop Notifier\wben.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
C:\Program Files\Winamp\winampa.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WINDVDPatch]
CTHELPER.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinFlyer32.dll]
rundll32.exe C:\WINDOWS\system32\WinFlyer32.dll,Run

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WSUSOfflineUpdate]
D:\cmd\DoUpdate.cmd /autoreboot /showlog

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe -quiet

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"x10nets"=3 (0x3)
"ose"=3 (0x3)
"ATI Smart"=2 (0x2)
"Ati HotKey Poller"=2 (0x2)
"AOL TopSpeedMonitor"=2 (0x2)
"AOL ACS"=2 (0x2)
"Adobe LM Service"=3 (0x3)

R0 hotcore3;hotcore3;C:\WINDOWS\system32\drivers\hotcore3.sys [2007-03-07 12:16]
R0 hpt3xx;hpt3xx;C:\WINDOWS\system32\drivers\HPT3xx.sys [2002-09-18 06:29]
R2 {95808DC4-FA4A-4c74-92FE-5B863F82066B};{95808DC4-FA4A-4c74-92FE-5B863F82066B};C:\Program Files\CyberLink\PowerDVD\000.fcl [2006-11-02 15:51]
R3 ga302nd5;NETGEAR GA302T Gigabit Adapter;C:\WINDOWS\system32\DRIVERS\ga302nd5.sys [2002-01-24 22:40]
S3 Memctl;Memctl;C:\Program Files\ABIT\FlashMenu\Memctl.sys [2001-11-29 19:49]

.
**************************************************************************

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-01 13:57:16
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

PROCESS: C:\WINDOWS\system32\lsass.exe [5.01.2600.2180]
-> C:\Program Files\Eset\pr_imon.dll
.
Completion time: 2008-01-01 14:02:35 - machine was rebooted
C:\qoobox\ComboFix-quarantined-files.txt 2008-01-01 19:02:29
C:\qoobox\ComboFix2.txt 2007-07-29 00:39:03

Here is the install Log…

AAA Logo 1.2
ABC Amber ICL Converter
ABC Amber Image Converter
Able Batch Converter 2.3
Adobe After Effects 7.0
Adobe Anchor Service CS3
Adobe Asset Services CS3
Adobe Bridge 1.0
Adobe Bridge CS3
Adobe Bridge Start Meeting
Adobe Camera Raw 4.0
Adobe CMaps
Adobe Common File Installer
Adobe Default Language CS3
Adobe Device Central CS3
Adobe Dreamweaver CS3
Adobe ExtendScript Toolkit 1.0
Adobe ExtendScript Toolkit 2
Adobe Extension Manager CS3
Adobe Flash Player 9 ActiveX
Adobe Flash Player Plugin
Adobe Help Center 2.0
Adobe Help Viewer CS3
Adobe PDF Library Files
Adobe Photoshop CS2
Adobe Reader 6.0
Adobe Setup
Adobe Stock Photos 1.0
Adobe Type Support
Adobe Update Manager CS3
Adobe Version Cue CS3 Client
AGEIA PhysX Processor Driver
AGEIA PhysX v6.10.25
Alien Skin Eye Candy 3.2 for After Effects
Alien Skin Eye Candy 5 Impact
Alien Skin Eye Candy 5 Nature
Alien Skin Eye Candy 5 Textures
Alien Skin Image Doctor 1.0
Alien Skin Snap Art
Alien Skin Xenofex 2.0
AOL Uninstaller (Choose which Products to Remove)
ATI - Software Uninstall Utility
ATI Catalyst Control Center
ATI Control Panel
ATI DVD Decoder 2.1.0.1
ATI Multimedia Center [removed]
ATI Remote Wonder 1.4
ATIRW14
AutoHotkey 1.0.47.05
AutoUpdate
Axialis IconWorkshop 6.0
BitComet 0.86
CCleaner (remove only)
CircleSurround II Plugin for Windows Media Player
CorelDRAW Graphics Suite X3
Cycore FX 1.0.1 for After Effects
Desktop Notifier
DivX Codec
DivX Content Uploader
DivX Converter
DivX Player
DivX Web Player
DVDDec
Easy Graphic Converter 3.0
EMS SQL Manager 2007 for MySQL
EN
EPSON Printer Software
EPSON Scan
EPSON Web-To-Page
FlashMenu
FontNav
Google Earth
HijackThis 1.99.1
Hotfix for Windows XP (KB926239)
hp deskjet 3820 series
hp deskjet 3820 series (Remove only)
HtmlCapture ActiveX Control 1.0
HydraVision
Icon Scanner 2.0
Imagicon
iSilo
IsoBuster 2.1
J2SE Runtime Environment 5.0 Update 6
Java™ SE Runtime Environment 6 Update 1
Live 6.0.9
Logo Design Studio
Microsoft .NET Framework 2.0
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Office Professional Edition 2003
Microsoft Office Project Professional 2003
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
MMC81
Movies Extractor Scout LITE
Mozilla Firefox (2.0.0.8)
Mozilla Thunderbird (2.0.0.6)
MultiExtractor
MultiRes (remove only)
My Web Search (Cursor Mania)
Nero 6 Ultra Edition
NOD32 antivirus systeem
NOD32 FiX
palmOne
Paragon Partition Manager 8.5 Enterprise Server Edition
Picasa 2
PowerDVD
QuickTime
Radeon Omega Drivers v3.8.421 Setup Files and Tools
ResumeMaker
SeaMonkey (1.1.7)
Sound Blaster Live! Web 2K/XP
The Logo Creator v2.5
The Logo Creator v3
The Logo Creator v4
The Logo Creator v5
Ulead COOL 3D Studio
Uninstall DreamSuite Demo
VBA
Viewpoint Media Player
Web Page Maker V2.5
WebFldrs XP
Windows Genuine Advantage v1.3.0254.0
Windows Installer 3.1 (KB893803)
Windows Media Encoder 9 Series
Windows Media Format 11 runtime
Windows Media Player 11
WinFlyer
WinRAR
Xenofex 1.0

Here is the HJT log…

Logfile of HijackThis v1.99.1
Scan saved at 2:21:51 PM, on 1/1/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\logonui.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Eset\nod32krn.exe
C:\Program Files\CyberLink\Shared files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\mozilla.org\SeaMonkey\seamonkey.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://home.sirius.com/manageaccount.do
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: {a3b5ede4-16ac-0f1a-4634-c8dd08aea9e1} - {1e9aea80-dd8c-4364-a1f0-ca614ede5b3a} - C:\WINDOWS\system32\tsnrssnh.dll (file missing)
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.3.28.dll
O2 - BHO: Google Module - {531BE052-76FC-4b05-9CCD-AF6AA265113C} - strike12.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {e2f6ab96-6023-4669-bea1-e5534ba128ce} - C:\WINDOWS\system32\lmrspl.dll (file missing)
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O3 - Toolbar: My &Web Search - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL (file missing)
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: ATI TV - {44226DFF-747E-4edc-B30C-78752E50CD0C} - C:\Program Files\ATI Multimedia\tv\EXPLBAR.DLL
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Movies Extractor Scout LITE - {AD7D74D5-54E1-405F-8B7B-48915C29157F} - C:\Program Files\Movies Extractor Scout LITE\flashextract.exe
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/f…p1.0.0.15-3.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1137395833730
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl-esd.sun.com/update/1.6.0/jin…ows-i586-jc.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

Thanks bud! :D
Post #4 last edited
Hi :)

I understand that downloading music and other files may be important to you; however, the Peer-to-Peer programs that you are using to do that, even if they are not infected with malware, will bring malware into your system. Therefore, the chances of you becoming infected again are very high. This obviously can result in disabling your computer and could even lead to someone stealing sensitive personal data from your computer. Beyond the inconvenience this causes you, these programs also tend to use your computer as a server to spread more infection all over the internet, so your computer becomes a part of the malware problem.

Remember that no matter how clean the program you're using for Peer-to-Peer filesharing may be, it offers no guarantees regarding the cleanliness of files you may choose to download. All files available via Peer-to-Peer filesharing carry a high risk, particularly those that offer you illegitimate methods of using legitimate software programs without paying for them. Any program or file that offers you the ability to access non-freeware programs at no cost, e.g., pirated software and/or cracks/key generators for gaining access to legitimate software, is 100% guaranteed to contain malware.

Here is some information that looks at the rates of infection:

http://www.benedelman.org/spyware/p2p/

With that being said, I recommend that you remove the following Peer-to-Peer program(s):

BitComet 0.86

C:\WINDOWS\evoexmas.bmp
C:\WINDOWS\Herve.bmp
C:\WINDOWS\VenusTransit.bmp

Do you know what these files are? Have you put them there yourself?

Step 1

Please download RenV (by sUBs) to your desktop.

Open Notepad (Go to Start > Run, type Notepad and hit Enter), and copy/paste the text in the quotebox below into it:

C:\Program Files\Common Files\InstallShield\UpdateService\issch .exe
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM .exe
C:\Program Files\ESET\nod32kui .exe
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\MSConfig .exe
C:\WINDOWS\system32\ctfmon .exe

Click on File > Save as….

In the File Name box, copy/paste Log.txt (Note: Do not change the filename!)

Click Save (Save Log.txt in the same location as RenV.exe)

[external image: Posted Image]

Refering to the picture above, drag Log.txt into RenV.exe.
When finished, it will produce a new log for you. Save it to a convenient location.

Step 2

Open Notepad (Go to Start > Run, type Notepad and hit Enter), and copy/paste the text in the quotebox below into it:

File::

C:\WINDOWS\system32\uhhideln.ini
C:\WINDOWS\system32\ugjptaqp.ini
C:\WINDOWS\system32\d3d9caps.dat

Registry::

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1e9aea80-dd8c-4364-a1f0-ca614ede5b3a}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{531BE052-76FC-4b05-9CCD-AF6AA265113C}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{e2f6ab96-6023-4669-bea1-e5534ba128ce}]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IpWins]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Load]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\My Web Search Bar Search Scope Monitor]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\setup]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundService]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinFlyer32.dll]

Click on File > Save as….

In the File Name box, copy/paste CFScript.txt (Note: Do not change the filename!)

Click Save (Save the CFScript in the same location as Combofix.exe)

[external image: Posted Image]

Referring to the picture above, drag CFScript into ComboFix.exe.
It will create a log. Be sure to save it to a convenient location.

Step 3

Click on Start, then Control Panel. Double click on Add or Remove Programs.

Please remove the following program(s):

  • J2SE Runtime Environment 5.0 Update 6
  • Java™ SE Runtime Environment 6 Update 1
  • My Web Search (Cursor Mania)

Then download and install Java Runtime Environment (JRE) 6 Update 3.

Step 4

In your next reply, please post:

  • the RenV log (Log.txt)
  • the Combofix log (C:\Combofix.txt)
  • a new HijackThis log
Post #5 
Ran on Tue 01/01/2008 - 16:31:58.48

 Entries:				0  (0)
 Directories:			0  Files:			 0
 Bytes:				  0  Blocks:			0

ComboFix 07-12-31.4 - WSUSUpdateAdmin 2008-01-01 16:38:58.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.177 [GMT -5:00]
Running from: C:\ThisKind\ComboFix.exe
Command switches used :: C:\ThisKind\CFScript.txt
* Created a new restore point

FILE
C:\WINDOWS\system32\d3d9caps.dat
C:\WINDOWS\system32\ugjptaqp.ini
C:\WINDOWS\system32\uhhideln.ini
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\d3d9caps.dat
C:\WINDOWS\system32\ugjptaqp.ini
C:\WINDOWS\system32\uhhideln.ini

.
((((((((((((((((((((((((( Files Created from 2007-12-01 to 2008-01-01 )))))))))))))))))))))))))))))))
.

2008-01-01 13:28 . 2008-01-01 13:28 d——– C:\Program Files\CCleaner
2008-01-01 13:15 . 2008-01-01 13:15 512,096 –a—— C:\WINDOWS\system32\drivers\amon.sys
2008-01-01 13:15 . 2008-01-01 13:15 298,104 –a—— C:\WINDOWS\system32\imon.dll
2008-01-01 13:15 . 2008-01-01 13:15 15,424 –a—— C:\WINDOWS\system32\drivers\nod32drv.sys
2007-12-30 23:12 . 2007-12-30 23:12 1,917,926 –a—— C:\WINDOWS\evoexmas.bmp
2007-12-30 15:43 . 2008-01-01 16:33 d——– C:\HJT
2007-12-30 15:11 . 2007-12-30 15:11 1 –a—— C:\WINDOWS\system32\rc.dat
2007-12-30 15:11 . 2007-12-30 15:11 1 –a—— C:\WINDOWS\system32\ps1.dat
2007-12-25 09:51 . 2007-12-30 16:22 54,156 –ah—– C:\WINDOWS\QTFont.qfn
2007-12-25 09:51 . 2007-12-25 09:51 1,409 –a—— C:\WINDOWS\QTFont.for
2007-12-15 16:25 . 2007-12-15 16:25 d——– C:\Documents and Settings\All Users\Application Data\SimCity Societies
2007-12-15 15:22 . 2007-04-04 18:55 261,480 –a—— C:\WINDOWS\system32\xactengine2_7.dll
2007-12-15 15:22 . 2007-04-04 18:53 81,768 –a—— C:\WINDOWS\system32\xinput1_3.dll
2007-12-15 12:22 . 2007-12-15 12:27 d——– C:\SIMEARTH
2007-12-14 18:22 . 2007-12-14 18:22 2,360,294 –a—— C:\WINDOWS\Herve.bmp
2007-12-07 16:23 . 2007-12-07 16:23 d——– C:\Program Files\AutoHotkey
2007-12-04 17:12 . 2007-12-04 17:12 1,733,486 –a—— C:\WINDOWS\VenusTransit.bmp
2007-12-01 22:53 . 2007-12-01 22:53 10 –a—— C:\WINDOWS\WININIT.INI
2007-12-01 22:50 . 2007-12-01 22:50 0 –a—— C:\WINDOWS\ativpsrm.bin
2007-12-01 22:28 . 2007-12-01 22:29 d——– C:\Program Files\MultiRes
2007-12-01 22:26 . 2007-12-01 22:26 d——– C:\Program Files\Radeon Omega Drivers
2007-12-01 22:26 . 2007-12-01 22:26 451,072 –a—— C:\WINDOWS\Radeon Omega Drivers v3.8.421 Uninstall.exe
2007-12-01 16:04 . 2007-12-01 16:04 dr-h—– C:\Documents and Settings\WSUSUpdateAdmin\Application Data\SecuROM
2007-12-01 16:04 . 2007-12-01 16:04 107,888 –a—— C:\WINDOWS\system32\CmdLineExt.dll
2007-12-01 15:50 . 2007-12-01 15:50 d——– C:\Documents and Settings\WSUSUpdateAdmin\Application Data\ATI
2007-12-01 15:38 . 2007-12-01 15:38 d——– C:\ATI
2007-12-01 15:06 . 2005-05-26 15:34 2,297,552 –a—— C:\WINDOWS\system32\d3dx9_26.dll
2007-12-01 15:05 . 2007-12-01 15:05 d—-c— C:\WINDOWS\system32\DRVSTORE
2007-12-01 15:05 . 2007-12-01 15:05 d——– C:\WINDOWS\system32\AGEIA
2007-12-01 15:05 . 2007-12-01 15:05 d——– C:\Program Files\Common Files\Wise Installation Wizard
2007-12-01 15:05 . 2007-12-01 15:05 d——– C:\Program Files\AGEIA Technologies
2007-12-01 14:48 . 2007-12-01 23:43 d——– C:\Program Files\Rail Simulator

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-01 21:23 ——— d—–w C:\Program Files\BitComet
2008-01-01 18:23 15,360 —-a-w C:\WINDOWS\system32\ctfmon.exe
2008-01-01 18:14 158,208 —-a-w C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\msconfig.exe
2007-12-30 17:50 ——— d—–w C:\Program Files\Pocket Tunes
2007-12-30 13:26 ——— d—–w C:\Program Files\AOL 9.0
2007-12-30 07:22 ——— d—–w C:\Documents and Settings\All Users\Application Data\AOL
2007-12-08 23:27 ——— d—–w C:\Documents and Settings\WSUSUpdateAdmin\Application Data\AdobeUM
2007-12-03 21:38 118,784 —-a-w C:\WINDOWS\SeaMonkeyUninstall.exe
2007-12-03 21:38 118,784 —-a-w C:\WINDOWS\GREUninstall.exe
2007-12-01 20:42 ——— d—–w C:\Program Files\ATI Technologies
2007-12-01 20:04 ——— d–h–w C:\Program Files\InstallShield Installation Information
2007-11-24 22:15 ——— d—–w C:\Documents and Settings\Slickparkdale\Application Data\AdobeUM
2007-11-15 20:57 ——— d—–w C:\Documents and Settings\WSUSUpdateAdmin\Application Data\ESET
2007-11-15 20:55 ——— d—–w C:\Documents and Settings\All Users\Application Data\ESET
2007-11-14 13:16 ——— d—–w C:\Program Files\Google
2007-11-10 06:15 ——— d—–w C:\Documents and Settings\WSUSUpdateAdmin\Application Data\Ableton
2007-11-10 06:14 ——— d—–w C:\Documents and Settings\All Users\Application Data\Ableton
2007-11-10 06:10 ——— d—–w C:\Program Files\Ableton
2007-11-02 14:32 ——— d—–w C:\Documents and Settings\WSUSUpdateAdmin\Application Data\Ulead Systems
2007-11-02 13:46 ——— d—–w C:\Program Files\Windows Media Connect 2
2007-11-02 13:40 ——— d—–w C:\Documents and Settings\All Users\Application Data\Office Genuine Advantage
2007-04-11 15:26 56 –sha-r C:\WINDOWS\system32\81F1E12EEA.sys
2007-09-20 00:42 3,350 –sha-w C:\WINDOWS\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((( snapshot@2008-01-01_14.01.55.03 )))))))))))))))))))))))))))))))))))))))))
.
- 2004-08-03 22:56:50 15,360 -c–a-w C:\WINDOWS\system32\dllcache\ctfmon.exe
+ 2008-01-01 18:23:33 15,360 -c–a-w C:\WINDOWS\system32\dllcache\ctfmon.exe
- 2004-08-04 12:00:00 158,208 -c–a-w C:\WINDOWS\system32\dllcache\msconfig.exe
+ 2008-01-01 18:14:28 158,208 -c–a-w C:\WINDOWS\system32\dllcache\msconfig.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-01-01 13:23 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nod32kui"="C:\Program Files\Eset\nod32kui.exe" [ ]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2007-09-27 20:17 443968]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"tscuninstall"="C:\WINDOWS\system32\tscupgrd.exe" [2004-08-04 07:00 44544]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HotSync Manager.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HotSync Manager.lnk
backup=C:\WINDOWS\pss\HotSync Manager.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HOTSYNCSHORTCUTNAME.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HOTSYNCSHORTCUTNAME.lnk
backup=C:\WINDOWS\pss\HOTSYNCSHORTCUTNAME.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Palo Alto Software Update Manager 8.0.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Palo Alto Software Update Manager 8.0.lnk
backup=C:\WINDOWS\pss\Palo Alto Software Update Manager 8.0.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^ST Thumbnails Explorer 1.2.2195.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ST Thumbnails Explorer 1.2.2195.lnk
backup=C:\WINDOWS\pss\ST Thumbnails Explorer 1.2.2195.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Slickparkdale^Start Menu^Programs^Startup^Adobe Gamma.lnk]
backup=C:\WINDOWS\pss\Adobe Gamma.lnkStartup
path=C:\Documents and Settings\Slickparkdale\Start Menu\Programs\Startup\Adobe Gamma.lnk

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Slickparkdale^Start Menu^Programs^Startup^AOL OpenRide.lnk]
path=C:\Documents and Settings\Slickparkdale\Start Menu\Programs\Startup\AOL OpenRide.lnk
backup=C:\WINDOWS\pss\AOL OpenRide.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Slickparkdale^Start Menu^Programs^Startup^LimeWire On Startup.lnk]
backup=C:\WINDOWS\pss\LimeWire On Startup.lnkStartup
path=C:\Documents and Settings\Slickparkdale\Start Menu\Programs\Startup\LimeWire On Startup.lnk

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Slickparkdale^Start Menu^Programs^Startup^palmOne Registration.lnk]
backup=C:\WINDOWS\pss\palmOne Registration.lnkStartup
path=C:\Documents and Settings\Slickparkdale\Start Menu\Programs\Startup\palmOne Registration.lnk

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Slickparkdale^Start Menu^Programs^Startup^Stardock ObjectDock.lnk]
backup=C:\WINDOWS\pss\Stardock ObjectDock.lnkStartup
path=C:\Documents and Settings\Slickparkdale\Start Menu\Programs\Startup\Stardock ObjectDock.lnk

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^WSUSUpdateAdmin^Start Menu^Programs^Startup^Adobe Gamma.lnk]
path=C:\Documents and Settings\WSUSUpdateAdmin\Start Menu\Programs\Startup\Adobe Gamma.lnk
backup=C:\WINDOWS\pss\Adobe Gamma.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^WSUSUpdateAdmin^Start Menu^Programs^Startup^HotSync Manager.LNK]
path=C:\Documents and Settings\WSUSUpdateAdmin\Start Menu\Programs\Startup\HotSync Manager.LNK
backup=C:\WINDOWS\pss\HotSync Manager.LNKStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^WSUSUpdateAdmin^Start Menu^Programs^Startup^palmOne Registration.lnk]
path=C:\Documents and Settings\WSUSUpdateAdmin\Start Menu\Programs\Startup\palmOne Registration.lnk
backup=C:\WINDOWS\pss\palmOne Registration.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\!ewido]
C:\Program Files\ewido anti-spyware 4.0\ewido.exe /minimized

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AIM]
C:\Program Files\AIM\aim.exe -cnetwait.odl

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6]
C:\Program Files\AIM6\aim6.exe /d locale=en-US ee://aol/imApp

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOL Fast Start]
C:\Program Files\AOL 9.0\AOL.EXE -b

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOL Spyware Protection]
C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOLDialer]
2006-10-23 07:50 71216 -ra—— C:\Program Files\Common Files\AOL\ACS\AOLDial.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATI Launchpad]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATI Remote Control]
2002-10-22 13:55 159744 –a—— C:\Program Files\ATI Multimedia\RemCtrl\ATIX10.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATICCC]
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe runtime -Delay

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIModeChange]
Ati2mdxx.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
2003-01-25 00:00 315392 –a—— C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-01-01 13:23 15360 –a—— C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CursorXP]
C:\Program Files\CursorXP\CursorXP.exe -s

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EmailScan]
C:\Program Files\mcafee.com\antivirus\mcvsescn.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus CX4800 Series]
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIADA.EXE /P26 EPSON Stylus CX4800 Series /O6 USB001 /M Stylus CX4800

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe /startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager]
2006-09-25 19:52 50736 –a—— C:\Program Files\Common Files\AOL\1137808604\ee\AOLSoftware.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPDJ Taskbar Utility]
2002-11-05 13:34 188416 –a—— C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM .exe -startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe -start

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Jet Detection]
2001-11-29 01:00 28672 –a—— C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut]
2007-02-07 15:21 54832 –a—— C:\Program Files\CyberLink\PowerDVD\Language\Language.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MPFExe]
C:\Program Files\mcafee.com\personal firewall\MPfTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
C:\Program Files\Messenger\msmsgs.exe /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MySpaceIM]
C:\Program Files\MySpace\IM\MySpaceIM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MyWebSearch Email Plugin]
C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2001-07-09 11:50 155648 –a—— C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OASClnt]
C:\Program Files\mcafee.com\antivirus\oasclnt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Picasa Media Detector]
C:\Program Files\Picasa2\PicasaMediaDetector

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\qttask.exe -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray]
C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
2007-02-07 15:24 71216 ——— C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SeaMonkey Quick Launch]
C:\Program Files\mozilla.org\SeaMonkey\SeaMonkey.exe -turbo

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\sscRun]
C:\Program Files\Common Files\AOL\1137808604\ee\services\sscFirewallPlugin\ver1_205_1_1\SSCRun.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2007-03-14 02:43 83608 –a—— C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Uniblue Registry Booster]
C:\Program Files\Uniblue\Registry Booster\RegistryBooster.exe /S

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg]
2000-05-11 01:00 90112 –a—— C:\WINDOWS\UpdReg.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\wben]
2007-06-12 12:25 287704 –a—— C:\Program Files\Starfield\Desktop Notifier\wben.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
C:\Program Files\Winamp\winampa.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WINDVDPatch]
CTHELPER.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WSUSOfflineUpdate]
D:\cmd\DoUpdate.cmd /autoreboot /showlog

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe -quiet

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"x10nets"=3 (0x3)
"ose"=3 (0x3)
"ATI Smart"=2 (0x2)
"Ati HotKey Poller"=2 (0x2)
"AOL TopSpeedMonitor"=2 (0x2)
"AOL ACS"=2 (0x2)
"Adobe LM Service"=3 (0x3)

R0 hotcore3;hotcore3;C:\WINDOWS\system32\drivers\hotcore3.sys [2007-03-07 12:16]
R0 hpt3xx;hpt3xx;C:\WINDOWS\system32\drivers\HPT3xx.sys [2002-09-18 06:29]
R2 {95808DC4-FA4A-4c74-92FE-5B863F82066B};{95808DC4-FA4A-4c74-92FE-5B863F82066B};C:\Program Files\CyberLink\PowerDVD\000.fcl [2006-11-02 15:51]
R3 ga302nd5;NETGEAR GA302T Gigabit Adapter;C:\WINDOWS\system32\DRIVERS\ga302nd5.sys [2002-01-24 22:40]
S3 Memctl;Memctl;C:\Program Files\ABIT\FlashMenu\Memctl.sys [2001-11-29 19:49]

.
**************************************************************************

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-01 16:45:29
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

PROCESS: C:\WINDOWS\system32\lsass.exe [5.01.2600.2180]
-> C:\Program Files\Eset\pr_imon.dll
.
Completion time: 2008-01-01 16:48:20
C:\qoobox\ComboFix-quarantined-files.txt 2008-01-01 21:48:03
C:\qoobox\ComboFix2.txt 2008-01-01 19:02:35
C:\qoobox\ComboFix3.txt 2007-07-29 00:39:03

Logfile of HijackThis v1.99.1
Scan saved at 7:09:18 AM, on 1/2/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Eset\nod32krn.exe
C:\Program Files\CyberLink\Shared files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\system32\devldr32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\mozilla.org\SeaMonkey\seamonkey.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\ThisKind\hijackthis_sfx.exe
C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://home.sirius.com/manageaccount.do
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O3 - Toolbar: My &Web Search - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL (file missing)
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: ATI TV - {44226DFF-747E-4edc-B30C-78752E50CD0C} - C:\Program Files\ATI Multimedia\tv\EXPLBAR.DLL
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Movies Extractor Scout LITE - {AD7D74D5-54E1-405F-8B7B-48915C29157F} - C:\Program Files\Movies Extractor Scout LITE\flashextract.exe
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/f…p1.0.0.15-3.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1137395833730
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
Post #6
Hi :)

Step 1

Open HijackThis, perform a scan and put a check next to the following items (if present):

O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O3 - Toolbar: My &Web Search - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL (file missing)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/f…p1.0.0.15-3.cab

Close all programs except HijackThis and click on Fix checked.

Step 2

Please do an online scan with Kaspersky WebScanner.

Click on Kaspersky Online Scanner. On the welcome screen, click Accept.

You will be promted to install an ActiveX component from Kaspersky, click Install.

  • The program will launch and then begin downloading the latest definition files.
  • Once the files have been downloaded click on Next.
  • Now click on Scan Settings.
  • In the scan settings make sure that the following are selected:

  • Scan using the following Anti-Virus database:

    Extended (if available, otherwise Standard)

  • Scan Options:

    Scan Archives
    Scan Mail Bases

  • Click OK.
  • Now under Select a Target to Scan:

    Select My Computer.

  • The program will start and scan your system.
  • The scan will take a while so be patient and let it run.
  • Once the scan is complete it will display if your system has been infected.
  • Now click on the Save as Text button and save the file to your desktop.

Step 3

In your next reply, please post:

  • the Kaspersky Online Scan report
  • a new HijackThis log
  • How is your computer currently running?
Post #8
Hi :)

You can try this to shorten the log:

Please download FixEdit.

  • Double-click on FixEdit.exe to open the program.
  • Go to File > Open, select the Kaspersky Online Scan report and click on Open.
  • Click on the Make Global Changes tab.
  • In the upper part (red lines), select Does NOT Contain the Test Key anywhere.
  • In the Test Key Text box, enter the text in the quotebox below:

    Object is locked
  • Make sure Retain only the lines that pass the Test Parameter, Discard the Rest is checked.
  • Click OK.
  • Now, click on the Show/Edit Current Text tab. Your Kaspersky Online Scan report should be a lot shorter now. Go to File > SaveAs and save the file to your desktop.
  • Please post the contents of that file in your next reply.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI