What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Homepage Hijacked

9 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I'd like to get rid of awesome homepage, but have yet to figure it out. I read some other topics, and ran hijackthis, but don't want to make any changes without someone's help. I've attached the log file. Think you could help?

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:00:00 PM, on 1/5/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\WINDOWS\Nhksrv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Blackice\blackd.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\Program Files\NavNT\defwatch.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\NavNT\rtvscan.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\system32\MsgSys.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\DELLMMKB.EXE
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\NavNT\vptray.exe
C:\Program Files\Netropa\OSD.exe
C:\Program Files\parentalcontrol\parentalcontrol.exe
C:\Program Files\Fisher-Price\Easy-Link internet launch pad\Easy-Link internet launch pad.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe
C:\Program Files\Microsoft Office 97\Office\OSA.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://awesomehomepage.com/newsletter.php?list=funnyfunpages
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://wsooya.t.rack.cc/sp.php (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
O1 - Hosts: 127.127.127.127 elite
O2 - BHO: (no name) - rsion - (no file)
O2 - BHO: Parental Control Toolbar - {4E7BD74F-2B8D-469E-9FA5-A33DE8DBE931} - C:\PROGRA~1\PARENT~1\PARENT~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O3 - Toolbar: Parental Control Toolbar - {4E7BD74F-2B8D-469E-9FA5-A33DE8DBE931} - C:\PROGRA~1\PARENT~1\PARENT~1.DLL
O4 - HKLM\..\Run: [DellTouch] C:\WINDOWS\DELLMMKB.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe
O4 - HKLM\..\Run: [RegisterDropHandler] C:\PROGRA~1\ScanSoft\TEXTBR~1.0\Bin\REGIST~1.EXE
O4 - HKLM\..\Run: [parentalcontrol] "C:\Program Files\parentalcontrol\parentalcontrol.exe" "C:\Program Files\parentalcontrol\parentalcontrol.dll" "parentalcontrol"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [eligmini] C:\Program Files\Fisher-Price\Easy-Link internet launch pad\Easy-Link internet launch pad.exe 0
O4 - HKLM\..\RunServices: [RegisterDropHandler] C:\PROGRA~1\ScanSoft\TEXTBR~1.0\Bin\REGIST~1.EXE
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AnyDVD] C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe
O4 - HKCU\..\Run: [WinUpdater] "C:\Program Files\WinUpdater\update.exe" /background
O4 - HKCU\..\Run: [AROReminder] C:\Program Files\Advanced Registry Optimizer\ARO.exe -rem
O4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft Office 97\Office\OSA.EXE
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/…?p=ZCxdm492YYUS
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: PalTalk - {4EAFEF58-EEFA-4116-983D-03B49BCBFFFE} - C:\Program Files\Paltalk Messenger\Paltalk.exe (file missing)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/f…p1.0.0.15-3.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200212…meInstaller.exe
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://207.188.7.150/26acb15e7a0d1bf9fe00/netzip/RdxIE2.cab
O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: BlackICE - Internet Security Systems, Inc. - C:\Program Files\Blackice\blackd.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: Netropa NHK Server (Nhksrv) - Unknown owner - C:\WINDOWS\Nhksrv.exe
O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: RapApp - Internet Security Systems, Inc. - C:\Program Files\Blackice\RapApp.exe

–
End of file - 7477 bytes
Post #2
Hello and Welcome to the forum.

You have more issues then just that homepage

I suggest you do this:

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Clear "Hide file extensions for known file types."
Under the "Hidden files" folder, select "Show hidden files and folders."
Clear "Hide protected operating system files."
Click Apply, and then click OK.


Please do not delete anything unless instructed to.


Please go to http://virusscan.jotti.org , click on Browse, and upload the following file for analysis:

C:\Program Files\WinUpdater\update.exe

Then click Submit. Allow the file to be scanned, and then please copy and paste the results here for me to see.


If Jotti is too busy you can try these.

http://www.kaspersky.com/scanforvirus.html


http://www.virustotal.com/en/indexf.html
Post #3
Thanks. I ran the scan and below are the results. Scan taken on 06 Jan 2008 19:15:18 (GMT) A-Squared Found nothing AntiVir Found TR/Drop.Agen.bba.18 ArcaVir Found nothing Avast Found Win32:Adware-gen AVG Antivirus Found nothing BitDefender Found nothing ClamAV Found nothing CPsecure Found nothing Dr.Web Found nothing F-Prot Antivirus Found nothing F-Secure Anti-Virus Found not-a-virus:AdWare.Win32.Mostofate.au (4, 1, 400) Fortinet Found Adware/Mostofate Ikarus Found Virus.Win32.AdWare Kaspersky Anti-Virus Found not-a-virus:AdWare.Win32.Mostofate.au NOD32 Found nothing Norman Virus Control Found Softomate.OG Panda Antivirus Found nothing Rising Antivirus Found nothing Sophos Antivirus Found nothing VirusBuster Found nothing VBA32 Found AdWare.Win32.Mostofate.au
Post #4
Lets run an F-Secure online scan it will scan for Viruses, Spyware and RootKits:
  • Click HERE
  • Scroll to the bottom of the page and click the Start scanning button. A window will pop up.
  • Allow the Active X control to be installed on your computer, then click the Accept button
  • Click Full System Scan and allow the components to download and the scan to complete.
  • If malware is found, check Submit samples to F-Secure then select Automatic cleaning
  • When cleaning has finitished, click Show report (this will open an Internet Explorer window containing the report)
  • Highlight and Copy (CTRL + C) the complete report, and Paste (CTRL + V) in a new reply to this post
If Automatic cleaning with Submit samples hangs, click Cancel, then New Scan
  • When the cleaning option is presented, Uncheck Submit samples to F-Secure
  • Click Automatic cleaning
  • When cleaning has finitished, click Show report (this will open an Internet Explorer window containing the report)
  • Highlight and Copy (CTRL + C) the complete report, and Paste (CTRL + V) in a new reply to this post

Note: This scan will only work with Internet Explorer.
You must be logged on a administrator rights to run this scan.
The scan may take a few hours.

Also let me know how the computer is running now.
Post #5
Computer seems to be running fine. Scanning Report Sunday, January 06, 2008 15:07:41 - 18:10:00 Computer name: DD74W811 Scanning type: Scan system for viruses, rootkits, spyware Target: C:\ ——————————————————————————– Result: 12 malware found Tracking Cookie (spyware) System (Disinfected) System System System System System System System System System System Trojan-Downloader.Win32.Agent.ba (virus) C:\WINDOWS\SYSTEM32\CORELSYS.DLL (Renamed & Submitted) ——————————————————————————– Statistics Scanned: Files: 60214 System: 5687 Not scanned: 28 Actions: Disinfected: 1 Renamed: 1 Deleted: 0 None: 10 Submitted: 1 Files not scanned: C:\PAGEFILE.SYS C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT C:\WINDOWS\SOFTWAREDISTRIBUTION\EVENTCACHE\{7458F2FE-4ED6-4708-86ED-C57A7292E38E}.BIN C:\WINDOWS\$NTUNINSTALLQ828026$\MSDXM.OCX C:\WINDOWS\$NTUNINSTALLQ328940$\REG00003 C:\WINDOWS\$NTUNINSTALLQ323172$\REG00003 C:\WINDOWS\$NTUNINSTALLQ319580$\REG00002 C:\WINDOWS\$NTUNINSTALLQ317277$\REG00002 C:\WINDOWS\$NTUNINSTALLQ315403$\REG00002 C:\WINDOWS\$NTUNINSTALLQ315000$\NETSETUP.EXE C:\WINDOWS\$NTUNINSTALLQ315000$\SPUNINST\SPUNINST.EXE C:\WINDOWS\$NTUNINSTALLQ314862$\QMGR.DLL C:\WINDOWS\$NTUNINSTALLQ314862$\SPUNINST\SPUNINST.EXE C:\WINDOWS\$NTUNINSTALLQ314147$\REG00002 C:\WINDOWS\$NTUNINSTALLQ311967$\REG00002 C:\WINDOWS\$NTUNINSTALLQ311889$\REG00002 C:\WINDOWS\$NTUNINSTALLQ311889$\SPUNINST\SPUNINST.EXE C:\WINDOWS\$NTUNINSTALLQ309521$\DXMASF.DLL C:\WINDOWS\$NTUNINSTALLQ309521$\SPUNINST\SPUNINST.EXE C:\WINDOWS\$NTUNINSTALLKB839645$\SHELL32.DLL C:\WINDOWS\$NTUNINSTALLKB837001$\DAO360.DLL C:\WINDOWS\$NTUNINSTALLKB835732$\BROWSER.DLL C:\WINDOWS\$NTUNINSTALLKB835732$\RTCDLL.DLL C:\WINDOWS\$NTUNINSTALLKB828741$\CATSRV.DLL C:\WINDOWS\$NTUNINSTALLKB828035$\MSGSVC.DLL C:\WINDOWS\$NTUNINSTALLKB828028$\MSASN1.DLL C:\WINDOWS\$NTUNINSTALLKB824141$\USER32.DLL C:\DOCUMENTS AND SETTINGS\JEN\LOCAL SETTINGS\TEMP\HSPERFDATA_JEN\3468 ——————————————————————————– Options Scanning engines: F-Secure AVP: 7.0.171, 2008-01-05 F-Secure Blacklight: 1.0.64 F-Secure Draco: 1.0.35, 0601-150-72 F-Secure Libra: 2.4.2, 2008-01-04 F-Secure Orion: 1.2.37, 2008-01-05 F-Secure Pegasus: 1.19.0, 2007-11-30 Scanning options: Scan defined files: COM EXE SYS OV? BIN SCR DLL SHS HTM HTML HTT VBS JS INF VXD DO? XL? RTF CPL WIZ HTA PP? PWZ P?T MSO PIF . ACM ASP AX CNV CSC DRV INI MDB MPD MPP MPT OBD OBT OCX PCI TLB TSP WBK WBT WPC WSH VWP WML BOO HLP TD0 TT6 MSG ASD JSE VBE WSC CHM EML PRC SHB BAT LNK ANI AVB CEO CMD LSP MAP MHT MIF PDF PHP POT WMF NWS TAR TGZ WSF ZL? {* ZIP JAR ARJ LZH TAR TGZ GZ CAB RAR BZ2 HQXSWF Use Advanced heuristics
Post #7
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:32:53 PM, on 1/6/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\WINDOWS\Nhksrv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Blackice\blackd.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\Program Files\NavNT\defwatch.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\NavNT\rtvscan.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\system32\MsgSys.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\DELLMMKB.EXE
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\NavNT\vptray.exe
C:\Program Files\Netropa\OSD.exe
C:\Program Files\parentalcontrol\parentalcontrol.exe
C:\Program Files\Fisher-Price\Easy-Link internet launch pad\Easy-Link internet launch pad.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe
C:\Program Files\Microsoft Office 97\Office\OSA.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://awesomehomepage.com/newsletter.php?list=funnyfunpages
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://wsooya.t.rack.cc/sp.php (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
O1 - Hosts: 127.127.127.127 elite
O2 - BHO: (no name) - rsion - (no file)
O2 - BHO: Parental Control Toolbar - {4E7BD74F-2B8D-469E-9FA5-A33DE8DBE931} - C:\PROGRA~1\PARENT~1\PARENT~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O3 - Toolbar: Parental Control Toolbar - {4E7BD74F-2B8D-469E-9FA5-A33DE8DBE931} - C:\PROGRA~1\PARENT~1\PARENT~1.DLL
O4 - HKLM\..\Run: [DellTouch] C:\WINDOWS\DELLMMKB.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe
O4 - HKLM\..\Run: [RegisterDropHandler] C:\PROGRA~1\ScanSoft\TEXTBR~1.0\Bin\REGIST~1.EXE
O4 - HKLM\..\Run: [parentalcontrol] "C:\Program Files\parentalcontrol\parentalcontrol.exe" "C:\Program Files\parentalcontrol\parentalcontrol.dll" "parentalcontrol"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [eligmini] C:\Program Files\Fisher-Price\Easy-Link internet launch pad\Easy-Link internet launch pad.exe 0
O4 - HKLM\..\RunServices: [RegisterDropHandler] C:\PROGRA~1\ScanSoft\TEXTBR~1.0\Bin\REGIST~1.EXE
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AnyDVD] C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe
O4 - HKCU\..\Run: [WinUpdater] "C:\Program Files\WinUpdater\update.exe" /background
O4 - HKCU\..\Run: [AROReminder] C:\Program Files\Advanced Registry Optimizer\ARO.exe -rem
O4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft Office 97\Office\OSA.EXE
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/…?p=ZCxdm492YYUS
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: PalTalk - {4EAFEF58-EEFA-4116-983D-03B49BCBFFFE} - C:\Program Files\Paltalk Messenger\Paltalk.exe (file missing)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} (F-Secure Online Scanner 3.1) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/f…p1.0.0.15-3.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200212…meInstaller.exe
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://207.188.7.150/26acb15e7a0d1bf9fe00/netzip/RdxIE2.cab
O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: BlackICE - Internet Security Systems, Inc. - C:\Program Files\Blackice\blackd.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: Netropa NHK Server (Nhksrv) - Unknown owner - C:\WINDOWS\Nhksrv.exe
O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: RapApp - Internet Security Systems, Inc. - C:\Program Files\Blackice\RapApp.exe

–
End of file - 7602 bytes
Post #8
I suggest you do this:

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Clear "Hide file extensions for known file types."
Under the "Hidden files" folder, select "Show hidden files and folders."
Clear "Hide protected operating system files."
Click Apply, and then click OK.


Please do not delete anything unless instructed to.

Next:

Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»

Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.


(If you use FireFox or the Opera browser
To keep saved passwords, click No at the prompt.)

It's normal after running ATF cleaner that the PC will be slower to boot the first time.

Next:

Download ComboFix from Here to your Desktop.

**Note: In the event you already have Combofix, please delete it from your desktop and download this new version . It is important that it is saved directly to your desktop**
——————————————————————–
  • Close any open browsers and make sure you are disconnected from the net. Unplug the cable if need be before running combofix.
  • WARNING: IF you have not already done so Combofix will disconnect your machine from the Internet when it starts
  • Please do not re-connect your machine back to the Internet until Combofix has completely finished.
——————————————————————–

Double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.
Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review

****Note: Do not mouseclick combofix's window while it's running. That may cause it to stall or freeze ****

*If there is no internet connection when Combofix has completely finished then restart your computer to restore back the connections.
Post #9
ComboFix 08-01-04.1 - Jen 2008-01-06 18:46:13.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.254 [GMT -5:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
.

((((((((((((((((((((((((( Files Created from 2007-12-06 to 2008-01-06 )))))))))))))))))))))))))))))))
.

2008-01-05 17:49 . 2000-08-31 08:00 51,200 –a—— C:\WINDOWS\NirCmd.exe
2008-01-05 17:45 . 2008-01-05 17:45 d——– C:\Program Files\Trend Micro
2008-01-03 12:33 . 2008-01-03 12:33 d——– C:\Program Files\Fisher-Price
2007-12-29 18:39 . 2007-12-29 18:39 5,181 –a—— C:\ZB20071229183538001.xml
2007-12-29 18:34 . 2007-12-29 18:34 2,141 –a—— C:\ZB20071229183158001.xml
2007-12-29 18:28 . 2007-12-29 18:28 811 –a—— C:\ZB20071229182822001.xml
2007-12-27 15:13 . 2007-12-27 15:13 d——– C:\Program Files\CCleaner
2007-12-27 14:48 . 2007-12-27 14:49 d——– C:\Program Files\parentalcontrol
2007-12-27 10:52 . 2007-12-27 14:39 d——– C:\Documents and Settings\Jen\Application Data\GlarySoft
2007-12-27 10:48 . 2007-12-27 10:48 d——– C:\Program Files\Glary Utilities
2007-12-27 10:31 . 2007-12-27 10:31 d——– C:\Program Files\Advanced Registry Optimizer
2007-12-27 10:31 . 2007-12-27 10:31 d——– C:\Documents and Settings\Jen\Application Data\Sammsoft
2007-12-27 09:50 . 2007-12-27 09:50 d——– C:\Program Files\Lavasoft
2007-12-27 09:50 . 2007-12-27 09:50 d——– C:\Documents and Settings\All Users\Application Data\Lavasoft
2007-12-26 21:45 . 2007-12-27 14:35 d——– C:\Program Files\Netcom3 Cleaner
2007-12-19 15:05 . 2007-12-19 15:05 97,216 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\AnyDVD.sys
2007-12-08 08:53 . 2007-12-08 08:53 d——– C:\Documents and Settings\All Users\Application Data\Logishrd

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-06 01:37 ——— d—–w C:\Program Files\Blackice
2008-01-06 01:23 ——— d—–w C:\Program Files\MSN Messenger
2008-01-03 17:33 ——— d–h–w C:\Program Files\InstallShield Installation Information
2007-12-30 22:35 ——— d—–w C:\Program Files\InterActual
2007-12-28 05:05 ——— d—–w C:\Program Files\MovieStar
2007-12-27 20:34 ——— d—–w C:\Program Files\Java
2007-12-27 19:38 ——— d—–w C:\Program Files\TaxCut03
2007-12-27 19:35 ——— d—–w C:\Program Files\Yahoo!
2007-12-27 19:35 ——— d—–w C:\Program Files\WinAce
2007-12-27 19:35 ——— d—–w C:\Program Files\THQ
2007-12-27 19:35 ——— d—–w C:\Program Files\Scholastic
2007-12-27 19:35 ——— d—–w C:\Program Files\QuickTime
2007-12-27 19:35 ——— d—–w C:\Program Files\PhoneTools
2007-12-27 19:35 ——— d—–w C:\Program Files\OnNet Host Suite Data
2007-12-27 19:35 ——— d—–w C:\Program Files\Microsoft ActiveSync
2007-12-27 19:35 ——— d—–w C:\Program Files\Google
2007-12-27 19:35 ——— d—–w C:\Program Files\Creative
2007-12-27 19:35 ——— d—–w C:\Program Files\ConstructionCity
2007-12-27 19:35 ——— d—–w C:\Program Files\Broderbund
2007-12-27 19:35 ——— d—–w C:\Program Files\Ahead
2007-12-27 19:31 ——— d—–w C:\Program Files\NavNT
2007-12-27 14:49 ——— d—–w C:\Program Files\Common Files\Wise Installation Wizard
2007-12-26 20:07 ——— d—a-w C:\Documents and Settings\All Users\Application Data\TEMP
2007-12-21 02:00 ——— d—–w C:\Program Files\Jr. Firefighter Demo
2007-12-08 13:55 ——— d—–w C:\Program Files\Common Files\LogiShrd
2007-12-08 13:53 ——— d—–w C:\Program Files\Logitech
2007-12-03 16:47 ——— d—–w C:\Program Files\Nick Jr. Arcade
2007-11-13 10:25 20,480 —-a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-11-07 20:39 ——— d—–w C:\Program Files\Viva Media
2007-10-29 22:43 1,287,680 —-a-w C:\WINDOWS\SYSTEM32\quartz.dll
2007-10-27 22:40 222,720 —-a-w C:\WINDOWS\SYSTEM32\wmasf.dll
2007-08-04 00:13 87,608 -c–a-w C:\Documents and Settings\Jen\Application Data\ezpinst.exe
2007-08-04 00:13 47,360 -c–a-w C:\Documents and Settings\Jen\Application Data\pcouffin.sys
2006-09-26 18:06 107,592 -c–a-w C:\Documents and Settings\Dan\Application Data\GDIPFONTCACHEV1.DAT
2006-04-03 00:51 107,208 -c–a-w C:\Documents and Settings\DMiano\Application Data\GDIPFONTCACHEV1.DAT
1999-06-08 19:07 83,472 -c–a-w C:\Program Files\Uninstal.EXE
.

((((((((((((((((((((((((((((( snapshot@2008-01-05_20.25.05.62 )))))))))))))))))))))))))))))))))))))))))
.
+ 2007-05-07 21:38:46 500,120 —-a-w C:\WINDOWS\Downloaded Program Files\daas_s.dll
+ 2007-05-07 21:39:00 192,920 —-a-w C:\WINDOWS\Downloaded Program Files\fsauc.dll
+ 2007-05-07 21:39:24 254,360 —-a-w C:\WINDOWS\Downloaded Program Files\fscax.dll
- 2008-01-05 22:37:23 40,832 —-a-w C:\WINDOWS\SYSTEM32\PERFC009.DAT
+ 2008-01-06 01:41:28 40,832 —-a-w C:\WINDOWS\SYSTEM32\PERFC009.DAT
- 2008-01-05 22:37:23 313,038 —-a-w C:\WINDOWS\SYSTEM32\PERFH009.DAT
+ 2008-01-06 01:41:28 313,038 —-a-w C:\WINDOWS\SYSTEM32\PERFH009.DAT
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:56 15360]
"AnyDVD"="C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe" [2007-12-21 07:34 1649600]
"WinUpdater"="C:\Program Files\WinUpdater\update.exe" [2007-07-29 13:13 62828]
"AROReminder"="C:\Program Files\Advanced Registry Optimizer\ARO.exe" [2007-07-23 09:34 2084480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DellTouch"="C:\WINDOWS\DELLMMKB.EXE" [2001-09-23 08:14 163840]
"UpdReg"="C:\WINDOWS\Updreg.exe" [2000-05-11 02:00 90112]
"HPDJ Taskbar Utility"="C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe" [2001-09-12 09:00 196608]
"vptray"="C:\Program Files\NavNT\vptray.exe" [2001-12-05 10:53 73728]
"RegisterDropHandler"="C:\PROGRA~1\ScanSoft\TEXTBR~1.0\Bin\REGIST~1.EXE" [2000-05-31 14:32 22528]
"parentalcontrol"="C:\Program Files\parentalcontrol\parentalcontrol.exe" [2006-08-31 09:25 36544]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 05:24 286720]
"eligmini"="C:\Program Files\Fisher-Price\Easy-Link internet launch pad\Easy-Link internet launch pad.exe" [2007-03-16 16:27 487424]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
"RegisterDropHandler"="C:\PROGRA~1\ScanSoft\TEXTBR~1.0\Bin\REGIST~1.EXE" [2000-05-31 14:32 22528]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Office Startup.lnk - C:\Program Files\Microsoft Office 97\Office\OSA.EXE [1997-07-10 23:00:00]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled]
"BookmarkCentral"=C:\PROGRA~1\BMCENT~1\BMLauncher.exe
"MoneyStartUp10.0"="C:\Program Files\Microsoft Money\System\Activation.exe"
"InstantAccess"=C:\PROGRA~1\ScanSoft\TEXTBR~1.0\Bin\INSTAN~1.EXE /h
"DXM6Patch_981116"=C:\WINDOWS\p_981116.exe /Q:A
"AHQInit"=C:\Program Files\Creative\SBLive\Program\AHQInit.exe

R0 hpt3xx;hpt3xx;C:\WINDOWS\system32\DRIVERS\hpt3xx.sys [2001-08-23 07:00]
R0 PrecSim;PrecSim;C:\WINDOWS\system32\DRIVERS\precsim.sys [2002-04-26 00:00]
R2 CVPNDRV;Cisco Systems IPsec Driver;C:\WINDOWS\System32\Drivers\CVPNDRV.sys [2002-02-04 13:36]
R2 Nhksrv;Netropa NHK Server;C:\WINDOWS\Nhksrv.exe [2001-08-06 14:41]
R3 Msikbd2k;DellTouch;C:\WINDOWS\system32\DRIVERS\msikbd2k.sys [2000-10-03 16:18]
R4 black;black;C:\WINDOWS\system32\drivers\BlackDrv.sys [2005-03-29 18:04]
S3 dwusbdnt;dwusbdnt;C:\WINDOWS\system32\DRIVERS\dwusbdnt.sys [2002-05-24 11:52]
S3 DzlUsb;Dazzle DVC USB Device;C:\WINDOWS\system32\DRIVERS\DzlUsb.sys [2001-10-11 11:23]
S3 ISD200;USB Storage Adapter V2;C:\WINDOWS\system32\DRIVERS\ISD200.SYS [2000-08-29 20:05]
S3 RapFile;RapFile;C:\WINDOWS\System32\drivers\RapFile.sys [2003-06-19 18:40]
S3 RapNet;RapNet;C:\WINDOWS\System32\drivers\RapNet.sys [2003-06-19 18:40]
S3 S6U12BScanner;MUSTEK 1200 UB Still Image Device Service;C:\WINDOWS\system32\drivers\usbscan.sys [2004-08-04 01:58]

*Newly Created Service* - F-SECURE_STANDALONE_MINIFILTER
.
Contents of the 'Scheduled Tasks' folder
"2008-01-06 23:55:00 C:\WINDOWS\Tasks\Symantec NetDetect.job"
- C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE
"2008-01-04 21:00:00 C:\WINDOWS\Tasks\{198CE73A-3A32-4ABF-989B-E1E6AE22FC31}_DD74W811_Dan.job"
- C:\WINDOWS\System32\mobsync.exe
"2008-01-04 14:00:00 C:\WINDOWS\Tasks\{9D387C1F-DF91-4B48-9816-BFE456F165CF}_DD74W811_Dan.job"
- C:\WINDOWS\System32\mobsync.exe
"2008-01-04 21:00:00 C:\WINDOWS\Tasks\{A82782C8-060B-49D1-AC9D-D91757DA44F5}_DD74W811_Dan.job"
- C:\WINDOWS\System32\mobsync.exeA /Schedule=
"2008-01-04 14:00:00 C:\WINDOWS\Tasks\{BF6C171C-1FC2-4553-B5F7-64AAE4FB31B0}_DD74W811_Dan.job"
- C:\WINDOWS\System32\mobsync.exeA /Schedule=
"2008-01-04 21:00:00 C:\WINDOWS\Tasks\{D2F3BA9B-F229-488E-9E19-75EC68923AAA}_DD74W811_Dan.job"
- C:\WINDOWS\System32\mobsync.exe
"2008-01-04 21:00:00 C:\WINDOWS\Tasks\{DD7A8C89-237F-4A94-B492-1AAEA1754ED6}_DD74W811_Dan.job"
- C:\WINDOWS\System32\mobsync.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-06 18:55:29
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\WINDOWS\system32\CSGina.dll
-> C:\WINDOWS\System32\NavLogon.dll

PROCESS: C:\WINDOWS\explorer.exe [6.00.2900.3156]
-> C:\WINDOWS\system32\Ftpnls32.dll
.
Completion time: 2008-01-06 18:56:53
ComboFix-quarantined-files.txt 2008-01-06 23:56:46
ComboFix2.txt 2008-01-06 01:25:57
.
2007-12-13 05:08:48 — E O F —


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:00:36 PM, on 1/6/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\WINDOWS\Nhksrv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Blackice\blackd.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\Program Files\NavNT\defwatch.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\NavNT\rtvscan.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\system32\MsgSys.EXE
C:\WINDOWS\DELLMMKB.EXE
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\NavNT\vptray.exe
C:\Program Files\Netropa\OSD.exe
C:\Program Files\parentalcontrol\parentalcontrol.exe
C:\Program Files\Fisher-Price\Easy-Link internet launch pad\Easy-Link internet launch pad.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe
C:\Program Files\Microsoft Office 97\Office\OSA.EXE
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://awesomehomepage.com/newsletter.php?list=funnyfunpages
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://wsooya.t.rack.cc/sp.php (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
O1 - Hosts: 127.127.127.127 elite
O2 - BHO: (no name) - rsion - (no file)
O2 - BHO: Parental Control Toolbar - {4E7BD74F-2B8D-469E-9FA5-A33DE8DBE931} - C:\PROGRA~1\PARENT~1\PARENT~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O3 - Toolbar: Parental Control Toolbar - {4E7BD74F-2B8D-469E-9FA5-A33DE8DBE931} - C:\PROGRA~1\PARENT~1\PARENT~1.DLL
O4 - HKLM\..\Run: [DellTouch] C:\WINDOWS\DELLMMKB.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe
O4 - HKLM\..\Run: [RegisterDropHandler] C:\PROGRA~1\ScanSoft\TEXTBR~1.0\Bin\REGIST~1.EXE
O4 - HKLM\..\Run: [parentalcontrol] "C:\Program Files\parentalcontrol\parentalcontrol.exe" "C:\Program Files\parentalcontrol\parentalcontrol.dll" "parentalcontrol"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [eligmini] C:\Program Files\Fisher-Price\Easy-Link internet launch pad\Easy-Link internet launch pad.exe 0
O4 - HKLM\..\RunServices: [RegisterDropHandler] C:\PROGRA~1\ScanSoft\TEXTBR~1.0\Bin\REGIST~1.EXE
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AnyDVD] C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe
O4 - HKCU\..\Run: [WinUpdater] "C:\Program Files\WinUpdater\update.exe" /background
O4 - HKCU\..\Run: [AROReminder] C:\Program Files\Advanced Registry Optimizer\ARO.exe -rem
O4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft Office 97\Office\OSA.EXE
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/…?p=ZCxdm492YYUS
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: PalTalk - {4EAFEF58-EEFA-4116-983D-03B49BCBFFFE} - C:\Program Files\Paltalk Messenger\Paltalk.exe (file missing)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} (F-Secure Online Scanner 3.1) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/f…p1.0.0.15-3.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200212…meInstaller.exe
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://207.188.7.150/26acb15e7a0d1bf9fe00/netzip/RdxIE2.cab
O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: BlackICE - Internet Security Systems, Inc. - C:\Program Files\Blackice\blackd.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: Netropa NHK Server (Nhksrv) - Unknown owner - C:\WINDOWS\Nhksrv.exe
O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: RapApp - Internet Security Systems, Inc. - C:\Program Files\Blackice\RapApp.exe

–
End of file - 7602 bytes
Post #10
Open notepad and copy/paste the text in the quotebox below into it:

File::
C:\ZB20071229183538001.xml
C:\ZB20071229183158001.xml
C:\ZB20071229182822001.xml
C:\Program Files\WinUpdater\update.exe

Folder::
C:\Program Files\WinUpdater

Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WinUpdater"=-


Save this as Save this as "CFScript"


[external image: Posted Image]

Refering to the picture above, drag CFScript.txt into ComboFix.exe

Then post the results log and a new HijackThis log.


Also please describe how your computer behaves at the moment.
Post #11
Computer seems to be running fine.

ComboFix 08-01-04.1 - Jen 2008-01-06 19:17:22.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.185 [GMT -5:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Jen\Desktop\CFScript.txt
* Created a new restore point

FILE
C:\Program Files\WinUpdater\update.exe
C:\ZB20071229182822001.xml
C:\ZB20071229183158001.xml
C:\ZB20071229183538001.xml
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\WinUpdater
C:\Program Files\WinUpdater\Temp\license.txt
C:\Program Files\WinUpdater\update.exe
C:\ZB20071229182822001.xml
C:\ZB20071229183158001.xml
C:\ZB20071229183538001.xml

.
((((((((((((((((((((((((( Files Created from 2007-12-07 to 2008-01-07 )))))))))))))))))))))))))))))))
.

2008-01-05 17:49 . 2000-08-31 08:00 51,200 –a—— C:\WINDOWS\NirCmd.exe
2008-01-05 17:45 . 2008-01-05 17:45 d——– C:\Program Files\Trend Micro
2008-01-03 12:33 . 2008-01-03 12:33 d——– C:\Program Files\Fisher-Price
2007-12-27 15:13 . 2007-12-27 15:13 d——– C:\Program Files\CCleaner
2007-12-27 14:48 . 2007-12-27 14:49 d——– C:\Program Files\parentalcontrol
2007-12-27 10:52 . 2007-12-27 14:39 d——– C:\Documents and Settings\Jen\Application Data\GlarySoft
2007-12-27 10:48 . 2007-12-27 10:48 d——– C:\Program Files\Glary Utilities
2007-12-27 10:31 . 2007-12-27 10:31 d——– C:\Program Files\Advanced Registry Optimizer
2007-12-27 10:31 . 2007-12-27 10:31 d——– C:\Documents and Settings\Jen\Application Data\Sammsoft
2007-12-27 09:50 . 2007-12-27 09:50 d——– C:\Program Files\Lavasoft
2007-12-27 09:50 . 2007-12-27 09:50 d——– C:\Documents and Settings\All Users\Application Data\Lavasoft
2007-12-26 21:45 . 2007-12-27 14:35 d——– C:\Program Files\Netcom3 Cleaner
2007-12-19 15:05 . 2007-12-19 15:05 97,216 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\AnyDVD.sys
2007-12-08 08:53 . 2007-12-08 08:53 d——– C:\Documents and Settings\All Users\Application Data\Logishrd

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-06 01:37 ——— d—–w C:\Program Files\Blackice
2008-01-06 01:23 ——— d—–w C:\Program Files\MSN Messenger
2008-01-03 17:33 ——— d–h–w C:\Program Files\InstallShield Installation Information
2007-12-30 22:35 ——— d—–w C:\Program Files\InterActual
2007-12-28 05:05 ——— d—–w C:\Program Files\MovieStar
2007-12-27 20:34 ——— d—–w C:\Program Files\Java
2007-12-27 19:38 ——— d—–w C:\Program Files\TaxCut03
2007-12-27 19:35 ——— d—–w C:\Program Files\Yahoo!
2007-12-27 19:35 ——— d—–w C:\Program Files\WinAce
2007-12-27 19:35 ——— d—–w C:\Program Files\THQ
2007-12-27 19:35 ——— d—–w C:\Program Files\Scholastic
2007-12-27 19:35 ——— d—–w C:\Program Files\QuickTime
2007-12-27 19:35 ——— d—–w C:\Program Files\PhoneTools
2007-12-27 19:35 ——— d—–w C:\Program Files\OnNet Host Suite Data
2007-12-27 19:35 ——— d—–w C:\Program Files\Microsoft ActiveSync
2007-12-27 19:35 ——— d—–w C:\Program Files\Google
2007-12-27 19:35 ——— d—–w C:\Program Files\Creative
2007-12-27 19:35 ——— d—–w C:\Program Files\ConstructionCity
2007-12-27 19:35 ——— d—–w C:\Program Files\Broderbund
2007-12-27 19:35 ——— d—–w C:\Program Files\Ahead
2007-12-27 19:31 ——— d—–w C:\Program Files\NavNT
2007-12-27 14:49 ——— d—–w C:\Program Files\Common Files\Wise Installation Wizard
2007-12-26 20:07 ——— d—a-w C:\Documents and Settings\All Users\Application Data\TEMP
2007-12-21 02:00 ——— d—–w C:\Program Files\Jr. Firefighter Demo
2007-12-08 13:55 ——— d—–w C:\Program Files\Common Files\LogiShrd
2007-12-08 13:53 ——— d—–w C:\Program Files\Logitech
2007-12-03 16:47 ——— d—–w C:\Program Files\Nick Jr. Arcade
2007-11-13 10:25 20,480 —-a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-11-07 20:39 ——— d—–w C:\Program Files\Viva Media
2007-10-29 22:43 1,287,680 —-a-w C:\WINDOWS\SYSTEM32\quartz.dll
2007-10-27 22:40 222,720 —-a-w C:\WINDOWS\SYSTEM32\wmasf.dll
2007-08-04 00:13 87,608 -c–a-w C:\Documents and Settings\Jen\Application Data\ezpinst.exe
2007-08-04 00:13 47,360 -c–a-w C:\Documents and Settings\Jen\Application Data\pcouffin.sys
2006-09-26 18:06 107,592 -c–a-w C:\Documents and Settings\Dan\Application Data\GDIPFONTCACHEV1.DAT
2006-04-03 00:51 107,208 -c–a-w C:\Documents and Settings\DMiano\Application Data\GDIPFONTCACHEV1.DAT
1999-06-08 19:07 83,472 -c–a-w C:\Program Files\Uninstal.EXE
.

((((((((((((((((((((((((((((( snapshot@2008-01-05_20.25.05.62 )))))))))))))))))))))))))))))))))))))))))
.
+ 2007-05-07 21:38:46 500,120 —-a-w C:\WINDOWS\Downloaded Program Files\daas_s.dll
+ 2007-05-07 21:39:00 192,920 —-a-w C:\WINDOWS\Downloaded Program Files\fsauc.dll
+ 2007-05-07 21:39:24 254,360 —-a-w C:\WINDOWS\Downloaded Program Files\fscax.dll
- 2008-01-05 22:37:23 40,832 —-a-w C:\WINDOWS\SYSTEM32\PERFC009.DAT
+ 2008-01-06 23:58:32 40,832 —-a-w C:\WINDOWS\SYSTEM32\PERFC009.DAT
- 2008-01-05 22:37:23 313,038 —-a-w C:\WINDOWS\SYSTEM32\PERFH009.DAT
+ 2008-01-06 23:58:32 313,038 —-a-w C:\WINDOWS\SYSTEM32\PERFH009.DAT
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:56 15360]
"AnyDVD"="C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe" [2007-12-21 07:34 1649600]
"AROReminder"="C:\Program Files\Advanced Registry Optimizer\ARO.exe" [2007-07-23 09:34 2084480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DellTouch"="C:\WINDOWS\DELLMMKB.EXE" [2001-09-23 08:14 163840]
"UpdReg"="C:\WINDOWS\Updreg.exe" [2000-05-11 02:00 90112]
"HPDJ Taskbar Utility"="C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe" [2001-09-12 09:00 196608]
"vptray"="C:\Program Files\NavNT\vptray.exe" [2001-12-05 10:53 73728]
"RegisterDropHandler"="C:\PROGRA~1\ScanSoft\TEXTBR~1.0\Bin\REGIST~1.EXE" [2000-05-31 14:32 22528]
"parentalcontrol"="C:\Program Files\parentalcontrol\parentalcontrol.exe" [2006-08-31 09:25 36544]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 05:24 286720]
"eligmini"="C:\Program Files\Fisher-Price\Easy-Link internet launch pad\Easy-Link internet launch pad.exe" [2007-03-16 16:27 487424]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
"RegisterDropHandler"="C:\PROGRA~1\ScanSoft\TEXTBR~1.0\Bin\REGIST~1.EXE" [2000-05-31 14:32 22528]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Office Startup.lnk - C:\Program Files\Microsoft Office 97\Office\OSA.EXE [1997-07-10 23:00:00]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled]
"BookmarkCentral"=C:\PROGRA~1\BMCENT~1\BMLauncher.exe
"MoneyStartUp10.0"="C:\Program Files\Microsoft Money\System\Activation.exe"
"InstantAccess"=C:\PROGRA~1\ScanSoft\TEXTBR~1.0\Bin\INSTAN~1.EXE /h
"DXM6Patch_981116"=C:\WINDOWS\p_981116.exe /Q:A
"AHQInit"=C:\Program Files\Creative\SBLive\Program\AHQInit.exe

R0 hpt3xx;hpt3xx;C:\WINDOWS\system32\DRIVERS\hpt3xx.sys [2001-08-23 07:00]
R0 PrecSim;PrecSim;C:\WINDOWS\system32\DRIVERS\precsim.sys [2002-04-26 00:00]
R2 CVPNDRV;Cisco Systems IPsec Driver;C:\WINDOWS\System32\Drivers\CVPNDRV.sys [2002-02-04 13:36]
R2 Nhksrv;Netropa NHK Server;C:\WINDOWS\Nhksrv.exe [2001-08-06 14:41]
R3 Msikbd2k;DellTouch;C:\WINDOWS\system32\DRIVERS\msikbd2k.sys [2000-10-03 16:18]
R4 black;black;C:\WINDOWS\system32\drivers\BlackDrv.sys [2005-03-29 18:04]
S3 dwusbdnt;dwusbdnt;C:\WINDOWS\system32\DRIVERS\dwusbdnt.sys [2002-05-24 11:52]
S3 DzlUsb;Dazzle DVC USB Device;C:\WINDOWS\system32\DRIVERS\DzlUsb.sys [2001-10-11 11:23]
S3 ISD200;USB Storage Adapter V2;C:\WINDOWS\system32\DRIVERS\ISD200.SYS [2000-08-29 20:05]
S3 RapFile;RapFile;C:\WINDOWS\System32\drivers\RapFile.sys [2003-06-19 18:40]
S3 RapNet;RapNet;C:\WINDOWS\System32\drivers\RapNet.sys [2003-06-19 18:40]
S3 S6U12BScanner;MUSTEK 1200 UB Still Image Device Service;C:\WINDOWS\system32\drivers\usbscan.sys [2004-08-04 01:58]

*Newly Created Service* - F-SECURE_STANDALONE_MINIFILTER
.
Contents of the 'Scheduled Tasks' folder
"2008-01-07 00:20:00 C:\WINDOWS\Tasks\Symantec NetDetect.job"
- C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE
"2008-01-04 21:00:00 C:\WINDOWS\Tasks\{198CE73A-3A32-4ABF-989B-E1E6AE22FC31}_DD74W811_Dan.job"
- C:\WINDOWS\System32\mobsync.exeA /Schedule=
"2008-01-04 14:00:00 C:\WINDOWS\Tasks\{9D387C1F-DF91-4B48-9816-BFE456F165CF}_DD74W811_Dan.job"
- C:\WINDOWS\System32\mobsync.exe
"2008-01-04 21:00:00 C:\WINDOWS\Tasks\{A82782C8-060B-49D1-AC9D-D91757DA44F5}_DD74W811_Dan.job"
- C:\WINDOWS\System32\mobsync.exeA /Schedule=
"2008-01-04 14:00:00 C:\WINDOWS\Tasks\{BF6C171C-1FC2-4553-B5F7-64AAE4FB31B0}_DD74W811_Dan.job"
- C:\WINDOWS\System32\mobsync.exe
"2008-01-04 21:00:00 C:\WINDOWS\Tasks\{D2F3BA9B-F229-488E-9E19-75EC68923AAA}_DD74W811_Dan.job"
- C:\WINDOWS\System32\mobsync.exeA /Schedule=
"2008-01-04 21:00:00 C:\WINDOWS\Tasks\{DD7A8C89-237F-4A94-B492-1AAEA1754ED6}_DD74W811_Dan.job"
- C:\WINDOWS\System32\mobsync.exeA /Schedule=
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-06 19:22:57
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\WINDOWS\system32\CSGina.dll
-> C:\WINDOWS\System32\NavLogon.dll
.
Completion time: 2008-01-06 19:24:16
ComboFix-quarantined-files.txt 2008-01-07 00:24:04
ComboFix2.txt 2008-01-06 23:56:54
ComboFix3.txt 2008-01-06 01:25:57
.
2007-12-13 05:08:48 — E O F —


ComboFix 08-01-04.1 - Jen 2008-01-06 19:17:22.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.185 [GMT -5:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Jen\Desktop\CFScript.txt
* Created a new restore point

FILE
C:\Program Files\WinUpdater\update.exe
C:\ZB20071229182822001.xml
C:\ZB20071229183158001.xml
C:\ZB20071229183538001.xml
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\WinUpdater
C:\Program Files\WinUpdater\Temp\license.txt
C:\Program Files\WinUpdater\update.exe
C:\ZB20071229182822001.xml
C:\ZB20071229183158001.xml
C:\ZB20071229183538001.xml

.
((((((((((((((((((((((((( Files Created from 2007-12-07 to 2008-01-07 )))))))))))))))))))))))))))))))
.

2008-01-05 17:49 . 2000-08-31 08:00 51,200 –a—— C:\WINDOWS\NirCmd.exe
2008-01-05 17:45 . 2008-01-05 17:45 d——– C:\Program Files\Trend Micro
2008-01-03 12:33 . 2008-01-03 12:33 d——– C:\Program Files\Fisher-Price
2007-12-27 15:13 . 2007-12-27 15:13 d——– C:\Program Files\CCleaner
2007-12-27 14:48 . 2007-12-27 14:49 d——– C:\Program Files\parentalcontrol
2007-12-27 10:52 . 2007-12-27 14:39 d——– C:\Documents and Settings\Jen\Application Data\GlarySoft
2007-12-27 10:48 . 2007-12-27 10:48 d——– C:\Program Files\Glary Utilities
2007-12-27 10:31 . 2007-12-27 10:31 d——– C:\Program Files\Advanced Registry Optimizer
2007-12-27 10:31 . 2007-12-27 10:31 d——– C:\Documents and Settings\Jen\Application Data\Sammsoft
2007-12-27 09:50 . 2007-12-27 09:50 d——– C:\Program Files\Lavasoft
2007-12-27 09:50 . 2007-12-27 09:50 d——– C:\Documents and Settings\All Users\Application Data\Lavasoft
2007-12-26 21:45 . 2007-12-27 14:35 d——– C:\Program Files\Netcom3 Cleaner
2007-12-19 15:05 . 2007-12-19 15:05 97,216 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\AnyDVD.sys
2007-12-08 08:53 . 2007-12-08 08:53 d——– C:\Documents and Settings\All Users\Application Data\Logishrd

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-06 01:37 ——— d—–w C:\Program Files\Blackice
2008-01-06 01:23 ——— d—–w C:\Program Files\MSN Messenger
2008-01-03 17:33 ——— d–h–w C:\Program Files\InstallShield Installation Information
2007-12-30 22:35 ——— d—–w C:\Program Files\InterActual
2007-12-28 05:05 ——— d—–w C:\Program Files\MovieStar
2007-12-27 20:34 ——— d—–w C:\Program Files\Java
2007-12-27 19:38 ——— d—–w C:\Program Files\TaxCut03
2007-12-27 19:35 ——— d—–w C:\Program Files\Yahoo!
2007-12-27 19:35 ——— d—–w C:\Program Files\WinAce
2007-12-27 19:35 ——— d—–w C:\Program Files\THQ
2007-12-27 19:35 ——— d—–w C:\Program Files\Scholastic
2007-12-27 19:35 ——— d—–w C:\Program Files\QuickTime
2007-12-27 19:35 ——— d—–w C:\Program Files\PhoneTools
2007-12-27 19:35 ——— d—–w C:\Program Files\OnNet Host Suite Data
2007-12-27 19:35 ——— d—–w C:\Program Files\Microsoft ActiveSync
2007-12-27 19:35 ——— d—–w C:\Program Files\Google
2007-12-27 19:35 ——— d—–w C:\Program Files\Creative
2007-12-27 19:35 ——— d—–w C:\Program Files\ConstructionCity
2007-12-27 19:35 ——— d—–w C:\Program Files\Broderbund
2007-12-27 19:35 ——— d—–w C:\Program Files\Ahead
2007-12-27 19:31 ——— d—–w C:\Program Files\NavNT
2007-12-27 14:49 ——— d—–w C:\Program Files\Common Files\Wise Installation Wizard
2007-12-26 20:07 ——— d—a-w C:\Documents and Settings\All Users\Application Data\TEMP
2007-12-21 02:00 ——— d—–w C:\Program Files\Jr. Firefighter Demo
2007-12-08 13:55 ——— d—–w C:\Program Files\Common Files\LogiShrd
2007-12-08 13:53 ——— d—–w C:\Program Files\Logitech
2007-12-03 16:47 ——— d—–w C:\Program Files\Nick Jr. Arcade
2007-11-13 10:25 20,480 —-a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-11-07 20:39 ——— d—–w C:\Program Files\Viva Media
2007-10-29 22:43 1,287,680 —-a-w C:\WINDOWS\SYSTEM32\quartz.dll
2007-10-27 22:40 222,720 —-a-w C:\WINDOWS\SYSTEM32\wmasf.dll
2007-08-04 00:13 87,608 -c–a-w C:\Documents and Settings\Jen\Application Data\ezpinst.exe
2007-08-04 00:13 47,360 -c–a-w C:\Documents and Settings\Jen\Application Data\pcouffin.sys
2006-09-26 18:06 107,592 -c–a-w C:\Documents and Settings\Dan\Application Data\GDIPFONTCACHEV1.DAT
2006-04-03 00:51 107,208 -c–a-w C:\Documents and Settings\DMiano\Application Data\GDIPFONTCACHEV1.DAT
1999-06-08 19:07 83,472 -c–a-w C:\Program Files\Uninstal.EXE
.

((((((((((((((((((((((((((((( snapshot@2008-01-05_20.25.05.62 )))))))))))))))))))))))))))))))))))))))))
.
+ 2007-05-07 21:38:46 500,120 —-a-w C:\WINDOWS\Downloaded Program Files\daas_s.dll
+ 2007-05-07 21:39:00 192,920 —-a-w C:\WINDOWS\Downloaded Program Files\fsauc.dll
+ 2007-05-07 21:39:24 254,360 —-a-w C:\WINDOWS\Downloaded Program Files\fscax.dll
- 2008-01-05 22:37:23 40,832 —-a-w C:\WINDOWS\SYSTEM32\PERFC009.DAT
+ 2008-01-06 23:58:32 40,832 —-a-w C:\WINDOWS\SYSTEM32\PERFC009.DAT
- 2008-01-05 22:37:23 313,038 —-a-w C:\WINDOWS\SYSTEM32\PERFH009.DAT
+ 2008-01-06 23:58:32 313,038 —-a-w C:\WINDOWS\SYSTEM32\PERFH009.DAT
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:56 15360]
"AnyDVD"="C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe" [2007-12-21 07:34 1649600]
"AROReminder"="C:\Program Files\Advanced Registry Optimizer\ARO.exe" [2007-07-23 09:34 2084480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DellTouch"="C:\WINDOWS\DELLMMKB.EXE" [2001-09-23 08:14 163840]
"UpdReg"="C:\WINDOWS\Updreg.exe" [2000-05-11 02:00 90112]
"HPDJ Taskbar Utility"="C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe" [2001-09-12 09:00 196608]
"vptray"="C:\Program Files\NavNT\vptray.exe" [2001-12-05 10:53 73728]
"RegisterDropHandler"="C:\PROGRA~1\ScanSoft\TEXTBR~1.0\Bin\REGIST~1.EXE" [2000-05-31 14:32 22528]
"parentalcontrol"="C:\Program Files\parentalcontrol\parentalcontrol.exe" [2006-08-31 09:25 36544]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 05:24 286720]
"eligmini"="C:\Program Files\Fisher-Price\Easy-Link internet launch pad\Easy-Link internet launch pad.exe" [2007-03-16 16:27 487424]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
"RegisterDropHandler"="C:\PROGRA~1\ScanSoft\TEXTBR~1.0\Bin\REGIST~1.EXE" [2000-05-31 14:32 22528]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Office Startup.lnk - C:\Program Files\Microsoft Office 97\Office\OSA.EXE [1997-07-10 23:00:00]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled]
"BookmarkCentral"=C:\PROGRA~1\BMCENT~1\BMLauncher.exe
"MoneyStartUp10.0"="C:\Program Files\Microsoft Money\System\Activation.exe"
"InstantAccess"=C:\PROGRA~1\ScanSoft\TEXTBR~1.0\Bin\INSTAN~1.EXE /h
"DXM6Patch_981116"=C:\WINDOWS\p_981116.exe /Q:A
"AHQInit"=C:\Program Files\Creative\SBLive\Program\AHQInit.exe

R0 hpt3xx;hpt3xx;C:\WINDOWS\system32\DRIVERS\hpt3xx.sys [2001-08-23 07:00]
R0 PrecSim;PrecSim;C:\WINDOWS\system32\DRIVERS\precsim.sys [2002-04-26 00:00]
R2 CVPNDRV;Cisco Systems IPsec Driver;C:\WINDOWS\System32\Drivers\CVPNDRV.sys [2002-02-04 13:36]
R2 Nhksrv;Netropa NHK Server;C:\WINDOWS\Nhksrv.exe [2001-08-06 14:41]
R3 Msikbd2k;DellTouch;C:\WINDOWS\system32\DRIVERS\msikbd2k.sys [2000-10-03 16:18]
R4 black;black;C:\WINDOWS\system32\drivers\BlackDrv.sys [2005-03-29 18:04]
S3 dwusbdnt;dwusbdnt;C:\WINDOWS\system32\DRIVERS\dwusbdnt.sys [2002-05-24 11:52]
S3 DzlUsb;Dazzle DVC USB Device;C:\WINDOWS\system32\DRIVERS\DzlUsb.sys [2001-10-11 11:23]
S3 ISD200;USB Storage Adapter V2;C:\WINDOWS\system32\DRIVERS\ISD200.SYS [2000-08-29 20:05]
S3 RapFile;RapFile;C:\WINDOWS\System32\drivers\RapFile.sys [2003-06-19 18:40]
S3 RapNet;RapNet;C:\WINDOWS\System32\drivers\RapNet.sys [2003-06-19 18:40]
S3 S6U12BScanner;MUSTEK 1200 UB Still Image Device Service;C:\WINDOWS\system32\drivers\usbscan.sys [2004-08-04 01:58]

*Newly Created Service* - F-SECURE_STANDALONE_MINIFILTER
.
Contents of the 'Scheduled Tasks' folder
"2008-01-07 00:20:00 C:\WINDOWS\Tasks\Symantec NetDetect.job"
- C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE
"2008-01-04 21:00:00 C:\WINDOWS\Tasks\{198CE73A-3A32-4ABF-989B-E1E6AE22FC31}_DD74W811_Dan.job"
- C:\WINDOWS\System32\mobsync.exeA /Schedule=
"2008-01-04 14:00:00 C:\WINDOWS\Tasks\{9D387C1F-DF91-4B48-9816-BFE456F165CF}_DD74W811_Dan.job"
- C:\WINDOWS\System32\mobsync.exe
"2008-01-04 21:00:00 C:\WINDOWS\Tasks\{A82782C8-060B-49D1-AC9D-D91757DA44F5}_DD74W811_Dan.job"
- C:\WINDOWS\System32\mobsync.exeA /Schedule=
"2008-01-04 14:00:00 C:\WINDOWS\Tasks\{BF6C171C-1FC2-4553-B5F7-64AAE4FB31B0}_DD74W811_Dan.job"
- C:\WINDOWS\System32\mobsync.exe
"2008-01-04 21:00:00 C:\WINDOWS\Tasks\{D2F3BA9B-F229-488E-9E19-75EC68923AAA}_DD74W811_Dan.job"
- C:\WINDOWS\System32\mobsync.exeA /Schedule=
"2008-01-04 21:00:00 C:\WINDOWS\Tasks\{DD7A8C89-237F-4A94-B492-1AAEA1754ED6}_DD74W811_Dan.job"
- C:\WINDOWS\System32\mobsync.exeA /Schedule=
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-06 19:22:57
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\WINDOWS\system32\CSGina.dll
-> C:\WINDOWS\System32\NavLogon.dll
.
Completion time: 2008-01-06 19:24:16
ComboFix-quarantined-files.txt 2008-01-07 00:24:04
ComboFix2.txt 2008-01-06 23:56:54
ComboFix3.txt 2008-01-06 01:25:57
.
2007-12-13 05:08:48 — E O F —
Post #13
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:26:58 PM, on 1/6/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\WINDOWS\Nhksrv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Blackice\blackd.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\Program Files\NavNT\defwatch.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\NavNT\rtvscan.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\system32\MsgSys.EXE
C:\WINDOWS\DELLMMKB.EXE
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\NavNT\vptray.exe
C:\Program Files\Netropa\OSD.exe
C:\Program Files\parentalcontrol\parentalcontrol.exe
C:\Program Files\Fisher-Price\Easy-Link internet launch pad\Easy-Link internet launch pad.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe
C:\Program Files\Microsoft Office 97\Office\OSA.EXE
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://awesomehomepage.com/newsletter.php?list=funnyfunpages
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://wsooya.t.rack.cc/sp.php (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
O1 - Hosts: 127.127.127.127 elite
O2 - BHO: (no name) - rsion - (no file)
O2 - BHO: Parental Control Toolbar - {4E7BD74F-2B8D-469E-9FA5-A33DE8DBE931} - C:\PROGRA~1\PARENT~1\PARENT~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O3 - Toolbar: Parental Control Toolbar - {4E7BD74F-2B8D-469E-9FA5-A33DE8DBE931} - C:\PROGRA~1\PARENT~1\PARENT~1.DLL
O4 - HKLM\..\Run: [DellTouch] C:\WINDOWS\DELLMMKB.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe
O4 - HKLM\..\Run: [RegisterDropHandler] C:\PROGRA~1\ScanSoft\TEXTBR~1.0\Bin\REGIST~1.EXE
O4 - HKLM\..\Run: [parentalcontrol] "C:\Program Files\parentalcontrol\parentalcontrol.exe" "C:\Program Files\parentalcontrol\parentalcontrol.dll" "parentalcontrol"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [eligmini] C:\Program Files\Fisher-Price\Easy-Link internet launch pad\Easy-Link internet launch pad.exe 0
O4 - HKLM\..\RunServices: [RegisterDropHandler] C:\PROGRA~1\ScanSoft\TEXTBR~1.0\Bin\REGIST~1.EXE
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AnyDVD] C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe
O4 - HKCU\..\Run: [AROReminder] C:\Program Files\Advanced Registry Optimizer\ARO.exe -rem
O4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft Office 97\Office\OSA.EXE
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/…?p=ZCxdm492YYUS
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: PalTalk - {4EAFEF58-EEFA-4116-983D-03B49BCBFFFE} - C:\Program Files\Paltalk Messenger\Paltalk.exe (file missing)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} (F-Secure Online Scanner 3.1) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/f…p1.0.0.15-3.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200212…meInstaller.exe
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://207.188.7.150/26acb15e7a0d1bf9fe00/netzip/RdxIE2.cab
O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: BlackICE - Internet Security Systems, Inc. - C:\Program Files\Blackice\blackd.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: Netropa NHK Server (Nhksrv) - Unknown owner - C:\WINDOWS\Nhksrv.exe
O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: RapApp - Internet Security Systems, Inc. - C:\Program Files\Blackice\RapApp.exe

–
End of file - 7517 bytes
Post #14
Run hijackthis. Hit None of the above, Click Do a System Scan Only. Put a checkmark/tick in the box on the left side on these:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://awesomehomepage.com/newsletter.php?list=funnyfunpages
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://wsooya.t.rack.cc/sp.php (obfuscated)
O1 - Hosts: 127.127.127.127 elite
O2 - BHO: (no name) - rsion - (no file)
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O16 - DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} (F-Secure Online Scanner 3.1) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/f…p1.0.0.15-3.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200212…meInstaller.exe
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://207.188.7.150/26acb15e7a0d1bf9fe00/netzip/RdxIE2.cab
O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab

Close ALL windows and browsers except HijackThis and click "Fix checked"



Empty Recycle Bin

Reboot and "copy/paste" a new HijackThis log file into this thread.

Also please describe how your computer behaves at the moment.
Post #15
Booted up fine. SVCHost was taking up all system resources for a minute or so after the boot. Now all is fine.. Awesomehomepage is gone.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:49:45 PM, on 1/6/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\WINDOWS\Nhksrv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Blackice\blackd.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\Program Files\NavNT\defwatch.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\NavNT\rtvscan.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\WINDOWS\DELLMMKB.EXE
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\NavNT\vptray.exe
C:\Program Files\parentalcontrol\parentalcontrol.exe
C:\WINDOWS\system32\MsgSys.EXE
C:\Program Files\Netropa\OSD.exe
C:\Program Files\Fisher-Price\Easy-Link internet launch pad\Easy-Link internet launch pad.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Microsoft Office 97\Office\OSA.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Internet Explorer\iexplore.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
O2 - BHO: Parental Control Toolbar - {4E7BD74F-2B8D-469E-9FA5-A33DE8DBE931} - C:\PROGRA~1\PARENT~1\PARENT~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O3 - Toolbar: Parental Control Toolbar - {4E7BD74F-2B8D-469E-9FA5-A33DE8DBE931} - C:\PROGRA~1\PARENT~1\PARENT~1.DLL
O4 - HKLM\..\Run: [DellTouch] C:\WINDOWS\DELLMMKB.EXE
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe
O4 - HKLM\..\Run: [RegisterDropHandler] C:\PROGRA~1\ScanSoft\TEXTBR~1.0\Bin\REGIST~1.EXE
O4 - HKLM\..\Run: [parentalcontrol] "C:\Program Files\parentalcontrol\parentalcontrol.exe" "C:\Program Files\parentalcontrol\parentalcontrol.dll" "parentalcontrol"
O4 - HKLM\..\Run: [eligmini] C:\Program Files\Fisher-Price\Easy-Link internet launch pad\Easy-Link internet launch pad.exe 0
O4 - HKLM\..\RunServices: [RegisterDropHandler] C:\PROGRA~1\ScanSoft\TEXTBR~1.0\Bin\REGIST~1.EXE
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AnyDVD] C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe
O4 - HKCU\..\Run: [AROReminder] C:\Program Files\Advanced Registry Optimizer\ARO.exe -rem
O4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft Office 97\Office\OSA.EXE
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/…?p=ZCxdm492YYUS
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: PalTalk - {4EAFEF58-EEFA-4116-983D-03B49BCBFFFE} - C:\Program Files\Paltalk Messenger\Paltalk.exe (file missing)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: BlackICE - Internet Security Systems, Inc. - C:\Program Files\Blackice\blackd.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: Netropa NHK Server (Nhksrv) - Unknown owner - C:\WINDOWS\Nhksrv.exe
O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: RapApp - Internet Security Systems, Inc. - C:\Program Files\Blackice\RapApp.exe

–
End of file - 6504 bytes

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI