What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Still having Popup Problems -- W/Scan

16 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1 last edited
I can't apologize enough for having such a late response. Please allow me a new thread. I'm still getting ads from SetTheTrend, SmacChat, Zedo, and the like. I was finally able to run the combofix scan. I have enclosed a new HJT log and the CF Scan. Once again, I apologize.

HJT

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:35:35 PM, on 1/11/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Microsoft Windows OneCare Live\Antivirus\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton Internet Security\ISSVC.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Microsoft Windows OneCare Live\Firewall\msfwsvc.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\Program Files\Microsoft Windows OneCare Live\winss.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…o&pf=laptop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…o&pf=laptop
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: {3ed3e1b8-6757-81ab-8af4-bf63a1e27d96} - {69d72e1a-36fb-4fa8-ba18-75768b1e3de3} - C:\WINDOWS\system32\jgxfogfu.dll (file missing)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {C64D090A-8460-4719-8AF0-3786A041A8DD} - C:\WINDOWS\system32\vtstq.dll (file missing)
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: TextAloud - {F053C368-5458-45B2-9B4D-D8914BDDDBFF} - C:\PROGRA~1\TEXTAL~1\TAForIE.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [OneCareUI] "C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [0caf330e] rundll32.exe "C:\WINDOWS\system32\wycgsasr.dll",b
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\RunServices: [csr] csrrs.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe -quiet
O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'Default user')
O4 - Startup: hamachi.lnk = C:\Program Files\Hamachi\hamachi.exe
O4 - Global Startup: BTTray.lnk = ?
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Customer\Start Menu\Programs\IMVU\Run IMVU.lnk
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q305&bd=presario&pf=laptop
O15 - Trusted Zone: *.amaena.com
O15 - Trusted Zone: *.doginhispen.com
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-GB/a-UNO1/GAME_UNO1.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/…lscbase4009.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo…otoUploader.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab31267.cab
O16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.5 Control) - http://filelodge.com/ImageUploader3.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab57176.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs:
O20 - Winlogon Notify: cinduhej - cinduhej.dll (file missing)
O20 - Winlogon Notify: nnnnnkl - nnnnnkl.dll (file missing)
O22 - SharedTaskScheduler: grassily - {4233ac08-a2c4-4742-a0b4-83719613d62c} - (no file)
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

–
End of file - 11698 bytes

CF

ComboFix 08-01-11.3 - Customer 2008-01-11 22:44:24.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.336 [GMT -5:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Start Menu\Live Safety Center.lnk
C:\Documents and Settings\All Users\Start Menu\Online Security Guide.lnk
C:\Documents and Settings\Customer\Application Data\macromedia\Flash Player\#SharedObjects\GAMGETPM\www.broadcaster.com
C:\Documents and Settings\Customer\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com
C:\Documents and Settings\Customer\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com\settings.sol
C:\Documents and Settings\Customer\Favorites\Online Security Guide.lnk
C:\Program Files\Common Files\crosof~1
C:\Program Files\Common Files\curity~1
C:\Program Files\Common Files\fnts~1
C:\Program Files\Common Files\fnts~1\FNTS~1\ctxad-527.0000
C:\Program Files\Common Files\fnts~1\FNTS~1\ctxad-527.0001
C:\Program Files\Common Files\inetget
C:\Program Files\Common Files\inetget\
C:\Program Files\Common Files\mantec~1
C:\Program Files\Common Files\pppatc~1
C:\Program Files\Common Files\racle~1
C:\Program Files\Common Files\sks~1
C:\Program Files\Common Files\windows
C:\Program Files\fnts~1
C:\Program Files\icroso~1
C:\Program Files\outerinfo
C:\Program Files\outerinfo\outerinfo.ico
C:\Program Files\outerinfo\Terms.rtf
C:\Program Files\pppatc~1
C:\Program Files\sstem~1
C:\Program Files\Temporary
C:\Program Files\toolbar888\
C:\Program Files\WinAble
C:\Program Files\WinBudget
C:\Program Files\WinBudget\bin\matrix.dat
C:\Program Files\ymbols~1
C:\Program Files\ystem3~1
C:\Temp\1cb
C:\Temp\1cb\syscheck.log
C:\temp\tn3
C:\WINDOWS\b122.exe
C:\WINDOWS\curity~1
C:\WINDOWS\ppatch~1
C:\WINDOWS\stem32~1
C:\WINDOWS\system32\a13
C:\WINDOWS\system32\cinduhej.dllbox
C:\WINDOWS\system32\curity~1
C:\WINDOWS\system32\drivers\core.cache.dsk
C:\WINDOWS\system32\drivers\core.sys
C:\WINDOWS\system32\e2
C:\WINDOWS\system32\g1
C:\WINDOWS\system32\hjkmp.bak1
C:\WINDOWS\system32\hjkmp.ini
C:\WINDOWS\system32\hjllm.bak1
C:\WINDOWS\system32\hjllm.ini
C:\WINDOWS\system32\i8
C:\WINDOWS\system32\jlnmp.bak1
C:\WINDOWS\system32\jlnmp.ini
C:\WINDOWS\system32\llkkj.bak1
C:\WINDOWS\system32\llkkj.ini
C:\WINDOWS\system32\pac.txt
C:\WINDOWS\system32\pstwa.bak1
C:\WINDOWS\system32\pstwa.ini
C:\WINDOWS\system32\qtstv.bak1
C:\WINDOWS\system32\qtstv.bak2
C:\WINDOWS\system32\qtstv.ini
C:\WINDOWS\system32\ssembl~1
C:\WINDOWS\system32\stem~1
C:\WINDOWS\system32\wcpsu.exe
C:\WINDOWS\system32\wyadd.bak1
C:\WINDOWS\system32\wyadd.ini
C:\WINDOWS\system32\wybeg.bak1
C:\WINDOWS\system32\wybeg.ini
C:\WINDOWS\system32\x22
C:\WINDOWS\system32\ystem3~1
C:\WINDOWS\system32\zxdnt3d.cfg

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
——-\LEGACY_CORE
——-\LEGACY_NETWORK_MONITOR
——-\core
——-\NPF


((((((((((((((((((((((((( Files Created from 2007-12-12 to 2008-01-12 )))))))))))))))))))))))))))))))
.

2008-01-11 22:41 . 2000-08-31 08:00 51,200 –a—— C:\WINDOWS\NirCmd.exe
2008-01-11 22:23 . 2008-01-11 22:23 d——– C:\VundoFix Backups
2007-12-23 15:22 . 2007-12-23 15:22 d——– C:\Program Files\Lavasoft
2007-12-23 15:22 . 2007-12-23 15:22 d——– C:\Documents and Settings\All Users\Application Data\Lavasoft
2007-12-22 13:41 . 2007-12-22 13:41 d——– C:\Program Files\Iarsn
2007-12-22 13:41 . 2006-10-24 16:29 17,928 –a—— C:\WINDOWS\system32\drivers\Tsknf700.sys
2007-12-21 10:46 . 2007-12-21 10:46 0 –a—— C:\WINDOWS\nsreg.dat

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-12 04:03 ——— d—–w C:\Program Files\mIRC
2008-01-12 03:32 ——— d—–w C:\Program Files\Microsoft Windows OneCare Live
2008-01-12 03:15 ——— d—–w C:\Documents and Settings\Customer\Application Data\Hamachi
2008-01-12 03:08 ——— d—–w C:\Program Files\Common Files\Symantec Shared
2007-12-23 20:21 ——— d—–w C:\Program Files\Common Files\Wise Installation Wizard
2007-12-15 02:54 ——— d—–w C:\Program Files\ArtMoney
2007-12-12 21:35 ——— d—–w C:\Program Files\TextAloud
2007-12-10 04:15 ——— d—–w C:\Program Files\Morpheus Toolbar
2007-12-04 14:56 93,264 —-a-w C:\WINDOWS\system32\drivers\aswmon.sys
2007-12-04 14:55 94,544 —-a-w C:\WINDOWS\system32\drivers\aswmon2.sys
2007-12-04 14:53 23,152 —-a-w C:\WINDOWS\system32\drivers\aswRdr.sys
2007-12-04 14:51 42,912 —-a-w C:\WINDOWS\system32\drivers\aswTdi.sys
2007-12-04 14:49 26,624 —-a-w C:\WINDOWS\system32\drivers\aavmker4.sys
2007-12-01 22:57 ——— d—–w C:\Program Files\StepMania
2007-11-27 22:10 ——— d—–w C:\Program Files\Winamp
2007-11-26 03:52 ——— d—–w C:\Program Files\Windows Defender
2007-11-17 00:55 ——— d—–w C:\Program Files\Morpheus
2007-11-13 20:35 ——— d—–w C:\Program Files\Alwil Software
2007-11-13 19:37 ——— d—–w C:\Program Files\MSN Messenger
2007-11-13 10:25 20,480 —-a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-01-18 18:09 85,120 —-a-w C:\Documents and Settings\Customer\Application Data\GDIPFONTCACHEV1.DAT
2006-12-04 23:13 6,365,144 —-a-w C:\Program Files\Bradyok Software.zip
2006-11-28 01:52 9,256,119 —-a-w C:\Program Files\Kronia jdsngfids.exe
2006-10-03 21:48 307,200 —-a-w C:\Program Files\Uninstall My Web Search.dll
2006-06-26 15:11 0 —ha-w C:\Program Files\Toolbar888
2006-04-21 03:44 32 —-a-r C:\Documents and Settings\All Users\hash.dat
2005-12-08 02:32 79 —-a-w C:\Documents and Settings\London\Play RTB.bat
2005-10-04 23:07 169 —-a-w C:\Documents and Settings\London\Unlocks.DAT
2005-08-05 02:40 96 —-a-w C:\Documents and Settings\London\RTB - dedicated.bat
1989-12-12 15:10 1,100,000 –sh–r C:\WINDOWS\njcclnc.exe
.

((((((((((((((((((((((((((((((((((((((((((((( AWF ))))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
—-a-w 2,664,448 2007-04-28 20:15:12 C:\Documents and Settings\All Users\Application Data\Skype\Plugins\Plugins\1163D2B46CC742E5A3CC9E4157887751\bak\TalkAndWrite.exe

—-a-w 81,920 2004-07-27 23:50:18 C:\Program Files\Common Files\InstallShield\UpdateService\bak\issch.exe

—-a-w 221,184 2004-07-27 23:50:42 C:\Program Files\Common Files\InstallShield\UpdateService\bak\ISUSPM.exe

—-a-w 90,112 2002-09-20 20:16:30 C:\Program Files\Common Files\Logitech\QCDriver2\bak\LVCOMS.EXE

—-a-w 180,269 2006-05-07 19:40:30 C:\Program Files\Common Files\Real\Update_OB\bak\realsched.exe

—-a-w 58,992 2005-03-23 19:34:32 C:\Program Files\Common Files\Symantec Shared\bak\ccApp.exe

—-a-w 3,739,648 2007-01-01 21:22:02 C:\Program Files\Google\Google Talk\bak\googletalk.exe

—-a-w 49,152 2005-02-17 06:11:42 C:\Program Files\Hp\HP Software Update\bak\HPWuSchd2.exe

—-a-w 256,576 2006-10-30 14:36:36 C:\Program Files\iTunes\bak\iTunesHelper.exe

—-a-w 36,975 2005-06-03 07:52:54 C:\Program Files\Java\jre1.5.0_04\bin\bak\jusched.exe

—-a-w 67,128 2007-03-30 02:10:23 C:\Program Files\Logitech\Desktop Messenger\8876480\Program\bak\LogitechDesktopMessenger.exe

—-a-w 155,648 2002-09-11 17:58:06 C:\Program Files\Logitech\ImageStudio\bak\ISStart.exe

—-a-w 45,056 2002-09-11 17:57:28 C:\Program Files\Logitech\ImageStudio\bak\LogiTray.exe

—-a-w 1,694,208 2004-10-13 16:24:37 C:\Program Files\Messenger\bak\msmsgs.exe

—-a-w 4,898,816 2007-01-12 01:45:10 C:\Program Files\MySpace\IM\bak\MySpaceIM.exe

—-a-w 282,624 2006-10-25 23:58:18 C:\Program Files\QuickTime\bak\qttask.exe

—-a-w 49,152 2003-05-08 16:00:58 C:\Program Files\ScanSoft\OmniPageSE2.0\bak\OpwareSE2.exe

—-a-w 692,316 2005-02-02 12:11:12 C:\Program Files\Synaptics\SynTP\bak\SynTPEnh.exe

—-a-w 102,492 2005-02-02 12:12:22 C:\Program Files\Synaptics\SynTP\bak\SynTPLpr.exe

—-a-w 15,872 2006-09-07 17:19:27 C:\Program Files\Unlocker\bak\UnlockerAssistant.exe

—-a-w 866,584 2006-11-03 22:20:12 C:\Program Files\Windows Defender\bak\MSASCui.exe

—-a-w 208,952 2004-08-04 13:00:00 C:\WINDOWS\ime\imjp8_1\bak\IMJPMIG.EXE
—-a-w 208,952 2004-08-04 13:00:00 C:\WINDOWS\ime\imjp8_1\imjpmig.exe

—-a-w 44,032 2004-08-04 13:00:00 C:\WINDOWS\ime\imkr6_1\bak\IMEKRMIG.EXE
—-a-w 44,032 2004-08-04 13:00:00 C:\WINDOWS\ime\imkr6_1\imekrmig.exe

—-a-w 15,360 2004-08-04 08:00:00 C:\WINDOWS\system32\bak\ctfmon.exe
—-a-w 15,360 2004-08-04 13:00:00 C:\WINDOWS\system32\ctfmon.exe

—-a-w 17,474,680 2007-09-06 02:50:42 C:\WINDOWS\system32\bak\MRT.exe
—-a-w 17,642,616 2008-01-02 18:21:36 C:\WINDOWS\system32\MRT.exe

—-a-w 342,016 2004-08-04 08:00:00 C:\WINDOWS\system32\bak\regscan.exe

—-a-w 59,392 2004-08-04 13:00:00 C:\WINDOWS\system32\IME\PINTLGNT\bak\ImScInst.exe
—-a-w 59,392 2004-08-04 13:00:00 C:\WINDOWS\system32\IME\PINTLGNT\imscinst.exe

.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{69d72e1a-36fb-4fa8-ba18-75768b1e3de3}]
C:\WINDOWS\system32\jgxfogfu.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C64D090A-8460-4719-8AF0-3786A041A8DD}]
C:\WINDOWS\system32\vtstq.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 08:00 15360]
"msnmsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 11:54 5674352]
"Yahoo! Pager"="C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-04 08:00 208952]
"IMEKRMIG6.1"="C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE" [2004-08-04 08:00 44032]
"MSPY2002"="C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-04 08:00 59392]
"OneCareUI"="C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe" [2007-10-01 08:53 66600]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [ ]
"0caf330e"="C:\WINDOWS\system32\wycgsasr.dll" [ ]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 08:00 79224]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
"csr"="csrrs.exe" []

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 08:00 15360]
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 15:38 39264]

C:\Documents and Settings\Customer\Start Menu\Programs\Startup\
hamachi.lnk - C:\Program Files\Hamachi\hamachi.exe [2007-10-30 19:42:11]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cinduhej]
cinduhej.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\nnnnnkl]
nnnnnkl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\OneCareMP]
@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^sdxqm.exe]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\sdxqm.exe
backup=C:\WINDOWS\pss\sdxqm.exeCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^London^Start Menu^Programs^Startup^Zeno.lnk]
path=C:\Documents and Settings\London\Start Menu\Programs\Startup\Zeno.lnk
backup=C:\WINDOWS\pss\Zeno.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^London^Start Menu^Programs^Startup^Z_Start.lnk]
path=C:\Documents and Settings\London\Start Menu\Programs\Startup\Z_Start.lnk
backup=C:\WINDOWS\pss\Z_Start.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\anphgh]
C:\WINDOWS\system32\bvlpgj.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
–a—— 2005-04-11 12:00 339968 C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BrowserUpdateSched]
C:\Documents and Settings\London\Desktop\owl\pwinmrag.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Cpqset]
–a—— 2005-02-17 16:01 233534 C:\Program Files\HPQ\Default Settings\cpqset.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eabconfg.cpl]
–a—— 2004-12-03 15:24 290816 C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
–a—— 2006-01-15 13:42 120320 C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpWirelessAssistant]
–a—— 2005-04-01 17:11 794624 C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LDM]
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LSBWatcher]
–a—— 2004-10-14 15:54 253952 c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\newname]
C:\windows\newname7.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002A]
–a—— 2004-08-04 08:00 455168 C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync]
–a—— 2004-08-04 08:00 455168 C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray]
–a—— 2006-05-07 14:40 208941 C:\Program Files\Real\RealPlayer\RealPlay.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\services32]
C:\Program Files\Common Files\Windows\mc-110-12-0000140.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\wafa743f.dll]


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
–a—— 2004-12-20 13:41 33792 C:\Program Files\Winamp\winampa.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\wkwih]
C:\WINDOWS\system32\bvlpgj.exe

R1 TSKNF700.SYS;TSKNF700.SYS;C:\WINDOWS\system32\Drivers\TSKNF700.SYS [2006-10-24 16:29]
R3 HSFHWATI;HSFHWATI;C:\WINDOWS\system32\DRIVERS\HSFHWATI.sys [2004-12-15 10:18]
S3 PhilCam8116;Logitech QuickCam Pro 3000(PID_08B0);C:\WINDOWS\system32\DRIVERS\CamDrL21.sys [2002-06-10 14:16]
S3 USBDongle;USBDongle;C:\WINDOWS\system32\DRIVERS\USBKey.sys [2004-01-30 08:31]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{79ac897e-4e89-11da-b554-00c09fa80eb0}]
\Shell\AutoRun\command - E:\setupSNK.exe

.
Contents of the 'Scheduled Tasks' folder
"2008-01-09 23:19:02 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2007-12-22 01:00:00 C:\WINDOWS\Tasks\Norton AntiVirus - Scan my computer - London.job"
- C:\PROGRA~1\NORTON~1\NORTON~1\NAVW32.EXEh/task:
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-11 23:08:22
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-11 23:20:46 - machine was rebooted
ComboFix-quarantined-files.txt 2008-01-12 04:20:43
.
2008-01-12 03:06:17 — E O F —

I hope this helps. Once more, sorry about the extreme delay.
Post #2
You need to stay with me here.
The infection you have also infects legit files.
This will take a number of fixes to complete.

Open notepad and copy/paste the text in the quotebox below into it:

File::
C:\Program Files\Kronia jdsngfids.exe
C:\Program Files\Toolbar888
C:\WINDOWS\njcclnc.exe
C:\WINDOWS\system32\jgxfogfu.dll
C:\WINDOWS\system32\vtstq.dll
C:\WINDOWS\system32\bvlpgj.exe
C:\Documents and Settings\London\Desktop\owl\pwinmrag.exe
C:\windows\newname7.exe

Folder::
C:\Program Files\Toolbar888
C:\Program Files\Google\Google Desktop Search

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{69d72e1a-36fb-4fa8-ba18-75768b1e3de3}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C64D090A-8460-4719-8AF0-3786A041A8DD}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
"csr"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cinduhej]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\nnnnnkl]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\wafa743f.dll]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\wkwih]


Save this as Save this as "CFScript"


[external image: Posted Image]

Refering to the picture above, drag CFScript.txt into ComboFix.exe

Then post the results log and a new HijackThis log.


Also please describe how your computer behaves at the moment.
Post #3
Rahky, Every time you reboot / shutdown the infections you have are going to duplicate. As I posted above, you need to stay with this until it's gone. If you don't have the time to do this now, you need to find the time and we'll have to start over.
Post #4
Okay. At the moment, my computer doesn't seem to acting abnormally, so far I haven't seen any popups since the initial scan. I guess this is a good sign? Here are the two logs.

HJT

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:27:47 AM, on 1/12/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Microsoft Windows OneCare Live\Antivirus\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton Internet Security\ISSVC.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Microsoft Windows OneCare Live\Firewall\msfwsvc.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\Program Files\Microsoft Windows OneCare Live\winss.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…o&pf=laptop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…o&pf=laptop
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: TextAloud - {F053C368-5458-45B2-9B4D-D8914BDDDBFF} - C:\PROGRA~1\TEXTAL~1\TAForIE.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [OneCareUI] "C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [0caf330e] rundll32.exe "C:\WINDOWS\system32\wycgsasr.dll",b
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe -quiet
O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'Default user')
O4 - Startup: hamachi.lnk = C:\Program Files\Hamachi\hamachi.exe
O4 - Global Startup: BTTray.lnk = ?
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Customer\Start Menu\Programs\IMVU\Run IMVU.lnk
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q305&bd=presario&pf=laptop
O15 - Trusted Zone: *.amaena.com
O15 - Trusted Zone: *.doginhispen.com
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-GB/a-UNO1/GAME_UNO1.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/…lscbase4009.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo…otoUploader.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab31267.cab
O16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.5 Control) - http://filelodge.com/ImageUploader3.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab57176.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs:
O22 - SharedTaskScheduler: grassily - {4233ac08-a2c4-4742-a0b4-83719613d62c} - (no file)
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

–
End of file - 11217 bytes

CF

ComboFix 08-01-11.3 - Customer 2008-01-12 11:11:06.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.364 [GMT -5:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Customer\Desktop\CFScript.txt
* Created a new restore point

FILE
C:\Documents and Settings\London\Desktop\owl\pwinmrag.exe
C:\Program Files\Kronia jdsngfids.exe
C:\Program Files\Toolbar888
C:\windows\newname7.exe
C:\WINDOWS\njcclnc.exe
C:\WINDOWS\system32\bvlpgj.exe
C:\WINDOWS\system32\jgxfogfu.dll
C:\WINDOWS\system32\vtstq.dll
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\Google\Google Desktop Search
C:\Program Files\Google\Google Desktop Search\aa ### WARNING - Do not
C:\Program Files\Google\Google Desktop Search\ab ### move or delete these
C:\Program Files\Google\Google Desktop Search\ac ### files - your system
C:\Program Files\Google\Google Desktop Search\ad ### may stop working
C:\Program Files\Google\Google Desktop Search\ae ###
C:\Program Files\Google\Google Desktop Search\af ### To uninstall use
C:\Program Files\Google\Google Desktop Search\ag ### Add-Remove programs
C:\Program Files\Google\Google Desktop Search\ah ### in the control panel
C:\Program Files\Google\Google Desktop Search\ai ### or run
C:\Program Files\Google\Google Desktop Search\aj ###
C:\Program Files\Google\Google Desktop Search\ak ### GoogleDesktopSearchSetup.exe -uninstall
C:\Program Files\Google\Google Desktop Search\al ###
C:\Program Files\Google\Google Desktop Search\docs\privacy.html
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopAPI2.dll
C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopDeskbar2.dll
C:\Program Files\Google\Google Desktop Search\GoogleDesktopDisplay.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopEncdet.dat
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIE.dll
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopMozilla.dll
C:\Program Files\Google\Google Desktop Search\GoogleDesktopMozillaStub.js
C:\Program Files\Google\Google Desktop Search\GoogleDesktopMozillaStub.xpt
C:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork1.dll
C:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork2.dll
C:\Program Files\Google\Google Desktop Search\GoogleDesktopOE.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopOffice.dll
C:\Program Files\Google\Google Desktop Search\GoogleDesktopResources_en.dll
C:\Program Files\Google\Google Desktop Search\GoogleDesktopSearchSetup.exe
C:\Program Files\Google\Google Desktop Search\gzlib.dll
C:\Program Files\Google\Google Desktop Search\pdftohtml.exe
C:\Program Files\Google\Google Desktop Search\uninstall.ico
C:\Program Files\Kronia jdsngfids.exe
C:\Program Files\Toolbar888
C:\Program Files\Toolbar888\
C:\WINDOWS\njcclnc.exe

.
((((((((((((((((((((((((( Files Created from 2007-12-12 to 2008-01-12 )))))))))))))))))))))))))))))))
.

2008-01-11 22:41 . 2000-08-31 08:00 51,200 –a—— C:\WINDOWS\NirCmd.exe
2008-01-11 22:23 . 2008-01-11 22:23 d——– C:\VundoFix Backups
2007-12-23 15:22 . 2007-12-23 15:22 d——– C:\Program Files\Lavasoft
2007-12-23 15:22 . 2007-12-23 15:22 d——– C:\Documents and Settings\All Users\Application Data\Lavasoft
2007-12-22 13:41 . 2007-12-22 13:41 d——– C:\Program Files\Iarsn
2007-12-22 13:41 . 2006-10-24 16:29 17,928 –a—— C:\WINDOWS\system32\drivers\Tsknf700.sys
2007-12-21 10:46 . 2007-12-21 10:46 0 –a—— C:\WINDOWS\nsreg.dat

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-12 16:22 ——— d—–w C:\Program Files\Google
2008-01-12 05:12 ——— d—–w C:\Program Files\mIRC
2008-01-12 04:10 ——— d—–w C:\Documents and Settings\Customer\Application Data\Hamachi
2008-01-12 03:32 ——— d—–w C:\Program Files\Microsoft Windows OneCare Live
2008-01-12 03:08 ——— d—–w C:\Program Files\Common Files\Symantec Shared
2007-12-23 20:21 ——— d—–w C:\Program Files\Common Files\Wise Installation Wizard
2007-12-15 02:54 ——— d—–w C:\Program Files\ArtMoney
2007-12-12 21:35 ——— d—–w C:\Program Files\TextAloud
2007-12-10 04:15 ——— d—–w C:\Program Files\Morpheus Toolbar
2007-12-04 14:56 93,264 —-a-w C:\WINDOWS\system32\drivers\aswmon.sys
2007-12-04 14:55 94,544 —-a-w C:\WINDOWS\system32\drivers\aswmon2.sys
2007-12-04 14:53 23,152 —-a-w C:\WINDOWS\system32\drivers\aswRdr.sys
2007-12-04 14:51 42,912 —-a-w C:\WINDOWS\system32\drivers\aswTdi.sys
2007-12-04 14:49 26,624 —-a-w C:\WINDOWS\system32\drivers\aavmker4.sys
2007-12-04 13:04 837,496 —-a-w C:\WINDOWS\system32\aswBoot.exe
2007-12-04 12:54 95,608 —-a-w C:\WINDOWS\system32\AvastSS.scr
2007-12-01 22:57 ——— d—–w C:\Program Files\StepMania
2007-11-27 22:10 ——— d—–w C:\Program Files\Winamp
2007-11-26 03:52 ——— d—–w C:\Program Files\Windows Defender
2007-11-17 00:55 ——— d—–w C:\Program Files\Morpheus
2007-11-14 07:26 450,560 ——w C:\WINDOWS\system32\dllcache\jscript.dll
2007-11-13 20:35 ——— d—–w C:\Program Files\Alwil Software
2007-11-13 19:37 ——— d—–w C:\Program Files\MSN Messenger
2007-11-13 10:25 20,480 —-a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-11-07 09:26 721,920 —-a-w C:\WINDOWS\system32\lsasrv.dll
2007-11-07 09:26 721,920 ——w C:\WINDOWS\system32\dllcache\lsasrv.dll
2007-10-30 17:20 360,064 ——w C:\WINDOWS\system32\dllcache\tcpip.sys
2007-10-30 10:16 3,058,688 ——w C:\WINDOWS\system32\dllcache\mshtml.dll
2007-10-29 22:43 1,287,680 —-a-w C:\WINDOWS\system32\quartz.dll
2007-10-29 22:43 1,287,680 ——w C:\WINDOWS\system32\dllcache\quartz.dll
2007-10-27 22:40 222,720 —-a-w C:\WINDOWS\system32\wmasf.dll
2007-10-27 22:40 222,720 —-a-w C:\WINDOWS\system32\dllcache\wmasf.dll
2007-10-26 03:36 8,454,656 ——w C:\WINDOWS\system32\dllcache\shell32.dll
2007-01-18 18:09 85,120 —-a-w C:\Documents and Settings\Customer\Application Data\GDIPFONTCACHEV1.DAT
2006-12-04 23:13 6,365,144 —-a-w C:\Program Files\Bradyok Software.zip
2006-10-03 21:48 307,200 —-a-w C:\Program Files\Uninstall My Web Search.dll
2006-04-21 03:44 32 —-a-r C:\Documents and Settings\All Users\hash.dat
2005-12-08 02:32 79 —-a-w C:\Documents and Settings\London\Play RTB.bat
2005-10-04 23:07 169 —-a-w C:\Documents and Settings\London\Unlocks.DAT
2005-08-05 02:40 96 —-a-w C:\Documents and Settings\London\RTB - dedicated.bat
.

((((((((((((((((((((((((((((( snapshot@2008-01-11_23.19.54.00 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-01-12 03:43:46 729,088 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000001\NTUSER.DAT
+ 2008-01-12 16:10:57 729,088 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000001\NTUSER.DAT
- 2008-01-12 03:43:46 8,192 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000002\UsrClass.dat
+ 2008-01-12 16:10:57 8,192 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000002\UsrClass.dat
- 2008-01-12 03:43:46 729,088 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000003\NTUSER.DAT
+ 2008-01-12 16:10:57 729,088 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000003\NTUSER.DAT
- 2008-01-12 03:43:46 8,192 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000004\UsrClass.dat
+ 2008-01-12 16:10:57 8,192 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000004\UsrClass.dat
- 2008-01-12 03:43:48 7,213,056 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000005\NTUSER.DAT
+ 2008-01-12 16:10:58 7,077,888 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000005\NTUSER.DAT
- 2008-01-12 03:43:48 40,960 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000006\UsrClass.dat
+ 2008-01-12 16:10:58 40,960 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000006\UsrClass.dat
.
((((((((((((((((((((((((((((((((((((((((((((( AWF ))))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
—-a-w 2,664,448 2007-04-28 20:15:12 C:\Documents and Settings\All Users\Application Data\Skype\Plugins\Plugins\1163D2B46CC742E5A3CC9E4157887751\bak\TalkAndWrite.exe

—-a-w 81,920 2004-07-27 23:50:18 C:\Program Files\Common Files\InstallShield\UpdateService\bak\issch.exe

—-a-w 221,184 2004-07-27 23:50:42 C:\Program Files\Common Files\InstallShield\UpdateService\bak\ISUSPM.exe

—-a-w 90,112 2002-09-20 20:16:30 C:\Program Files\Common Files\Logitech\QCDriver2\bak\LVCOMS.EXE

—-a-w 180,269 2006-05-07 19:40:30 C:\Program Files\Common Files\Real\Update_OB\bak\realsched.exe

—-a-w 58,992 2005-03-23 19:34:32 C:\Program Files\Common Files\Symantec Shared\bak\ccApp.exe

—-a-w 3,739,648 2007-01-01 21:22:02 C:\Program Files\Google\Google Talk\bak\googletalk.exe

—-a-w 49,152 2005-02-17 06:11:42 C:\Program Files\Hp\HP Software Update\bak\HPWuSchd2.exe

—-a-w 256,576 2006-10-30 14:36:36 C:\Program Files\iTunes\bak\iTunesHelper.exe

—-a-w 36,975 2005-06-03 07:52:54 C:\Program Files\Java\jre1.5.0_04\bin\bak\jusched.exe

—-a-w 67,128 2007-03-30 02:10:23 C:\Program Files\Logitech\Desktop Messenger\8876480\Program\bak\LogitechDesktopMessenger.exe

—-a-w 155,648 2002-09-11 17:58:06 C:\Program Files\Logitech\ImageStudio\bak\ISStart.exe

—-a-w 45,056 2002-09-11 17:57:28 C:\Program Files\Logitech\ImageStudio\bak\LogiTray.exe

—-a-w 1,694,208 2004-10-13 16:24:37 C:\Program Files\Messenger\bak\msmsgs.exe

—-a-w 4,898,816 2007-01-12 01:45:10 C:\Program Files\MySpace\IM\bak\MySpaceIM.exe

—-a-w 282,624 2006-10-25 23:58:18 C:\Program Files\QuickTime\bak\qttask.exe

—-a-w 49,152 2003-05-08 16:00:58 C:\Program Files\ScanSoft\OmniPageSE2.0\bak\OpwareSE2.exe

—-a-w 692,316 2005-02-02 12:11:12 C:\Program Files\Synaptics\SynTP\bak\SynTPEnh.exe

—-a-w 102,492 2005-02-02 12:12:22 C:\Program Files\Synaptics\SynTP\bak\SynTPLpr.exe

—-a-w 15,872 2006-09-07 17:19:27 C:\Program Files\Unlocker\bak\UnlockerAssistant.exe

—-a-w 866,584 2006-11-03 22:20:12 C:\Program Files\Windows Defender\bak\MSASCui.exe

—-a-w 208,952 2004-08-04 13:00:00 C:\WINDOWS\ime\imjp8_1\bak\IMJPMIG.EXE
—-a-w 208,952 2004-08-04 13:00:00 C:\WINDOWS\ime\imjp8_1\imjpmig.exe

—-a-w 44,032 2004-08-04 13:00:00 C:\WINDOWS\ime\imkr6_1\bak\IMEKRMIG.EXE
—-a-w 44,032 2004-08-04 13:00:00 C:\WINDOWS\ime\imkr6_1\imekrmig.exe

—-a-w 15,360 2004-08-04 08:00:00 C:\WINDOWS\system32\bak\ctfmon.exe
—-a-w 15,360 2004-08-04 13:00:00 C:\WINDOWS\system32\ctfmon.exe

—-a-w 17,474,680 2007-09-06 02:50:42 C:\WINDOWS\system32\bak\MRT.exe
—-a-w 17,642,616 2008-01-02 18:21:36 C:\WINDOWS\system32\MRT.exe

—-a-w 342,016 2004-08-04 08:00:00 C:\WINDOWS\system32\bak\regscan.exe

—-a-w 59,392 2004-08-04 13:00:00 C:\WINDOWS\system32\IME\PINTLGNT\bak\ImScInst.exe
—-a-w 59,392 2004-08-04 13:00:00 C:\WINDOWS\system32\IME\PINTLGNT\imscinst.exe

.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 08:00 15360]
"msnmsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 11:54 5674352]
"Yahoo! Pager"="C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-04 08:00 208952]
"IMEKRMIG6.1"="C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE" [2004-08-04 08:00 44032]
"MSPY2002"="C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-04 08:00 59392]
"OneCareUI"="C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe" [2007-10-01 08:53 66600]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [ ]
"0caf330e"="C:\WINDOWS\system32\wycgsasr.dll" [ ]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 08:00 79224]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 08:00 15360]
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 15:38 39264]

C:\Documents and Settings\Customer\Start Menu\Programs\Startup\
hamachi.lnk - C:\Program Files\Hamachi\hamachi.exe [2007-10-30 19:42:11]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\OneCareMP]
@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^sdxqm.exe]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\sdxqm.exe
backup=C:\WINDOWS\pss\sdxqm.exeCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^London^Start Menu^Programs^Startup^Zeno.lnk]
path=C:\Documents and Settings\London\Start Menu\Programs\Startup\Zeno.lnk
backup=C:\WINDOWS\pss\Zeno.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^London^Start Menu^Programs^Startup^Z_Start.lnk]
path=C:\Documents and Settings\London\Start Menu\Programs\Startup\Z_Start.lnk
backup=C:\WINDOWS\pss\Z_Start.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\anphgh]
C:\WINDOWS\system32\bvlpgj.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
–a—— 2005-04-11 12:00 339968 C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BrowserUpdateSched]
C:\Documents and Settings\London\Desktop\owl\pwinmrag.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Cpqset]
–a—— 2005-02-17 16:01 233534 C:\Program Files\HPQ\Default Settings\cpqset.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eabconfg.cpl]
–a—— 2004-12-03 15:24 290816 C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpWirelessAssistant]
–a—— 2005-04-01 17:11 794624 C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LDM]
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LSBWatcher]
–a—— 2004-10-14 15:54 253952 c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\newname]
C:\windows\newname7.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002A]
–a—— 2004-08-04 08:00 455168 C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync]
–a—— 2004-08-04 08:00 455168 C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray]
–a—— 2006-05-07 14:40 208941 C:\Program Files\Real\RealPlayer\RealPlay.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\services32]
C:\Program Files\Common Files\Windows\mc-110-12-0000140.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
–a—— 2004-12-20 13:41 33792 C:\Program Files\Winamp\winampa.exe

R1 TSKNF700.SYS;TSKNF700.SYS;C:\WINDOWS\system32\Drivers\TSKNF700.SYS [2006-10-24 16:29]
R3 HSFHWATI;HSFHWATI;C:\WINDOWS\system32\DRIVERS\HSFHWATI.sys [2004-12-15 10:18]
S3 PhilCam8116;Logitech QuickCam Pro 3000(PID_08B0);C:\WINDOWS\system32\DRIVERS\CamDrL21.sys [2002-06-10 14:16]
S3 USBDongle;USBDongle;C:\WINDOWS\system32\DRIVERS\USBKey.sys [2004-01-30 08:31]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{79ac897e-4e89-11da-b554-00c09fa80eb0}]
\Shell\AutoRun\command - E:\setupSNK.exe

.
Contents of the 'Scheduled Tasks' folder
"2008-01-09 23:19:02 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2007-12-22 01:00:00 C:\WINDOWS\Tasks\Norton AntiVirus - Scan my computer - London.job"
- C:\PROGRA~1\NORTON~1\NORTON~1\NAVW32.EXEh/task:
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-12 11:22:58
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-12 11:24:48
ComboFix-quarantined-files.txt 2008-01-12 16:24:39
ComboFix2.txt 2008-01-12 04:20:46
.
2008-01-12 03:06:17 — E O F —
Post #5
Right click on this link DelO15Domains.inf
http://www.mvps.org/winhelp2002/DelDomains.inf and choose Save As. Save it to your desktop. Right click on that file and choose Install. It will run immediately (you won't be able to see anything happen). You may delete it afterwards. NOTE: This script will delete any sites you may have added to the Trusted Sites. So if you want them back, you have to add them back to the Trusted Sites again.

Next:

Please click HERE select Save. Save FindAWF to your desktop.

Double Click FindAWF.exe and let it run, it will create the file awf.txt on your desktop when finished.

Open awf.txt in notepad, select Edit> Select All> Edit> Copy> and Paste the contents.
Post #6
Here is the AWF Scan. By the way, while it was scanning, two things appeared by it on the Desktop. I forgot what they were called, but I assume that they were part of the AWF Scan. Just out of curiosity, what were those? AWF Report. Find AWF report by noahdfear ©2006 Version 1.40 The current date is: Sat 01/12/2008 The current time is: 11:42:16.12 bak folders found ~~~~~~~~~~~ Directory of C:\PROGRA~1\ITUNES\BAK 10/30/2006 09:36 AM 256,576 iTunesHelper.exe 1 File(s) 256,576 bytes Directory of C:\PROGRA~1\MESSEN~1\BAK 10/13/2004 11:24 AM 1,694,208 msmsgs.exe 1 File(s) 1,694,208 bytes Directory of C:\PROGRA~1\MSNMES~1\BAK 0 File(s) 0 bytes Directory of C:\PROGRA~1\QUICKT~1\BAK 10/25/2006 06:58 PM 282,624 qttask.exe 1 File(s) 282,624 bytes Directory of C:\PROGRA~1\UNLOCKER\BAK 09/07/2006 12:19 PM 15,872 UnlockerAssistant.exe 1 File(s) 15,872 bytes Directory of C:\PROGRA~1\WIFD1F~1\BAK 11/03/2006 05:20 PM 866,584 MSASCui.exe 1 File(s) 866,584 bytes Directory of C:\WINDOWS\SYSTEM32\BAK 08/04/2004 03:00 AM 15,360 ctfmon.exe 09/05/2007 09:50 PM 17,474,680 MRT.exe 08/04/2004 03:00 AM 342,016 regscan.exe 3 File(s) 17,832,056 bytes Directory of C:\PROGRA~1\COMMON~1\SYMANT~1\BAK 03/23/2005 02:34 PM 58,992 ccApp.exe 1 File(s) 58,992 bytes Directory of C:\PROGRA~1\GOOGLE\GOOGLE~4\BAK 01/01/2007 04:22 PM 3,739,648 googletalk.exe 1 File(s) 3,739,648 bytes Directory of C:\PROGRA~1\HP\HPSOFT~1\BAK 02/17/2005 01:11 AM 49,152 HPWuSchd2.exe 1 File(s) 49,152 bytes Directory of C:\PROGRA~1\LOGITECH\IMAGES~1\BAK 09/11/2002 12:58 PM 155,648 ISStart.exe 09/11/2002 12:57 PM 45,056 LogiTray.exe 2 File(s) 200,704 bytes Directory of C:\PROGRA~1\MYSPACE\IM\BAK 01/11/2007 08:45 PM 4,898,816 MySpaceIM.exe 1 File(s) 4,898,816 bytes Directory of C:\PROGRA~1\SCANSOFT\OMNIPA~1.0\BAK 05/08/2003 11:00 AM 49,152 OpwareSE2.exe 1 File(s) 49,152 bytes Directory of C:\PROGRA~1\SYNAPT~1\SYNTP\BAK 02/02/2005 07:11 AM 692,316 SynTPEnh.exe 02/02/2005 07:12 AM 102,492 SynTPLpr.exe 2 File(s) 794,808 bytes Directory of C:\PROGRA~1\YAHOO!\MESSEN~1\BAK 0 File(s) 0 bytes Directory of C:\WINDOWS\IME\IMJP8_1\BAK 08/04/2004 08:00 AM 208,952 IMJPMIG.EXE 1 File(s) 208,952 bytes Directory of C:\WINDOWS\IME\IMKR6_1\BAK 08/04/2004 08:00 AM 44,032 IMEKRMIG.EXE 1 File(s) 44,032 bytes Directory of C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\BAK 07/27/2004 06:50 PM 81,920 issch.exe 07/27/2004 06:50 PM 221,184 ISUSPM.exe 2 File(s) 303,104 bytes Directory of C:\PROGRA~1\COMMON~1\LOGITECH\QCDRIV~1\BAK 09/20/2002 03:16 PM 90,112 LVCOMS.EXE 1 File(s) 90,112 bytes Directory of C:\PROGRA~1\COMMON~1\REAL\UPDATE~1\BAK 05/07/2006 02:40 PM 180,269 realsched.exe 1 File(s) 180,269 bytes Directory of C:\PROGRA~1\JAVA\JRE15~2.0_0\BIN\BAK 06/03/2005 02:52 AM 36,975 jusched.exe 1 File(s) 36,975 bytes Directory of C:\WINDOWS\SYSTEM32\IME\PINTLGNT\BAK 08/04/2004 08:00 AM 59,392 ImScInst.exe 1 File(s) 59,392 bytes Directory of C:\PROGRA~1\LOGITECH\DESKTO~1\8876480\PROGRAM\BAK 03/29/2007 09:10 PM 67,128 LogitechDesktopMessenger.exe 1 File(s) 67,128 bytes Directory of C:\DOCUME~1\ALLUSE~1\APPLIC~1\SKYPE\PLUGINS\PLUGINS\1163D2~1\BAK 04/28/2007 03:15 PM 2,664,448 TalkAndWrite.exe 1 File(s) 2,664,448 bytes Duplicate files of bak directory contents ~~~~~~~~~~~~~~~~~~~~~~~ 256576 Oct 30 2006 "C:\Program Files\iTunes\bak\iTunesHelper.exe" 102400 Jan 10 2007 "C:\WINDOWS\Installer\{446DBFFA-4088-48E3-8932-74316BA4CAE4}\iTunesIco.exe" 108096 Oct 30 2006 "C:\Documents and Settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 7.0.2.16\iTunesSetupAdmin.exe" 1667584 Aug 3 2004 "C:\WINDOWS\$NtUninstallKB887472$\msmsgs.exe" 1694208 Oct 13 2004 "C:\Program Files\Messenger\bak\msmsgs.exe" 1694208 Oct 13 2004 "C:\WINDOWS\$hf_mig$\KB887472\SP2QFE\msmsgs.exe" 282624 Oct 25 2006 "C:\Program Files\QuickTime\bak\qttask.exe" 195645 Jul 8 2007 "C:\Documents and Settings\Customer\My Documents\unlocker1.8.5.exe" 15872 Sep 7 2006 "C:\Program Files\Unlocker\bak\UnlockerAssistant.exe" 866584 Nov 3 2006 "C:\Program Files\Windows Defender\bak\MSASCui.exe" 15360 Aug 4 2004 "C:\WINDOWS\system32\ctfmon.exe" 15360 Aug 4 2004 "C:\WINDOWS\system32\bak\ctfmon.exe" 17642616 Jan 2 2008 "C:\WINDOWS\system32\MRT.exe" 17474680 Sep 5 2007 "C:\WINDOWS\system32\bak\MRT.exe" 342016 Aug 4 2004 "C:\WINDOWS\system32\bak\regscan.exe" 58992 Mar 23 2005 "C:\Program Files\Common Files\Symantec Shared\bak\ccApp.exe" 58488 Aug 28 2004 "C:\SWSetup\SYMIS\US\Support\ccCommon\ccCommon\ccApp.exe" 1581768 Nov 25 2006 "C:\Documents and Settings\Customer\My Documents\googletalk-setup.exe" 4983528 Sep 5 2006 "C:\Documents and Settings\London\My Documents\GoogleVideoPlayerSetup.exe" 462916 Oct 18 2005 "C:\Program Files\Google\Google Earth\GoogleEarth.exe" 4927488 Jul 10 2006 "C:\Program Files\Google\Google Video Player\GoogleVideoPlayer.exe" 559784 May 7 2006 "C:\Program Files\Common Files\Real\GToolbar\GoogleToolbarInstaller.exe" 3739648 Jan 1 2007 "C:\Program Files\Google\Google Talk\bak\googletalk.exe" 1606064 Jan 5 2007 "C:\Program Files\Google\Google Talk\googletalk-1.0.0.104\googletalk-setup-upgrade.exe" 49152 Feb 17 2005 "C:\Program Files\Hp\HP Software Update\bak\HPWuSchd2.exe" 155648 Sep 11 2002 "C:\Program Files\Logitech\ImageStudio\bak\ISStart.exe" 45056 Sep 11 2002 "C:\Program Files\Logitech\ImageStudio\bak\LogiTray.exe" 67480 Feb 9 2007 "C:\Documents and Settings\Customer\My Documents\myspaceim.exe" 67480 Feb 4 2007 "C:\Documents and Settings\London\My Documents\MySpaceIM_Setup.exe" 4898816 Jan 11 2007 "C:\Program Files\MySpace\IM\bak\MySpaceIM.exe" 4898816 Jan 11 2007 "C:\Program Files\MySpace\IM\temp\MySpaceIM.exe" 49152 May 8 2003 "C:\Program Files\ScanSoft\OmniPageSE2.0\bak\OpwareSE2.exe" 692316 Feb 2 2005 "C:\SWSetup\Touchpad\SynTPEnh.exe" 692316 Feb 2 2005 "C:\Program Files\Synaptics\SynTP\bak\SynTPEnh.exe" 692316 Feb 2 2005 "C:\Program Files\Synaptics\SynTP\Media\SynTPEnh.exe" 102492 Feb 2 2005 "C:\SWSetup\Touchpad\SynTPLpr.exe" 102492 Feb 2 2005 "C:\Program Files\Synaptics\SynTP\bak\SynTPLpr.exe" 102492 Feb 2 2005 "C:\Program Files\Synaptics\SynTP\Media\SynTPLpr.exe" 208952 Aug 4 2004 "C:\WINDOWS\ime\imjp8_1\imjpmig.exe" 208952 Aug 4 2004 "C:\WINDOWS\ime\imjp8_1\bak\IMJPMIG.EXE" 44032 Aug 4 2004 "C:\WINDOWS\ime\imkr6_1\imekrmig.exe" 44032 Aug 4 2004 "C:\WINDOWS\ime\imkr6_1\bak\IMEKRMIG.EXE" 81920 Jul 27 2004 "C:\Program Files\Common Files\InstallShield\UpdateService\bak\issch.exe" 221184 Jul 27 2004 "C:\Program Files\Common Files\InstallShield\UpdateService\bak\ISUSPM.exe" 102400 Jun 10 2002 "C:\WINDOWS\system32\LVComS.exe" 102400 Jun 10 2002 "C:\Program Files\Common Files\Logitech\QCDriver\LVComS.exe" 90112 Sep 20 2002 "C:\Program Files\Common Files\Logitech\QCDriver2\bak\LVCOMS.EXE" 180269 May 7 2006 "C:\Program Files\Common Files\Real\Update_OB\bak\realsched.exe" 36975 Mar 4 2005 "C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe" 36975 Jun 3 2005 "C:\Program Files\Java\jre1.5.0_04\bin\bak\jusched.exe" 59392 Aug 4 2004 "C:\WINDOWS\system32\IME\PINTLGNT\imscinst.exe" 59392 Aug 4 2004 "C:\WINDOWS\system32\IME\PINTLGNT\bak\ImScInst.exe" 67128 Mar 29 2007 "C:\Program Files\Logitech\Desktop Messenger\8876480\Program\bak\LogitechDesktopMessenger.exe" 2664448 Apr 28 2007 "C:\Documents and Settings\All Users\Application Data\Skype\Plugins\Plugins\1163D2B46CC742E5A3CC9E4157887751\bak\TalkAndWrite.exe" end of report
Post #7
I assume they were created by AWF.
This will take another 2 fixes at least.

Double-click FindAWF.exe to start the tool. Then, do the following
Select "option #2 - Restore files from bak folders" by typing 2 and press Enter .
A text file will open up. Please copy/paste the following text from the quote box (all except the word QUOTE) into the text file.

"C:\Program Files\iTunes\bak\iTunesHelper.exe"
"C:\Program Files\Messenger\bak\msmsgs.exe"
"C:\Program Files\QuickTime\bak\qttask.exe"
"C:\Program Files\Windows Defender\bak\MSASCui.exe"
"C:\WINDOWS\system32\bak\ctfmon.exe"
"C:\WINDOWS\system32\bak\MRT.exe"
"C:\WINDOWS\system32\bak\regscan.exe"
"C:\Program Files\Common Files\Symantec Shared\bak\ccApp.exe"
"C:\Program Files\Google\Google Talk\bak\googletalk.exe"
"C:\Program Files\Hp\HP Software Update\bak\HPWuSchd2.exe"
"C:\Program Files\Logitech\ImageStudio\bak\ISStart.exe"
"C:\Program Files\Logitech\ImageStudio\bak\LogiTray.exe"
"C:\Program Files\MySpace\IM\bak\MySpaceIM.exe"
"C:\Program Files\ScanSoft\OmniPageSE2.0\bak\OpwareSE2.exe"
"C:\Program Files\Synaptics\SynTP\bak\SynTPEnh.exe"
"C:\WINDOWS\ime\imjp8_1\bak\IMJPMIG.EXE"
"C:\WINDOWS\ime\imkr6_1\bak\IMEKRMIG.EXE"
"C:\Program Files\Common Files\InstallShield\UpdateService\bak\issch.exe"
"C:\Program Files\Common Files\Logitech\QCDriver2\bak\LVCOMS.EXE"
"C:\Program Files\Common Files\Real\Update_OB\bak\realsched.exe"
"C:\Program Files\Java\jre1.5.0_04\bin\bak\jusched.exe"
"C:\WINDOWS\system32\IME\PINTLGNT\bak\ImScInst.exe"
"C:\Program Files\Logitech\Desktop Messenger\8876480\Program\bak\LogitechDesktopMessenger.exe"
"C:\Documents and Settings\All Users\Application Data\Skype\Plugins\Plugins\1163D2B46CC742E5A3CC9E4157887751\bak\TalkAndWrite.exe"


Close the .txt file and click Yes to save the changes.
When the tool has completed, a report will open up in notepad. Please post the results of the awf.txt in your next reply as an attachment.

==================================================================
Post #10
Oh. Sure thing. Sorry about that. AWF Find AWF report by noahdfear ©2006 Version 1.40 Option 2 run successfully The current date is: Sat 01/12/2008 The current time is: 12:32:17.03 bak folders found ~~~~~~~~~~~ Directory of C:\PROGRA~1\ITUNES\BAK 10/30/2006 09:36 AM 256,576 iTunesHelper.exe 1 File(s) 256,576 bytes Directory of C:\PROGRA~1\MESSEN~1\BAK 10/13/2004 11:24 AM 1,694,208 msmsgs.exe 1 File(s) 1,694,208 bytes Directory of C:\PROGRA~1\MSNMES~1\BAK 0 File(s) 0 bytes Directory of C:\PROGRA~1\QUICKT~1\BAK 10/25/2006 06:58 PM 282,624 qttask.exe 1 File(s) 282,624 bytes Directory of C:\PROGRA~1\UNLOCKER\BAK 09/07/2006 12:19 PM 15,872 UnlockerAssistant.exe 1 File(s) 15,872 bytes Directory of C:\PROGRA~1\WIFD1F~1\BAK 11/03/2006 05:20 PM 866,584 MSASCui.exe 1 File(s) 866,584 bytes Directory of C:\WINDOWS\SYSTEM32\BAK 08/04/2004 03:00 AM 15,360 ctfmon.exe 09/05/2007 09:50 PM 17,474,680 MRT.exe 08/04/2004 03:00 AM 342,016 regscan.exe 3 File(s) 17,832,056 bytes Directory of C:\PROGRA~1\COMMON~1\SYMANT~1\BAK 03/23/2005 02:34 PM 58,992 ccApp.exe 1 File(s) 58,992 bytes Directory of C:\PROGRA~1\GOOGLE\GOOGLE~4\BAK 01/01/2007 04:22 PM 3,739,648 googletalk.exe 1 File(s) 3,739,648 bytes Directory of C:\PROGRA~1\HP\HPSOFT~1\BAK 02/17/2005 01:11 AM 49,152 HPWuSchd2.exe 1 File(s) 49,152 bytes Directory of C:\PROGRA~1\LOGITECH\IMAGES~1\BAK 09/11/2002 12:58 PM 155,648 ISStart.exe 09/11/2002 12:57 PM 45,056 LogiTray.exe 2 File(s) 200,704 bytes Directory of C:\PROGRA~1\MYSPACE\IM\BAK 01/11/2007 08:45 PM 4,898,816 MySpaceIM.exe 1 File(s) 4,898,816 bytes Directory of C:\PROGRA~1\SCANSOFT\OMNIPA~1.0\BAK 05/08/2003 11:00 AM 49,152 OpwareSE2.exe 1 File(s) 49,152 bytes Directory of C:\PROGRA~1\SYNAPT~1\SYNTP\BAK 02/02/2005 07:11 AM 692,316 SynTPEnh.exe 02/02/2005 07:12 AM 102,492 SynTPLpr.exe 2 File(s) 794,808 bytes Directory of C:\PROGRA~1\YAHOO!\MESSEN~1\BAK 0 File(s) 0 bytes Directory of C:\WINDOWS\IME\IMJP8_1\BAK 08/04/2004 08:00 AM 208,952 IMJPMIG.EXE 1 File(s) 208,952 bytes Directory of C:\WINDOWS\IME\IMKR6_1\BAK 08/04/2004 08:00 AM 44,032 IMEKRMIG.EXE 1 File(s) 44,032 bytes Directory of C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\BAK 07/27/2004 06:50 PM 81,920 issch.exe 07/27/2004 06:50 PM 221,184 ISUSPM.exe 2 File(s) 303,104 bytes Directory of C:\PROGRA~1\COMMON~1\LOGITECH\QCDRIV~1\BAK 09/20/2002 03:16 PM 90,112 LVCOMS.EXE 1 File(s) 90,112 bytes Directory of C:\PROGRA~1\COMMON~1\REAL\UPDATE~1\BAK 05/07/2006 02:40 PM 180,269 realsched.exe 1 File(s) 180,269 bytes Directory of C:\PROGRA~1\JAVA\JRE15~2.0_0\BIN\BAK 06/03/2005 02:52 AM 36,975 jusched.exe 1 File(s) 36,975 bytes Directory of C:\WINDOWS\SYSTEM32\IME\PINTLGNT\BAK 08/04/2004 08:00 AM 59,392 ImScInst.exe 1 File(s) 59,392 bytes Directory of C:\PROGRA~1\LOGITECH\DESKTO~1\8876480\PROGRAM\BAK 03/29/2007 09:10 PM 67,128 LogitechDesktopMessenger.exe 1 File(s) 67,128 bytes Directory of C:\DOCUME~1\ALLUSE~1\APPLIC~1\SKYPE\PLUGINS\PLUGINS\1163D2~1\BAK 04/28/2007 03:15 PM 2,664,448 TalkAndWrite.exe 1 File(s) 2,664,448 bytes Duplicate files of bak directory contents ~~~~~~~~~~~~~~~~~~~~~~~ 256576 Oct 30 2006 "C:\Program Files\iTunes\iTunesHelper.exe" 256576 Oct 30 2006 "C:\Program Files\iTunes\bak\iTunesHelper.exe" 102400 Jan 10 2007 "C:\WINDOWS\Installer\{446DBFFA-4088-48E3-8932-74316BA4CAE4}\iTunesIco.exe" 108096 Oct 30 2006 "C:\Documents and Settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 7.0.2.16\iTunesSetupAdmin.exe" 1694208 Oct 13 2004 "C:\Program Files\Messenger\msmsgs.exe" 1667584 Aug 3 2004 "C:\WINDOWS\$NtUninstallKB887472$\msmsgs.exe" 1694208 Oct 13 2004 "C:\Program Files\Messenger\bak\msmsgs.exe" 1694208 Oct 13 2004 "C:\WINDOWS\$hf_mig$\KB887472\SP2QFE\msmsgs.exe" 282624 Oct 25 2006 "C:\Program Files\QuickTime\qttask.exe" 282624 Oct 25 2006 "C:\Program Files\QuickTime\bak\qttask.exe" 195645 Jul 8 2007 "C:\Documents and Settings\Customer\My Documents\unlocker1.8.5.exe" 15872 Sep 7 2006 "C:\Program Files\Unlocker\bak\UnlockerAssistant.exe" 866584 Nov 3 2006 "C:\Program Files\Windows Defender\MSASCui.exe" 866584 Nov 3 2006 "C:\Program Files\Windows Defender\bak\MSASCui.exe" 15360 Aug 4 2004 "C:\WINDOWS\system32\ctfmon.exe" 15360 Aug 4 2004 "C:\WINDOWS\system32\bak\ctfmon.exe" 17474680 Sep 5 2007 "C:\WINDOWS\system32\MRT.exe" 17474680 Sep 5 2007 "C:\WINDOWS\system32\bak\MRT.exe" 342016 Aug 4 2004 "C:\WINDOWS\system32\regscan.exe" 342016 Aug 4 2004 "C:\WINDOWS\system32\bak\regscan.exe" 58992 Mar 23 2005 "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" 58992 Mar 23 2005 "C:\Program Files\Common Files\Symantec Shared\bak\ccApp.exe" 58488 Aug 28 2004 "C:\SWSetup\SYMIS\US\Support\ccCommon\ccCommon\ccApp.exe" 1581768 Nov 25 2006 "C:\Documents and Settings\Customer\My Documents\googletalk-setup.exe" 4983528 Sep 5 2006 "C:\Documents and Settings\London\My Documents\GoogleVideoPlayerSetup.exe" 462916 Oct 18 2005 "C:\Program Files\Google\Google Earth\GoogleEarth.exe" 4927488 Jul 10 2006 "C:\Program Files\Google\Google Video Player\GoogleVideoPlayer.exe" 3739648 Jan 1 2007 "C:\Program Files\Google\Google Talk\googletalk.exe" 559784 May 7 2006 "C:\Program Files\Common Files\Real\GToolbar\GoogleToolbarInstaller.exe" 3739648 Jan 1 2007 "C:\Program Files\Google\Google Talk\bak\googletalk.exe" 1606064 Jan 5 2007 "C:\Program Files\Google\Google Talk\googletalk-1.0.0.104\googletalk-setup-upgrade.exe" 49152 Feb 17 2005 "C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe" 49152 Feb 17 2005 "C:\Program Files\Hp\HP Software Update\bak\HPWuSchd2.exe" 155648 Sep 11 2002 "C:\Program Files\Logitech\ImageStudio\ISStart.exe" 155648 Sep 11 2002 "C:\Program Files\Logitech\ImageStudio\bak\ISStart.exe" 45056 Sep 11 2002 "C:\Program Files\Logitech\ImageStudio\LogiTray.exe" 45056 Sep 11 2002 "C:\Program Files\Logitech\ImageStudio\bak\LogiTray.exe" 67480 Feb 9 2007 "C:\Documents and Settings\Customer\My Documents\myspaceim.exe" 67480 Feb 4 2007 "C:\Documents and Settings\London\My Documents\MySpaceIM_Setup.exe" 4898816 Jan 11 2007 "C:\Program Files\MySpace\IM\MySpaceIM.exe" 4898816 Jan 11 2007 "C:\Program Files\MySpace\IM\bak\MySpaceIM.exe" 4898816 Jan 11 2007 "C:\Program Files\MySpace\IM\temp\MySpaceIM.exe" 49152 May 8 2003 "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe" 49152 May 8 2003 "C:\Program Files\ScanSoft\OmniPageSE2.0\bak\OpwareSE2.exe" 692316 Feb 2 2005 "C:\SWSetup\Touchpad\SynTPEnh.exe" 692316 Feb 2 2005 "C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" 692316 Feb 2 2005 "C:\Program Files\Synaptics\SynTP\bak\SynTPEnh.exe" 692316 Feb 2 2005 "C:\Program Files\Synaptics\SynTP\Media\SynTPEnh.exe" 102492 Feb 2 2005 "C:\SWSetup\Touchpad\SynTPLpr.exe" 102492 Feb 2 2005 "C:\Program Files\Synaptics\SynTP\bak\SynTPLpr.exe" 102492 Feb 2 2005 "C:\Program Files\Synaptics\SynTP\Media\SynTPLpr.exe" 208952 Aug 4 2004 "C:\WINDOWS\ime\imjp8_1\IMJPMIG.EXE" 208952 Aug 4 2004 "C:\WINDOWS\ime\imjp8_1\bak\IMJPMIG.EXE" 44032 Aug 4 2004 "C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE" 44032 Aug 4 2004 "C:\WINDOWS\ime\imkr6_1\bak\IMEKRMIG.EXE" 81920 Jul 27 2004 "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" 81920 Jul 27 2004 "C:\Program Files\Common Files\InstallShield\UpdateService\bak\issch.exe" 221184 Jul 27 2004 "C:\Program Files\Common Files\InstallShield\UpdateService\bak\ISUSPM.exe" 102400 Jun 10 2002 "C:\WINDOWS\system32\LVComS.exe" 102400 Jun 10 2002 "C:\Program Files\Common Files\Logitech\QCDriver\LVComS.exe" 90112 Sep 20 2002 "C:\Program Files\Common Files\Logitech\QCDriver2\LVCOMS.EXE" 90112 Sep 20 2002 "C:\Program Files\Common Files\Logitech\QCDriver2\bak\LVCOMS.EXE" 180269 May 7 2006 "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" 180269 May 7 2006 "C:\Program Files\Common Files\Real\Update_OB\bak\realsched.exe" 36975 Mar 4 2005 "C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe" 36975 Jun 3 2005 "C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe" 36975 Jun 3 2005 "C:\Program Files\Java\jre1.5.0_04\bin\bak\jusched.exe" 59392 Aug 4 2004 "C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" 59392 Aug 4 2004 "C:\WINDOWS\system32\IME\PINTLGNT\bak\ImScInst.exe" 67128 Mar 29 2007 "C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe" 67128 Mar 29 2007 "C:\Program Files\Logitech\Desktop Messenger\8876480\Program\bak\LogitechDesktopMessenger.exe" 2664448 Apr 28 2007 "C:\Documents and Settings\All Users\Application Data\Skype\Plugins\Plugins\1163D2B46CC742E5A3CC9E4157887751\TalkAndWrite.exe" 2664448 Apr 28 2007 "C:\Documents and Settings\All Users\Application Data\Skype\Plugins\Plugins\1163D2B46CC742E5A3CC9E4157887751\bak\TalkAndWrite.exe" end of report
Post #11
Please double-click the FindAWF icon once again
This time we are going to remove some folders.


Use the following option: Press 3 then Enter to remove bak folders


A text file opens called: folders.txt
Click below the line and paste the following list of folders to be removed:

C:\Program Files\iTunes\bak
C:\Program Files\Messenger\bak
C:\Program Files\QuickTime\bak
C:\Program Files\Windows Defender\bak
C:\Program Files\Common Files\Symantec Shared\bak
C:\Program Files\Google\Google Talk\bak
C:\Program Files\Hp\HP Software Update\bak
C:\Program Files\Logitech\ImageStudio\bak
C:\Program Files\MySpace\IM\bak
C:\Program Files\ScanSoft\OmniPageSE2.0\bak
C:\Program Files\Synaptics\SynTP\bak
C:\WINDOWS\ime\imjp8_1\bak
C:\WINDOWS\ime\imkr6_1\bak
C:\Program Files\Common Files\InstallShield\UpdateService\bak
C:\Program Files\Common Files\Logitech\QCDriver2\bak
C:\Program Files\Common Files\Real\Update_OB\bak
C:\Program Files\Java\jre1.5.0_04\bin\bak
C:\WINDOWS\system32\IME\PINTLGNT\bak
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\bak
C:\Documents and Settings\All Users\Application Data\Skype\Plugins\Plugins\1163D2B46CC742E5A3CC9E4157887751\bak


Next, close and click Yes to save the changes.

When done with the above, FindAWF automatically runs a new scan and opens a new log that you need to post.
Please provide the new FindAWF log
Post #12
Scan of AWF Option 3. Find AWF report by noahdfear ©2006 Version 1.40 Option 3 run successfully The current date is: Sat 01/12/2008 The current time is: 13:01:52.35 bak folders found ~~~~~~~~~~~ Directory of C:\PROGRA~1\MSNMES~1\BAK 0 File(s) 0 bytes Directory of C:\PROGRA~1\UNLOCKER\BAK 09/07/2006 12:19 PM 15,872 UnlockerAssistant.exe 1 File(s) 15,872 bytes Directory of C:\WINDOWS\SYSTEM32\BAK 08/04/2004 03:00 AM 15,360 ctfmon.exe 09/05/2007 09:50 PM 17,474,680 MRT.exe 08/04/2004 03:00 AM 342,016 regscan.exe 3 File(s) 17,832,056 bytes Directory of C:\PROGRA~1\YAHOO!\MESSEN~1\BAK 0 File(s) 0 bytes Duplicate files of bak directory contents ~~~~~~~~~~~~~~~~~~~~~~~ 195645 Jul 8 2007 "C:\Documents and Settings\Customer\My Documents\unlocker1.8.5.exe" 15872 Sep 7 2006 "C:\Program Files\Unlocker\bak\UnlockerAssistant.exe" 15360 Aug 4 2004 "C:\WINDOWS\system32\ctfmon.exe" 15360 Aug 4 2004 "C:\WINDOWS\system32\bak\ctfmon.exe" 17474680 Sep 5 2007 "C:\WINDOWS\system32\MRT.exe" 17474680 Sep 5 2007 "C:\WINDOWS\system32\bak\MRT.exe" 342016 Aug 4 2004 "C:\WINDOWS\system32\regscan.exe" 342016 Aug 4 2004 "C:\WINDOWS\system32\bak\regscan.exe" end of report
Post #13
run find AWF & choose option 4 please and use this to paste in the fix

"C:\Program Files\Unlocker\bak\UnlockerAssistant.exe"
"C:\WINDOWS\system32\bak\ctfmon.exe"
"C:\WINDOWS\SYSTEM32\bak\ctfmon.exe"
"C:\WINDOWS\system32\bak\MRT.exe"
"C:\WINDOWS\system32\bak\regscan.exe"

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI