Spyware / Malware / Virus Removal

[Resolved] Help With A Dropper.DELF.MF virus

11 min read

Looking for the outcome? Ask AI

parlevoo Topic Starter

Post #1January 25, 2008, 2:23 PM UTC

hi, i noticed that my run button and shut down button were missing from the start menu, and task manager option was not available with Ctrl+Alt+Del. i could not run Regedit or Task Manager because it said it was "Disabled by your adminstrator. but i am the only computer user. here is my Sophos Scan (http://www.sophos.com/support/disinfection/delf.html) RESOLVE Version 1.07 Copyright © 2004, Sophos Plc, www.sophos.com System disinfection for Troj/Delf-ALI Data Version 1.01 System scan started at 01:02 on 26 January 2008 Checking for in memory Checking for files affected by Scanning C: Could not scan 16-{AD640FD0-AB7A-E373-C1CA-12F65B18E0F1}-v1-{6ADDD477-3A28-4D88-8B52-613BBB98BB7E}-v16-Downloaded.frx Could not scan 15-{AC73F347-FADA-4ADA-9A59-E2886C0139D9}-v51-{6ADDD477-3A28-4D88-8B52-613BBB98BB7E}-v15-Downloaded.frx Could not scan 13-{AC73F347-FADA-4ADA-9A59-E2886C0139D9}-v52-{6ADDD477-3A28-4D88-8B52-613BBB98BB7E}-v13-Downloaded.frx Could not scan 53-{AC73F347-FADA-4ADA-9A59-E2886C0139D9}-v53-{AC73F347-FADA-4ADA-9A59-E2886C0139D9}-v53-Downloaded.frx Could not scan 17-{5453E28E-6235-62EB-41AA-7C1896C5BA69}-v1-{6ADDD477-3A28-4D88-8B52-613BBB98BB7E}-v17-Downloaded.frx Could not scan 19-{EDD87393-7362-8961-F32B-86C8E03CF921}-v1-{6ADDD477-3A28-4D88-8B52-613BBB98BB7E}-v19-Downloaded.frx Could not scan 19-{8BFB8230-AE62-FCE0-5AAC-D871158D89CE}-v1-{6ADDD477-3A28-4D88-8B52-613BBB98BB7E}-v19-Downloaded.frx Could not scan 18-{051DE316-D6A5-2F02-6F6A-8BB0D9025044}-v1-{6ADDD477-3A28-4D88-8B52-613BBB98BB7E}-v18-Downloaded.frx Checking for registry keys affected by System scan finished at 01:06 on 26 January 2008 Processes found : 0 Processes terminated or disinfected : 0 Registry keys affected : 0 Registry keys changed : 0 Files found : 0 Files deleted : 0 cant get HiJack This to run as of yet, keep getting an error when i first run it: XMS Driver Not Running Will post one as soon as i get the program working Cheers, Jesse

parlevoo

Post #2January 25, 2008, 2:45 PM UTC

Hi Jack This Log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:42:40 AM, on 1/26/2008
Platform: Windows Vista SP1, v.668 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.17052)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\ASUS\ASUS Live Update\ALU.exe
C:\Program Files\ccxgui\ccx_gui.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Internet Explorer\IEXPLORE.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Free Download Manager\fdm.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\system32\Taskmgr.exe
C:\Windows\system32\SearchFilterHost.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.asus.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.asus.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.1.2.dll
O2 - BHO: URLLink Class - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E} - C:\Program Files\NewDotNet\newdotnet6_38.dll (file missing)
O2 - BHO: DealioBHO Class - {6A87B991-A31F-4130-AE72-6D0C294BF082} - C:\Program Files\Dealio\kb124\Dealio.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdm2.dll
O3 - Toolbar: Dealio - {E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F} - C:\Program Files\Dealio\kb124\Dealio.dll
O4 - HKLM\..\Run: [Windows Defender] -
O4 - HKLM\..\Run: [ATKMEDIA] -C:\Program Files\ASUS\ATK Media\DMEDIA.EXE
O4 - HKLM\..\Run: [SynTPEnh] -C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [NeroFilterCheck] -C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [GrooveMonitor] -"C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [IgfxTray] -C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] -C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] -C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [PCSuiteTrayApplication] -C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [SunJavaUpdateSched] -"C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] -"C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] -"C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Windows Mobile-based device management] -%SystemRoot%\system32\svchost.exe -k LocalSystemNetworkRestricted
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~1.DLL,NewDotNetStartup -s
O4 - HKLM\..\Run: [au] C:\Program Files\Dealio\DealioAU.exe
O4 - HKCU\..\Run: [Free Download Manager] -"C:\Program Files\Free Download Manager\fdm.exe" -autorun
O4 - HKCU\..\Run: [MsnMsgr] -"C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Tunebite] -C:\Program Files\RapidSolution\Tunebite\Tunebite.exe -tray
O4 - HKCU\..\Run: [WMPNSCFG] -C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: ccXgui.lnk = C:\Program Files\ccxgui\ccx_gui.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Compare Prices with &Dealio - C:\Users\Jesse Allomes\AppData\LocalLow\Dealio\kb124\res\DealioSearch.html
O8 - Extra context menu item: Download all with Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm
O8 - Extra context menu item: Download selected with Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Download video with Free Download Manager - file://C:\Program Files\Free Download Manager\dlfvideo.htm
O8 - Extra context menu item: Download with Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.1.2.dll/206 (file missing)
O9 - Extra button: Dealio - {E908B145-C847-4e85-B315-07E2E70DECF8} - C:\Program Files\Dealio\kb124\Dealio.dll
O9 - Extra 'Tools' menuitem: Dealio - {E908B145-C847-4e85-B315-07E2E70DECF8} - C:\Program Files\Dealio\kb124\Dealio.dll
O10 - Broken Internet access because of LSP provider 'c:\program files\newdotnet\newdotnet6_38.dll' missing
O13 - Gopher Prefix:
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O20 - Winlogon Notify: avgwlntf - C:\Windows\SYSTEM32\avgwlntf.dll
O23 - Service: Adobe LM Service - Unknown owner - -"C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe" (file missing)
O23 - Service: Apple Mobile Device - Unknown owner - -"C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe" (file missing)
O23 - Service: ASLDR Service (ASLDRService) - Unknown owner - -C:\Program Files\ATK Hotkey\ASLDRSrv.exe (file missing)
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG7 Resident Shield Service (AvgCoreSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Unknown owner - -"C:\Program Files\Bonjour\mDNSResponder.exe" (file missing)
O23 - Service: ccXgui - Unknown owner - -C:\Program Files\ccxgui\ccXservice.exe (file missing)
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - -"C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: FLEXnet Licensing Service - Unknown owner - -"C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe" (file missing)
O23 - Service: iPod Service - Unknown owner - -"C:\Program Files\iPod\bin\iPodService.exe" (file missing)
O23 - Service: Machine Debug Manager (MDM) - Unknown owner - -"C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe" (file missing)
O23 - Service: Microsoft Office Groove Audit Service - Unknown owner - -"C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe" (file missing)
O23 - Service: MSSQL$SONY_MEDIAMGR - Unknown owner - -C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe (file missing)
O23 - Service: MSSQLServerADHelper - Unknown owner - -C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqladhlp.exe (file missing)
O23 - Service: NBService - Unknown owner - -C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe (file missing)
O23 - Service: NNServ - New.net, Inc. - C:\Program Files\NewDotNet\nnrun.exe
O23 - Service: Microsoft Office Diagnostics Service (odserv) - Unknown owner - -"C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE" (file missing)
O23 - Service: Office Source Engine (ose) - Unknown owner - -"C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE" (file missing)
O23 - Service: ServiceLayer - Unknown owner - -"C:\Program Files\PC Connectivity Solution\ServiceLayer.exe" (file missing)
O23 - Service: spmgr - Unknown owner - -C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe (file missing)
O23 - Service: SQLAgent$SONY_MEDIAMGR - Unknown owner - -C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlagent.EXE (file missing)
O23 - Service: Syntek AVStream USB2.0 WebCam Service (StkSSrv) - Syntek America Inc. - C:\Windows\System32\StkCSrv.exe
O23 - Service: Messenger Sharing Folders USN Journal Reader service (usnjsvc) - Unknown owner - -"C:\Program Files\Windows Live\Messenger\usnsvc.exe" (file missing)
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - -"C:\Program Files\Windows Live\installer\WLSetupSvc.exe" (file missing)

–
End of file - 11725 bytes

Scotty

Post #3January 25, 2008, 4:25 PM UTC

Hi! Welcome to the WTT forums.
My name is Scotty. I would be glad to take a look at your log and help you with solving any malware problems. HijackThis logs can take a while to research.
Please be patient.

Please make a uninstall list using HijackThis
To access the Uninstall Manager you would do the following:

1. Start HijackThis
2. Click on the Config button
3. Click on the Misc Tools button
4. Click on the Open Uninstall Manager button.
5. Click on the Save list… button and specify where you would like to save this file. When you press Save button a notepad will open with the contents of that file. Simply copy and paste the contents of that notepad here in a reply.

parlevoo

Post #4January 25, 2008, 4:38 PM UTC

here you go V V V HiJack This Uninstall Log 2007 Microsoft Office Suite Service Pack 1 (SP1) 2007 Microsoft Office Suite Service Pack 1 (SP1) 2007 Microsoft Office Suite Service Pack 1 (SP1) 2007 Microsoft Office Suite Service Pack 1 (SP1) 2007 Microsoft Office Suite Service Pack 1 (SP1) 2007 Microsoft Office Suite Service Pack 1 (SP1) 2007 Microsoft Office Suite Service Pack 1 (SP1) 2007 Microsoft Office Suite Service Pack 1 (SP1) 2007 Microsoft Office Suite Service Pack 1 (SP1) 2007 Microsoft Office Suite Service Pack 1 (SP1) 2007 Microsoft Office Suite Service Pack 1 (SP1) 2007 Microsoft Office Suite Service Pack 1 (SP1) 2007 Microsoft Office Suite Service Pack 1 (SP1) 2007 Microsoft Office Suite Service Pack 1 (SP1) 2007 Microsoft Office Suite Service Pack 1 (SP1) 2007 Microsoft Office Suite Service Pack 1 (SP1) 2007 Microsoft Office Suite Service Pack 1 (SP1) Adobe Anchor Service CS3 Adobe Asset Services CS3 Adobe Bridge 1.0 Adobe Bridge CS3 Adobe Bridge Start Meeting Adobe Camera Raw 4.0 Adobe CMaps Adobe Color - Photoshop Specific Adobe Color Common Settings Adobe Color Common Settings Adobe Color EU Extra Settings Adobe Color JA Extra Settings Adobe Color NA Recommended Settings Adobe Common File Installer Adobe Default Language CS3 Adobe Device Central CS3 Adobe ExtendScript Toolkit 2 Adobe ExtendScript Toolkit 2 Adobe Fonts All Adobe Help Center 1.0 Adobe Help Viewer CS3 Adobe Linguistics CS3 Adobe PDF Library Files Adobe Photoshop CS2 Adobe Photoshop CS3 Adobe Photoshop CS3 Adobe Reader 7.0 Adobe Setup Adobe Setup Adobe Setup Adobe Stock Photos 1.0 Adobe Stock Photos CS3 Adobe Type Support Adobe Update Manager CS3 Adobe Version Cue CS3 Client Adobe WinSoft Linguistics Plugin Adobe XMP Panels CS3 Anapod CopyGear (remove only) Anapod Explorer (remove only) Apple Mobile Device Support Apple Software Update ASUS InstantFun ASUS Live Update ASUS Splendid Video Enhancement Technology ATK Hotkey ATK Media ATKOSD2 AVG 7.5 AVG Anti-Spyware 7.5 Bingo Cafe BitComet 0.98 Canon Camera Window DC_DV 6 for ZoomBrowser EX Canon Camera Window MC 6 for ZoomBrowser EX Canon G.726 WMP-Decoder Canon MovieEdit Task for ZoomBrowser EX Canon RAW Image Task for ZoomBrowser EX Canon RemoteCapture Task for ZoomBrowser EX Canon Utilities PhotoStitch Canon Utilities ZoomBrowser EX Download Direct DVD Shrink 3.2 Extract-XISO – GUI by Huge Free Download Manager 2.5 Google Earth Pro HijackThis 2.0.2 Intel® Graphics Media Accelerator Driver iTunes J2SE Runtime Environment 5.0 Update 4 Java™ 6 Update 3 K-Lite Codec Pack 3.5.7 Full LifeFrame2 LimeWire PRO 4.16.2 Microsoft Office Access MUI (English) 2007 Microsoft Office Access Setup Metadata MUI (English) 2007 Microsoft Office Enterprise 2007 Microsoft Office Enterprise 2007 Microsoft Office Excel MUI (English) 2007 Microsoft Office Groove MUI (English) 2007 Microsoft Office Groove Setup Metadata MUI (English) 2007 Microsoft Office InfoPath MUI (English) 2007 Microsoft Office OneNote MUI (English) 2007 Microsoft Office Outlook MUI (English) 2007 Microsoft Office PowerPoint MUI (English) 2007 Microsoft Office Proof (English) 2007 Microsoft Office Proof (French) 2007 Microsoft Office Proof (Spanish) 2007 Microsoft Office Proofing (English) 2007 Microsoft Office Publisher MUI (English) 2007 Microsoft Office Shared MUI (English) 2007 Microsoft Office Shared Setup Metadata MUI (English) 2007 Microsoft Office Word MUI (English) 2007 Microsoft Save as PDF or XPS Add-in for 2007 Microsoft Office programs Microsoft SQL Server Desktop Engine (SONY_MEDIAMGR) Microsoft Visual C++ 2005 Redistributable Microsoft Visual C++ 2005 Redistributable MioMap v3 Updater for Mio C250 MioTransfer mIRC Motorola SM56 Speakerphone Modem Mozilla Firefox (2.0.0.11) MSXML 4.0 SP2 (KB927978) MSXML 4.0 SP2 (KB936181) MSXML 4.0 SP2 (KB941833) NB Probe Nero 7 Premium Net4Switch Nokia Connectivity Cable Driver Nokia PC Suite Nokia PC Suite PC Connectivity Solution PDF Settings PixiePack Codec Pack Power4Gear eXtreme PowerForPhone PowerISO QuickTime Security Update for CAPICOM (KB931906) Security Update for CAPICOM (KB931906) SigmaTel Audio Sony Media Manager 2.2 Sony Vegas 7.0 StuffPlug 3 Synaptics Pointing Device Driver Uniblue RegistryBooster 2 Update for Outlook 2007 Junk Email Filter (kb943597) USB2.0 1.3M WebCam VideoLAN VLC media player 0.8.6b Windows Driver Package - Nokia (WUDFRd) WPD (06/01/2007 6.84.33.0) Windows Driver Package - Nokia Modem (02/15/2007 3.1) Windows Driver Package - Nokia Modem (05/24/2007 6.84.0.1) Windows Driver Package - Nokia Modem (08/03/2007 6.84.0.2) Windows Driver Package - Nokia Modem (08/08/2007 3.3) Windows Driver Package - Nokia Modem (11/03/2006 6.82.0.1) Windows Live installer Windows Live Messenger Windows Live Sign-in Assistant WinFlash WinRAR archiver WinZip Wireless Console 2

parlevoo

Post #5January 25, 2008, 4:40 PM UTC

hi sorry to be a pain, but i just removed dealio and newdotnet… here is the new HJT Log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:39:14 AM, on 1/26/2008
Platform: Windows Vista SP1, v.668 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.17052)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\ASUS\ASUS Live Update\ALU.exe
C:\Program Files\ccxgui\ccx_gui.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Free Download Manager\fdm.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Grisoft\AVG7\avgwb.dat
C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\LimeWire\LimeWire.exe
C:\Windows\Explorer.exe
C:\Windows\system32\DllHost.exe
C:\Program Files\NewDotNet\uninstall.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\System32\notepad.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.asus.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.asus.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.1.2.dll
O2 - BHO: URLLink Class - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E} - C:\Program Files\NewDotNet\newdotnet6_38.dll (file missing)
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdm2.dll
O4 - HKLM\..\Run: [Windows Defender] -
O4 - HKLM\..\Run: [ATKMEDIA] -C:\Program Files\ASUS\ATK Media\DMEDIA.EXE
O4 - HKLM\..\Run: [SynTPEnh] -C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [NeroFilterCheck] -C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [GrooveMonitor] -"C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [IgfxTray] -C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] -C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] -C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [PCSuiteTrayApplication] -C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [SunJavaUpdateSched] -"C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] -"C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Windows Mobile-based device management] -%SystemRoot%\system32\svchost.exe -k LocalSystemNetworkRestricted
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~1.DLL,NewDotNetStartup -s
O4 - HKCU\..\Run: [Free Download Manager] -"C:\Program Files\Free Download Manager\fdm.exe" -autorun
O4 - HKCU\..\Run: [MsnMsgr] -"C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Tunebite] -C:\Program Files\RapidSolution\Tunebite\Tunebite.exe -tray
O4 - HKCU\..\Run: [WMPNSCFG] -C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: ccXgui.lnk = C:\Program Files\ccxgui\ccx_gui.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Download all with Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm
O8 - Extra context menu item: Download selected with Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Download video with Free Download Manager - file://C:\Program Files\Free Download Manager\dlfvideo.htm
O8 - Extra context menu item: Download with Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.1.2.dll/206 (file missing)
O13 - Gopher Prefix:
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O20 - Winlogon Notify: avgwlntf - C:\Windows\SYSTEM32\avgwlntf.dll
O23 - Service: Adobe LM Service - Unknown owner - -"C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe" (file missing)
O23 - Service: Apple Mobile Device - Unknown owner - -"C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe" (file missing)
O23 - Service: ASLDR Service (ASLDRService) - Unknown owner - -C:\Program Files\ATK Hotkey\ASLDRSrv.exe (file missing)
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG7 Resident Shield Service (AvgCoreSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Unknown owner - -"C:\Program Files\Bonjour\mDNSResponder.exe" (file missing)
O23 - Service: ccXgui - Unknown owner - -C:\Program Files\ccxgui\ccXservice.exe (file missing)
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - -"C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: FLEXnet Licensing Service - Unknown owner - -"C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe" (file missing)
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Machine Debug Manager (MDM) - Unknown owner - -"C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe" (file missing)
O23 - Service: Microsoft Office Groove Audit Service - Unknown owner - -"C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe" (file missing)
O23 - Service: MSSQL$SONY_MEDIAMGR - Unknown owner - -C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe (file missing)
O23 - Service: MSSQLServerADHelper - Unknown owner - -C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqladhlp.exe (file missing)
O23 - Service: NBService - Unknown owner - -C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe (file missing)
O23 - Service: Microsoft Office Diagnostics Service (odserv) - Unknown owner - -"C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE" (file missing)
O23 - Service: Office Source Engine (ose) - Unknown owner - -"C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE" (file missing)
O23 - Service: ServiceLayer - Unknown owner - -"C:\Program Files\PC Connectivity Solution\ServiceLayer.exe" (file missing)
O23 - Service: spmgr - Unknown owner - -C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe (file missing)
O23 - Service: SQLAgent$SONY_MEDIAMGR - Unknown owner - -C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlagent.EXE (file missing)
O23 - Service: Syntek AVStream USB2.0 WebCam Service (StkSSrv) - Syntek America Inc. - C:\Windows\System32\StkCSrv.exe
O23 - Service: Messenger Sharing Folders USN Journal Reader service (usnjsvc) - Unknown owner - -"C:\Program Files\Windows Live\Messenger\usnsvc.exe" (file missing)
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - -"C:\Program Files\Windows Live\installer\WLSetupSvc.exe" (file missing)

–
End of file - 10926 bytes

Scotty

Post #6January 25, 2008, 4:45 PM UTC

Hello

If you already have Combofix, please delete that copy and download it again as it's being updated regularly.

Please download Combofix from Bleeping Computer.

If you can't download it from there, please try these 2 alternative sites:

Forospyware
Geeks to Go

Save it to your Desktop.
Disconnect from the Internet, than disable your anti-virus and any real-time anti-spyware monitors that are running.
Click Start>Run copy/paste or type "%userprofile%\desktop\combofix.exe" /killall into the Run box and click OK.
When finished, it shall produce a log for you. Post that log in your next reply with a new HijackThis log.

Note 1: Do not mouseclick combofix's window whilst it's running. That may cause it to stall
Note 2:Remember to re-enable your anti-virus and anti-spyware before reconnecting to the Internet.

In your next reply post:
ComboFix.txt
New HijackThis log taken after the above scan has run

parlevoo

Post #7January 25, 2008, 5:41 PM UTC

ComboFix 08-01-23.1C - Jesse 2008-01-26 4:05:57.1 - NTFSx86
Microsoft® Windows Vista™ Business 6.0.6001.1.1252.1.1033.18.415 [GMT 11:00]
Running from: C:\Users\[removed]\Desktop\combofix.exe
Command switches used :: /killall
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\newdotnet
C:\Program Files\newdotnet\NewDotNet-old0\nncore.dll
C:\Program Files\newdotnet\NewDotNet-old0\nnrun.exe
C:\Program Files\newdotnet\NewDotNet-old0\uninstall.exe
C:\Windows\system32\drivers\core.cache.dsk
C:\Windows\system32\drivers\core.sys
C:\Windows\system32\x64

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
——-\LEGACY_CORE
——-\core

((((((((((((((((((((((((( Files Created from 2007-12-25 to 2008-01-25 )))))))))))))))))))))))))))))))
.

2008-01-26 01:40 . 2008-01-26 01:40 d——– C:\Program Files\Trend Micro
2008-01-26 01:29 . 2008-01-26 01:29 8,464 –a—— C:\Windows\System32\sporder.dll
2008-01-26 00:38 . 2008-01-26 00:38 d——– C:\Program Files\Uniblue
2008-01-26 00:37 . 2008-01-26 00:37 167,536 –ah—– C:\Windows\System32\mlfcache.dat
2008-01-25 23:49 . 2000-08-31 08:00 51,200 –a—— C:\Windows\Nircmd.exe
2008-01-25 21:04 . 2007-05-30 23:10 10,872 –a—— C:\Windows\System32\drivers\AvgAsCln.sys
2008-01-25 20:13 . 2008-01-25 20:13 9,216 –a—— C:\Windows\System32\avgwlntf.dll
2008-01-25 18:37 . 2008-01-25 18:37 d——– C:\Program Files\Kaspersky Lab
2008-01-25 17:36 . 2008-01-25 17:36 d——– C:\Program Files\Common Files\SWF Studio
2008-01-25 17:28 . 2008-01-25 18:52 d–hs—- C:\Windows\SmVzc2UgQWxsb21lcw
2008-01-25 13:16 . 2007-12-12 13:15 2,032,128 –a—— C:\Windows\System32\win32k.sys
2008-01-25 01:35 . 2008-01-25 01:35 d——– C:\PerfLogs
2008-01-24 18:41 . 2007-11-30 23:07 8,139,264 –a—— C:\Windows\System32\ssBranded.scr
2008-01-24 18:40 . 2007-11-30 21:45 12,038,656 –a—— C:\Windows\System32\NlsLexicons0007.dll
2008-01-24 18:38 . 2007-11-30 21:20 4,240,384 –a—— C:\Windows\System32\GameUXLegacyGDFs.dll
2008-01-24 18:37 . 2007-11-30 23:10 2,153,472 –a—— C:\Windows\System32\oobefldr.dll
2008-01-24 13:23 . 2008-01-24 13:29 d——– C:\Program Files\Download Direct
2008-01-24 05:37 . 2008-01-24 05:37 6,656 –a—— C:\Windows\System32\kbd106n.dll
2008-01-22 15:40 . 2008-01-22 15:40 2,560 –a—— C:\Windows\System32\bitcometres.dll
2008-01-22 02:15 . 2008-01-13 03:06 804,352 –a—— C:\Windows\System32\drivers\tcpip.original
2008-01-19 17:16 . 2008-01-19 17:17 d——– C:\Program Files\BingoCafe
2008-01-18 13:28 . 2008-01-18 13:28 d——– C:\Program Files\iPod
2008-01-18 13:28 . 2008-01-26 03:19 1,409 –a—— C:\Windows\QTFont.for
2008-01-18 13:27 . 2008-01-18 13:28 d——– C:\Program Files\iTunes
2008-01-18 13:25 . 2008-01-18 13:26 d——– C:\Program Files\QuickTime
2008-01-16 02:06 . 2007-09-24 23:31 69,632 –a—— C:\Windows\System32\javacpl.cpl
2008-01-14 00:13 . 2008-01-14 00:15 d——– C:\Program Files\Canon
2008-01-14 00:12 . 2008-01-14 00:12 d——– C:\Program Files\Common Files\Canon
2008-01-12 10:40 . 2008-01-26 03:19 54,156 –ah—– C:\Windows\QTFont.qfn
2008-01-10 15:27 . 2008-01-10 15:27 90,112 –a—— C:\Windows\System32\QuickTimeVR.qtx
2008-01-10 15:27 . 2008-01-10 15:27 57,344 –a—— C:\Windows\System32\QuickTime.qts
2007-12-26 16:06 . 2007-12-26 16:06 d——– C:\Program Files\K-Lite Codec Pack
2007-12-26 15:59 . 2007-12-26 15:59 d——– C:\Program Files\PixiePack Codec Pack
2007-12-26 15:55 . 2007-11-16 10:30 26,912 –a—— C:\Windows\System32\drivers\tbhsd.sys
2007-12-26 15:53 . 2007-12-26 15:53 d——– C:\Program Files\RapidSolution
2007-12-26 02:04 . 2008-01-26 00:34 d——– C:\Program Files\mIRC

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-24 15:01 174 –sha-w C:\Program Files\desktop.ini
2008-01-24 14:37 ——— d—–w C:\Program Files\Windows Sidebar
2008-01-24 14:37 ——— d—–w C:\Program Files\Windows Photo Gallery
2008-01-24 14:37 ——— d—–w C:\Program Files\Windows Mail
2008-01-24 14:37 ——— d—–w C:\Program Files\Windows Journal
2008-01-24 14:37 ——— d—–w C:\Program Files\Windows Defender
2008-01-24 14:37 ——— d—–w C:\Program Files\Windows Collaboration
2008-01-24 14:37 ——— d—–w C:\Program Files\Windows Calendar
2008-01-15 15:13 ——— d—–w C:\Program Files\LimeWire
2008-01-15 15:06 ——— d—–w C:\Program Files\Java
2007-12-21 03:30 ——— d—–w C:\Program Files\xlink one
2007-12-21 03:30 ——— d—–w C:\Program Files\XLink Kai Evolution VII
2007-12-21 03:29 ——— d—–w C:\Program Files\NCH Swift Sound
2007-12-21 03:17 ——— d–h–w C:\Program Files\InstallShield Installation Information
2007-12-21 02:52 ——— d—–w C:\Program Files\NCH Software
2007-12-20 14:11 ——— d—–w C:\Program Files\Vstplugins
2007-12-20 14:09 ——— d—–w C:\Program Files\Sony
2007-12-07 14:34 ——— d—–w C:\Program Files\Extract-XISO
2007-12-06 20:35 ——— d—–w C:\Program Files\Google
2007-12-03 03:28 ——— d—–w C:\Program Files\ccxgui
2007-12-01 14:56 ——— d—–w C:\Program Files\Red Chair Software
2007-12-01 10:35 ——— d—–w C:\Program Files\Apple Software Update
2007-12-01 10:33 ——— d—–w C:\Program Files\Common Files\Apple
2007-12-01 00:05 ——— d—–w C:\Program Files\BitComet
2007-11-30 12:17 891,448 —-a-w C:\Windows\system32\drivers\tcpip.sys
2007-11-30 12:17 529,464 —-a-w C:\Windows\system32\drivers\ndis.sys
2007-11-30 12:17 504,376 —-a-w C:\Windows\system32\drivers\Wdf01000.sys
2007-11-30 12:17 440,888 —-a-w C:\Windows\system32\drivers\ksecdd.sys
2007-11-30 12:17 294,456 —-a-w C:\Windows\system32\drivers\volmgrx.sys
2007-11-30 12:17 266,808 —-a-w C:\Windows\system32\drivers\acpi.sys
2007-11-30 12:17 227,896 —-a-w C:\Windows\system32\drivers\volsnap.sys
2007-11-30 12:17 223,288 —-a-w C:\Windows\system32\drivers\netio.sys
2007-11-30 12:17 192,056 —-a-w C:\Windows\system32\drivers\fltMgr.sys
2007-11-30 12:17 181,304 —-a-w C:\Windows\system32\drivers\msiscsi.sys
2007-11-30 12:17 163,384 —-a-w C:\Windows\system32\drivers\msrpc.sys
2007-11-30 12:17 1,082,424 —-a-w C:\Windows\system32\drivers\ntfs.sys
2007-11-30 12:16 151,096 —-a-w C:\Windows\system32\drivers\pci.sys
2007-11-30 12:16 143,416 —-a-w C:\Windows\system32\drivers\ecache.sys
2007-11-30 12:16 142,904 —-a-w C:\Windows\system32\drivers\scsiport.sys
2007-11-30 12:16 127,544 —-a-w C:\Windows\system32\drivers\Classpnp.sys
2007-11-30 12:16 123,960 —-a-w C:\Windows\system32\drivers\Storport.sys
2007-11-30 12:16 110,136 —-a-w C:\Windows\system32\drivers\ataport.sys
2007-11-30 12:16 101,432 —-a-w C:\Windows\system32\drivers\FWPKCLNT.SYS
2007-11-30 12:15 58,936 —-a-w C:\Windows\system32\drivers\fileinfo.sys
2007-11-30 12:15 57,400 —-a-w C:\Windows\system32\drivers\mountmgr.sys
2007-11-30 12:15 56,376 —-a-w C:\Windows\system32\drivers\partmgr.sys
2007-11-30 12:15 55,352 —-a-w C:\Windows\system32\drivers\disk.sys
2007-11-30 12:15 54,328 —-a-w C:\Windows\system32\drivers\termdd.sys
2007-11-30 12:15 52,792 —-a-w C:\Windows\system32\drivers\volmgr.sys
2007-11-30 12:15 49,208 —-a-w C:\Windows\system32\drivers\mup.sys
2007-11-30 12:15 45,112 —-a-w C:\Windows\system32\drivers\pciidex.sys
2007-11-30 12:15 36,408 —-a-w C:\Windows\system32\drivers\crashdmp.sys
2007-11-30 12:15 35,896 —-a-w C:\Windows\system32\drivers\WdfLdr.sys
2007-11-30 12:15 35,384 —-a-w C:\Windows\system32\drivers\kbdclass.sys
2007-11-30 12:15 34,360 —-a-w C:\Windows\system32\drivers\mouclass.sys
2007-11-30 12:15 31,288 —-a-w C:\Windows\system32\drivers\mssmbios.sys
2007-11-30 12:15 29,240 —-a-w C:\Windows\system32\drivers\Dumpata.sys
2007-11-30 12:14 28,216 —-a-w C:\Windows\system32\drivers\battc.sys
2007-11-30 12:14 21,560 —-a-w C:\Windows\system32\drivers\atapi.sys
2007-11-30 12:14 21,048 —-a-w C:\Windows\system32\drivers\spldr.sys
2007-11-30 12:14 20,792 —-a-w C:\Windows\system32\drivers\compbatt.sys
2007-11-30 12:14 17,976 —-a-w C:\Windows\system32\drivers\wmilib.sys
2007-11-30 12:14 17,976 —-a-w C:\Windows\system32\drivers\intelide.sys
2007-11-30 12:14 16,440 —-a-w C:\Windows\system32\drivers\msisadrv.sys
2007-11-30 12:14 15,288 —-a-w C:\Windows\system32\drivers\swenum.sys
2007-11-30 12:08 52,736 —-a-w C:\Windows\AppPatch\iebrshim.dll
2007-11-30 12:07 58,880 —-a-w C:\Windows\bfsvc.exe
2007-11-30 12:07 540,672 —-a-w C:\Windows\AppPatch\AcLayers.dll
2007-11-30 12:07 498,176 —-a-w C:\Windows\HelpPane.exe
2007-11-30 12:07 456,704 —-a-w C:\Windows\AppPatch\AcSpecfc.dll
2007-11-30 12:07 40,960 —-a-w C:\Windows\AppPatch\apihex86.dll
2007-11-30 12:07 237,568 —-a-w C:\Windows\AppPatch\AcRedir.dll
2007-11-30 12:07 2,921,984 —-a-w C:\Windows\explorer.exe
2007-11-30 12:07 2,153,984 —-a-w C:\Windows\AppPatch\AcGenral.dll
2007-11-30 12:07 173,056 —-a-w C:\Windows\AppPatch\AcXtrnal.dll
2007-11-30 12:07 151,040 —-a-w C:\Windows\notepad.exe
2007-11-30 12:07 134,656 —-a-w C:\Windows\regedit.exe
2007-11-30 12:07 13,312 —-a-w C:\Windows\fveupdate.exe
2007-11-30 11:31 93,696 —-a-w C:\Windows\system32\drivers\bridge.sys
2007-11-30 11:26 130,048 —-a-w C:\Windows\system32\drivers\drmk.sys
2007-11-30 10:37 39,936 —-a-w C:\Windows\system32\drivers\WpdUsb.sys
2007-11-30 10:35 248,832 —-a-w C:\Windows\system32\drivers\rdpdr.sys
2007-11-30 10:34 6,144 —-a-w C:\Windows\system32\drivers\RDPENCDD.sys
2007-11-30 10:34 6,144 —-a-w C:\Windows\system32\drivers\RDPCDD.sys
2007-11-30 10:34 29,184 —-a-w C:\Windows\system32\drivers\tdtcp.sys
2007-11-30 10:34 23,552 —-a-w C:\Windows\system32\drivers\tssecsrv.sys
2007-11-30 10:34 180,736 —-a-w C:\Windows\system32\drivers\rdpwd.sys
2007-11-30 10:34 17,920 —-a-w C:\Windows\system32\drivers\tdpipe.sys
2007-11-30 10:30 8,192 —-a-w C:\Windows\system32\drivers\rootmdm.sys
2007-11-30 10:30 76,288 —-a-w C:\Windows\system32\drivers\rasl2tp.sys
2007-11-30 10:30 69,120 —-a-w C:\Windows\system32\drivers\rassstp.sys
2007-11-30 10:30 62,976 —-a-w C:\Windows\system32\drivers\raspptp.sys
2007-11-30 10:30 62,464 —-a-w C:\Windows\system32\drivers\wanarp.sys
2007-11-30 10:30 49,664 —-a-w C:\Windows\system32\drivers\ndproxy.sys
2007-11-30 10:30 47,616 —-a-w C:\Windows\system32\drivers\ipfltdrv.sys
2007-11-30 10:30 41,472 —-a-w C:\Windows\system32\drivers\raspppoe.sys
2007-11-30 10:30 31,744 —-a-w C:\Windows\system32\drivers\modem.sys
2007-11-30 10:30 273,920 —-a-w C:\Windows\system32\drivers\afd.sys
2007-11-30 10:30 20,992 —-a-w C:\Windows\system32\drivers\tdi.sys
2007-11-30 10:30 20,992 —-a-w C:\Windows\system32\drivers\ndistapi.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4A2AACF3-ADF6-11D5-98A9-00E018981B9E}]
C:\Program Files\NewDotNet\newdotnet6_38.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Free Download Manager"="-C:\Program Files\Free Download Manager\fdm.exe" [ ]
"MsnMsgr"="-C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [ ]
"Tunebite"="-C:\Program Files\RapidSolution\Tunebite\Tunebite.exe" [ ]
"WMPNSCFG"="-C:\Program Files\Windows Media Player\WMPNSCFG.exe" [ ]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 23:44:06 29696]
ccXgui.lnk - C:\Program Files\ccxgui\ccx_gui.exe [2004-10-07 22:53:20 344576]
WinZip Quick Pick.lnk - C:\Program Files\WinZip\WZQKPICK.EXE [2007-11-17 01:49:25 122880]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 0 (0x0)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"ForceRunOnStartMenu"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgwlntf]
avgwlntf.dll 2008-01-25 20:13 9216 C:\Windows\System32\avgwlntf.dll

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Privoxy.lnk]
path=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Privoxy.lnk
backup=C:\Windows\pss\Privoxy.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^Users^Jesse Allomes^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Anapod Manager.lnk]
path=C:\Users\Jesse Allomes\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Anapod Manager.lnk
backup=C:\Windows\pss\Anapod Manager.lnk.Startup
backupExtension=.Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitComet]
–a—— 2008-01-08 21:25 2124088 C:\Program Files\BitComet\BitComet.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
–a—— 2008-01-15 03:22 267048 C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PowerForPhone]
–a—— 2007-01-16 10:17 778240 C:\Program Files\PowerForPhone\PowerForPhone.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE]
–a—— 2007-04-09 23:23 200704 C:\Program Files\PowerISO\PWRISOVM.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
–a—— 2008-01-10 15:27 385024 C:\Program Files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SMSERIAL]
–a—— 2006-10-09 22:43 729088 C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Vidalia]
C:\Program Files\Vidalia Bundle\Vidalia\vidalia.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Mobile-based device management]
%windir%\WindowsMobile\wmdSync.exe

R3 igfx;igfx;C:\Windows\system32\DRIVERS\igdkmd32.sys [2007-08-24 19:39]
R3 NETw3v32;Intel® PRO/Wireless 3945ABG Adapter Driver for Windows Vista 32 Bit;C:\Windows\system32\DRIVERS\NETw3v32.sys [2006-12-19 12:12]
S3 exfat;exFAT File System Driver;C:\Windows\system32\drivers\exfat.sys [2007-11-30 21:01]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalService REG_MULTI_SZ nsi lltdsvc SSDPSRV upnphost SCardSvr w32time EventSystem RemoteRegistry WinHttpAutoProxySvc lanmanworkstation TBS SLUINotify THREADORDER fdrespub netprofm fdphost wcncsvc QWAVE WebClient SstpSvc
LocalSystemNetworkRestricted REG_MULTI_SZ hidserv UxSms WdiSystemHost Netman trkwks AudioEndpointBuilder WUDFSvc irmon sysmain IPBusEnum dot3svc PcaSvc CscService TabletInputService UmRdpService wlansvc WPDBusEnum EMDMgmt
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
LocalServiceNetworkRestricted REG_MULTI_SZ DHCP eventlog AudioSrv LmHosts wscsvc p2pimsvc PNRPSvc p2psvc PnrpAutoReg
bthsvcs REG_MULTI_SZ BthServ
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - LocalService
SstpSvc

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
\shell\AutoRun\command - F:\LaunchU3.exe -a

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{621FCD24-4498-4324-A81E-07D331376EDF}]
C:\Program Files\PixiePack Codec Pack\InstallerHelper.exe
.
Contents of the 'Scheduled Tasks' folder
"2008-01-25 17:12:12 C:\Windows\Tasks\At1.job"
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-26 04:32:20
Windows 6.0.6001 Service Pack 1, v.668 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-26 4:38:15
ComboFix-quarantined-files.txt 2008-01-25 17:38:06
.
2008-01-25 02:17:16 — E O F —

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:40:48 AM, on 1/26/2008
Platform: Windows Vista SP1, v.668 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.17052)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\ASUS\ASUS Live Update\ALU.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Windows\Explorer.exe
C:\Windows\System32\mobsync.exe
C:\Windows\system32\notepad.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\Explorer.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\iseeyou.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.asus.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.asus.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.1.2.dll
O2 - BHO: URLLink Class - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E} - C:\Program Files\NewDotNet\newdotnet6_38.dll (file missing)
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdm2.dll
O4 - HKCU\..\Run: [Free Download Manager] -"C:\Program Files\Free Download Manager\fdm.exe" -autorun
O4 - HKCU\..\Run: [MsnMsgr] -"C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Tunebite] -C:\Program Files\RapidSolution\Tunebite\Tunebite.exe -tray
O4 - HKCU\..\Run: [WMPNSCFG] -C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: ccXgui.lnk = C:\Program Files\ccxgui\ccx_gui.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Download all with Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm
O8 - Extra context menu item: Download selected with Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Download video with Free Download Manager - file://C:\Program Files\Free Download Manager\dlfvideo.htm
O8 - Extra context menu item: Download with Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.1.2.dll/206 (file missing)
O13 - Gopher Prefix:
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O20 - Winlogon Notify: avgwlntf - C:\Windows\SYSTEM32\avgwlntf.dll
O23 - Service: Adobe LM Service - Unknown owner - -"C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe" (file missing)
O23 - Service: Apple Mobile Device - Unknown owner - -"C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe" (file missing)
O23 - Service: ASLDR Service (ASLDRService) - Unknown owner - -C:\Program Files\ATK Hotkey\ASLDRSrv.exe (file missing)
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG7 Resident Shield Service (AvgCoreSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Unknown owner - -"C:\Program Files\Bonjour\mDNSResponder.exe" (file missing)
O23 - Service: ccXgui - Unknown owner - -C:\Program Files\ccxgui\ccXservice.exe (file missing)
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - -"C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: FLEXnet Licensing Service - Unknown owner - -"C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe" (file missing)
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Machine Debug Manager (MDM) - Unknown owner - -"C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe" (file missing)
O23 - Service: Microsoft Office Groove Audit Service - Unknown owner - -"C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe" (file missing)
O23 - Service: MSSQL$SONY_MEDIAMGR - Unknown owner - -C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe (file missing)
O23 - Service: MSSQLServerADHelper - Unknown owner - -C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqladhlp.exe (file missing)
O23 - Service: NBService - Unknown owner - -C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe (file missing)
O23 - Service: Microsoft Office Diagnostics Service (odserv) - Unknown owner - -"C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE" (file missing)
O23 - Service: Office Source Engine (ose) - Unknown owner - -"C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE" (file missing)
O23 - Service: ServiceLayer - Unknown owner - -"C:\Program Files\PC Connectivity Solution\ServiceLayer.exe" (file missing)
O23 - Service: spmgr - Unknown owner - -C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe (file missing)
O23 - Service: SQLAgent$SONY_MEDIAMGR - Unknown owner - -C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlagent.EXE (file missing)
O23 - Service: Syntek AVStream USB2.0 WebCam Service (StkSSrv) - Syntek America Inc. - C:\Windows\System32\StkCSrv.exe
O23 - Service: Messenger Sharing Folders USN Journal Reader service (usnjsvc) - Unknown owner - -"C:\Program Files\Windows Live\Messenger\usnsvc.exe" (file missing)
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - -"C:\Program Files\Windows Live\installer\WLSetupSvc.exe" (file missing)

–
End of file - 8971 bytes

parlevoo

Post #8January 26, 2008, 1:16 PM UTC last edited January 26, 2008, 1:19 PM UTC

are you there scotty i need to know what else to do.

Scotty

Post #9January 26, 2008, 4:29 PM UTC

Hi

Sorry, I had to get confirmation on something, before proceeding.

One thing pointed out to me is that you have disabled the User Account Control on your computer, which may be the reason you have got infected. Here is the Wiki description of UAC. I suggest reenabling it for your computers safety.
http://en.wikipedia.org/wiki/User_Account_Control

Remember to disconnect from the Internet and disable your anti-virus before carrying out the next instruction, and to reenable the anti-virus before reconnecting to the Internet

Open Notepad - it must be Notepad, not Wordpad.
Copy the text below in the code box by highlighting all the text with your mouse and pressing Ctrl+C

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4A2AACF3-ADF6-11D5-98A9-00E018981B9E}]

Go to the Notepad window and click Edit > Paste
Then click File > Save
Name the file "CFScript.txt" (including the quotes)
Save the file to your Desktop

[external image: Posted Image]

Refering to the picture above, drag CFScript into ComboFix.exe

Please do an online scan with Kaspersky Online Scanner. You will be prompted to install an ActiveX component from Kaspersky, Click Yes.

The program will launch and then start to download the latest definition files.
Once the scanner is installed and the definitions downloaded, click Next.
Now click on Scan Settings
In the scan settings make sure that the following are selected:
- Scan using the following Anti-Virus database:
  
  + Extended(If available otherwise Standard)
- Scan Options:
  
  + Scan Archives
  + Scan Mail Bases
Click OK
Now under select a target to scan select My Computer
The scan will take a while so be patient and let it run. Once the scan is complete it will display if your system has been infected.
Now click on the Save as Text button
Save the file to your desktop.
Copy and paste that information in your next post.

With the exception of Internet Explorer, which is needed for the Kaspersky Scan, keep ALL programs closed until the scan is complete. This includes your anti-virus. Once you have installed the Scanner, and the updated definitions, you can disconnect from the Internet.Re-enable the anti-virus before reconnecting to the Internet.

In your next reply post:
Kaspersky report
ComboFix.txt
New HJT log taken after the above scan has run

parlevoo

Post #10January 26, 2008, 5:48 PM UTC

ComboFix 08-01-23.1C - Jesse 2008-01-27 4:38:27.2 - NTFSx86 NETWORK
Microsoft® Windows Vista™ Business 6.0.6001.1.1252.1.1033.18.647 [GMT 11:00]
Running from: C:\Users\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Users\Jesse Allomes\Desktop\cfscript.txt
.

((((((((((((((((((((((((( Files Created from 2007-12-26 to 2008-01-26 )))))))))))))))))))))))))))))))
.

2008-01-26 06:43 . 2008-01-26 06:43 d——– C:\Program Files\Synaptics
2008-01-26 06:42 . 2006-03-09 09:58 1,060,424 –a—— C:\Windows\System32\WdfCoInstaller01000.dll
2008-01-26 06:42 . 2007-12-06 17:09 196,608 –a—— C:\Windows\System32\SynCtrl.dll
2008-01-26 06:42 . 2007-12-06 18:12 196,400 –a—— C:\Windows\System32\drivers\SynTP.sys
2008-01-26 06:42 . 2007-12-06 17:08 163,840 –a—— C:\Windows\System32\SynCOM.dll
2008-01-26 06:42 . 2007-12-06 17:20 147,456 –a—— C:\Windows\System32\SynTPAPI.dll
2008-01-26 06:42 . 2007-12-06 18:12 110,592 –a—— C:\Windows\System32\SynTPCo4.dll
2008-01-26 06:31 . 2008-01-26 06:32 306,432 –a—— C:\Windows\System32\TuneUpDefragService.exe
2008-01-26 06:31 . 2007-12-20 10:41 29,440 –a—— C:\Windows\System32\uxtuneup.dll
2008-01-26 06:31 . 2007-12-20 10:44 16,640 –a—— C:\Windows\System32\authuitu.dll
2008-01-26 06:30 . 2008-01-26 06:32 d——– C:\Program Files\TuneUp Utilities 2008
2008-01-26 06:30 . 2008-01-26 06:30 d——– C:\Program Files\Common Files\Wise Installation Wizard
2008-01-26 01:40 . 2008-01-26 01:40 d——– C:\Program Files\Trend Micro
2008-01-26 01:29 . 2008-01-26 01:29 8,464 –a—— C:\Windows\System32\sporder.dll
2008-01-26 00:38 . 2008-01-26 00:38 d——– C:\Program Files\Uniblue
2008-01-26 00:37 . 2008-01-26 00:37 167,536 –ah—– C:\Windows\System32\mlfcache.dat
2008-01-25 23:49 . 2000-08-31 08:00 51,200 –a—— C:\Windows\Nircmd.exe
2008-01-25 21:04 . 2007-05-30 23:10 10,872 –a—— C:\Windows\System32\drivers\AvgAsCln.sys
2008-01-25 20:13 . 2008-01-25 20:13 9,216 –a—— C:\Windows\System32\avgwlntf.dll
2008-01-25 18:37 . 2008-01-25 18:37 d——– C:\Program Files\Kaspersky Lab
2008-01-25 17:36 . 2008-01-25 17:36 d——– C:\Program Files\Common Files\SWF Studio
2008-01-25 17:28 . 2008-01-25 18:52 d–hs—- C:\Windows\SmVzc2UgQWxsb21lcw
2008-01-25 13:16 . 2007-12-12 13:15 2,032,128 –a—— C:\Windows\System32\win32k.sys
2008-01-25 01:35 . 2008-01-25 01:35 d——– C:\PerfLogs
2008-01-24 18:41 . 2007-11-30 23:07 8,139,264 –a—— C:\Windows\System32\ssBranded.scr
2008-01-24 18:40 . 2007-11-30 21:45 12,038,656 –a—— C:\Windows\System32\NlsLexicons0007.dll
2008-01-24 18:38 . 2007-11-30 21:20 4,240,384 –a—— C:\Windows\System32\GameUXLegacyGDFs.dll
2008-01-24 18:37 . 2007-11-30 23:10 2,153,472 –a—— C:\Windows\System32\oobefldr.dll
2008-01-24 05:37 . 2008-01-24 05:37 6,656 –a—— C:\Windows\System32\kbd106n.dll
2008-01-22 15:40 . 2008-01-22 15:40 2,560 –a—— C:\Windows\System32\bitcometres.dll
2008-01-22 02:15 . 2008-01-13 03:06 804,352 –a—— C:\Windows\System32\drivers\tcpip.original
2008-01-18 13:28 . 2008-01-18 13:28 d——– C:\Program Files\iPod
2008-01-18 13:28 . 2008-01-26 06:27 1,409 –a—— C:\Windows\QTFont.for
2008-01-18 13:27 . 2008-01-26 06:28 d——– C:\Program Files\iTunes
2008-01-18 13:25 . 2008-01-18 13:26 d——– C:\Program Files\QuickTime
2008-01-16 02:06 . 2007-09-24 23:31 69,632 –a—— C:\Windows\System32\javacpl.cpl
2008-01-14 00:13 . 2008-01-14 00:15 d——– C:\Program Files\Canon
2008-01-14 00:12 . 2008-01-14 00:12 d——– C:\Program Files\Common Files\Canon
2008-01-12 10:40 . 2008-01-26 06:58 54,156 –ah—– C:\Windows\QTFont.qfn
2008-01-10 15:27 . 2008-01-10 15:27 90,112 –a—— C:\Windows\System32\QuickTimeVR.qtx
2008-01-10 15:27 . 2008-01-10 15:27 57,344 –a—— C:\Windows\System32\QuickTime.qts
2007-12-26 16:06 . 2007-12-26 16:06 d——– C:\Program Files\K-Lite Codec Pack
2007-12-26 15:59 . 2007-12-26 15:59 d——– C:\Program Files\PixiePack Codec Pack
2007-12-26 15:55 . 2007-11-16 10:30 26,912 –a—— C:\Windows\System32\drivers\tbhsd.sys
2007-12-26 15:53 . 2007-12-26 15:53 d——– C:\Program Files\RapidSolution
2007-12-26 02:04 . 2008-01-26 00:34 d——– C:\Program Files\mIRC

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-25 19:49 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-01-24 15:01 174 –sha-w C:\Program Files\desktop.ini
2008-01-24 14:37 ——— d—–w C:\Program Files\Windows Sidebar
2008-01-24 14:37 ——— d—–w C:\Program Files\Windows Photo Gallery
2008-01-24 14:37 ——— d—–w C:\Program Files\Windows Mail
2008-01-24 14:37 ——— d—–w C:\Program Files\Windows Journal
2008-01-24 14:37 ——— d—–w C:\Program Files\Windows Defender
2008-01-24 14:37 ——— d—–w C:\Program Files\Windows Collaboration
2008-01-24 14:37 ——— d—–w C:\Program Files\Windows Calendar
2008-01-15 15:13 ——— d—–w C:\Program Files\LimeWire
2008-01-15 15:06 ——— d—–w C:\Program Files\Java
2007-12-21 03:30 ——— d—–w C:\Program Files\xlink one
2007-12-21 03:30 ——— d—–w C:\Program Files\XLink Kai Evolution VII
2007-12-21 03:29 ——— d—–w C:\Program Files\NCH Swift Sound
2007-12-21 02:52 ——— d—–w C:\Program Files\NCH Software
2007-12-20 14:11 ——— d—–w C:\Program Files\Vstplugins
2007-12-20 14:09 ——— d—–w C:\Program Files\Sony
2007-12-07 14:34 ——— d—–w C:\Program Files\Extract-XISO
2007-12-06 20:35 ——— d—–w C:\Program Files\Google
2007-12-03 03:28 ——— d—–w C:\Program Files\ccxgui
2007-12-01 14:56 ——— d—–w C:\Program Files\Red Chair Software
2007-12-01 10:35 ——— d—–w C:\Program Files\Apple Software Update
2007-12-01 10:33 ——— d—–w C:\Program Files\Common Files\Apple
2007-12-01 00:05 ——— d—–w C:\Program Files\BitComet
2007-11-30 12:17 891,448 —-a-w C:\Windows\system32\drivers\tcpip.sys
2007-11-30 12:17 529,464 —-a-w C:\Windows\system32\drivers\ndis.sys
2007-11-30 12:17 504,376 —-a-w C:\Windows\system32\drivers\Wdf01000.sys
2007-11-30 12:17 440,888 —-a-w C:\Windows\system32\drivers\ksecdd.sys
2007-11-30 12:17 294,456 —-a-w C:\Windows\system32\drivers\volmgrx.sys
2007-11-30 12:17 266,808 —-a-w C:\Windows\system32\drivers\acpi.sys
2007-11-30 12:17 227,896 —-a-w C:\Windows\system32\drivers\volsnap.sys
2007-11-30 12:17 223,288 —-a-w C:\Windows\system32\drivers\netio.sys
2007-11-30 12:17 192,056 —-a-w C:\Windows\system32\drivers\fltMgr.sys
2007-11-30 12:17 181,304 —-a-w C:\Windows\system32\drivers\msiscsi.sys
2007-11-30 12:17 163,384 —-a-w C:\Windows\system32\drivers\msrpc.sys
2007-11-30 12:17 1,082,424 —-a-w C:\Windows\system32\drivers\ntfs.sys
2007-11-30 12:16 151,096 —-a-w C:\Windows\system32\drivers\pci.sys
2007-11-30 12:16 143,416 —-a-w C:\Windows\system32\drivers\ecache.sys
2007-11-30 12:16 142,904 —-a-w C:\Windows\system32\drivers\scsiport.sys
2007-11-30 12:16 127,544 —-a-w C:\Windows\system32\drivers\Classpnp.sys
2007-11-30 12:16 123,960 —-a-w C:\Windows\system32\drivers\Storport.sys
2007-11-30 12:16 110,136 —-a-w C:\Windows\system32\drivers\ataport.sys
2007-11-30 12:16 101,432 —-a-w C:\Windows\system32\drivers\FWPKCLNT.SYS
2007-11-30 12:15 58,936 —-a-w C:\Windows\system32\drivers\fileinfo.sys
2007-11-30 12:15 57,400 —-a-w C:\Windows\system32\drivers\mountmgr.sys
2007-11-30 12:15 56,376 —-a-w C:\Windows\system32\drivers\partmgr.sys
2007-11-30 12:15 55,352 —-a-w C:\Windows\system32\drivers\disk.sys
2007-11-30 12:15 54,328 —-a-w C:\Windows\system32\drivers\termdd.sys
2007-11-30 12:15 52,792 —-a-w C:\Windows\system32\drivers\volmgr.sys
2007-11-30 12:15 49,208 —-a-w C:\Windows\system32\drivers\mup.sys
2007-11-30 12:15 45,112 —-a-w C:\Windows\system32\drivers\pciidex.sys
2007-11-30 12:15 36,408 —-a-w C:\Windows\system32\drivers\crashdmp.sys
2007-11-30 12:15 35,896 —-a-w C:\Windows\system32\drivers\WdfLdr.sys
2007-11-30 12:15 35,384 —-a-w C:\Windows\system32\drivers\kbdclass.sys
2007-11-30 12:15 34,360 —-a-w C:\Windows\system32\drivers\mouclass.sys
2007-11-30 12:15 31,288 —-a-w C:\Windows\system32\drivers\mssmbios.sys
2007-11-30 12:15 29,240 —-a-w C:\Windows\system32\drivers\Dumpata.sys
2007-11-30 12:14 28,216 —-a-w C:\Windows\system32\drivers\battc.sys
2007-11-30 12:14 21,560 —-a-w C:\Windows\system32\drivers\atapi.sys
2007-11-30 12:14 21,048 —-a-w C:\Windows\system32\drivers\spldr.sys
2007-11-30 12:14 20,792 —-a-w C:\Windows\system32\drivers\compbatt.sys
2007-11-30 12:14 17,976 —-a-w C:\Windows\system32\drivers\wmilib.sys
2007-11-30 12:14 17,976 —-a-w C:\Windows\system32\drivers\intelide.sys
2007-11-30 12:14 16,440 —-a-w C:\Windows\system32\drivers\msisadrv.sys
2007-11-30 12:14 15,288 —-a-w C:\Windows\system32\drivers\swenum.sys
2007-11-30 12:08 52,736 —-a-w C:\Windows\AppPatch\iebrshim.dll
2007-11-30 12:07 58,880 —-a-w C:\Windows\bfsvc.exe
2007-11-30 12:07 540,672 —-a-w C:\Windows\AppPatch\AcLayers.dll
2007-11-30 12:07 498,176 —-a-w C:\Windows\HelpPane.exe
2007-11-30 12:07 456,704 —-a-w C:\Windows\AppPatch\AcSpecfc.dll
2007-11-30 12:07 40,960 —-a-w C:\Windows\AppPatch\apihex86.dll
2007-11-30 12:07 237,568 —-a-w C:\Windows\AppPatch\AcRedir.dll
2007-11-30 12:07 2,921,984 —-a-w C:\Windows\explorer.exe
2007-11-30 12:07 2,153,984 —-a-w C:\Windows\AppPatch\AcGenral.dll
2007-11-30 12:07 173,056 —-a-w C:\Windows\AppPatch\AcXtrnal.dll
2007-11-30 12:07 151,040 —-a-w C:\Windows\notepad.exe
2007-11-30 12:07 134,656 —-a-w C:\Windows\regedit.exe
2007-11-30 12:07 13,312 —-a-w C:\Windows\fveupdate.exe
2007-11-30 11:31 93,696 —-a-w C:\Windows\system32\drivers\bridge.sys
2007-11-30 11:26 130,048 —-a-w C:\Windows\system32\drivers\drmk.sys
2007-11-30 10:37 39,936 —-a-w C:\Windows\system32\drivers\WpdUsb.sys
2007-11-30 10:35 248,832 —-a-w C:\Windows\system32\drivers\rdpdr.sys
2007-11-30 10:34 6,144 —-a-w C:\Windows\system32\drivers\RDPENCDD.sys
2007-11-30 10:34 6,144 —-a-w C:\Windows\system32\drivers\RDPCDD.sys
2007-11-30 10:34 29,184 —-a-w C:\Windows\system32\drivers\tdtcp.sys
2007-11-30 10:34 23,552 —-a-w C:\Windows\system32\drivers\tssecsrv.sys
2007-11-30 10:34 180,736 —-a-w C:\Windows\system32\drivers\rdpwd.sys
2007-11-30 10:34 17,920 —-a-w C:\Windows\system32\drivers\tdpipe.sys
2007-11-30 10:30 8,192 —-a-w C:\Windows\system32\drivers\rootmdm.sys
2007-11-30 10:30 76,288 —-a-w C:\Windows\system32\drivers\rasl2tp.sys
2007-11-30 10:30 69,120 —-a-w C:\Windows\system32\drivers\rassstp.sys
2007-11-30 10:30 62,976 —-a-w C:\Windows\system32\drivers\raspptp.sys
2007-11-30 10:30 62,464 —-a-w C:\Windows\system32\drivers\wanarp.sys
2007-11-30 10:30 49,664 —-a-w C:\Windows\system32\drivers\ndproxy.sys
2007-11-30 10:30 47,616 —-a-w C:\Windows\system32\drivers\ipfltdrv.sys
2007-11-30 10:30 41,472 —-a-w C:\Windows\system32\drivers\raspppoe.sys
2007-11-30 10:30 31,744 —-a-w C:\Windows\system32\drivers\modem.sys
2007-11-30 10:30 273,920 —-a-w C:\Windows\system32\drivers\afd.sys
2007-11-30 10:30 20,992 —-a-w C:\Windows\system32\drivers\tdi.sys
2007-11-30 10:30 20,992 —-a-w C:\Windows\system32\drivers\ndistapi.sys
.

((((((((((((((((((((((((((((( snapshot@2008-01-26_ 4.37.35.43 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-01-25 17:31:05 67,584 –s-a-w C:\Windows\bootstat.dat
+ 2008-01-26 17:37:07 67,584 –s-a-w C:\Windows\bootstat.dat
+ 2000-08-30 21:00:00 163,328 —-a-w C:\Windows\erdnt\Hiv-backup\ERDNT.EXE
+ 2008-01-26 17:38:13 155,648 —-a-w C:\Windows\erdnt\Hiv-backup\Users\00000001\NTUSER.DAT
+ 2008-01-26 17:38:13 159,744 —-a-w C:\Windows\erdnt\Hiv-backup\Users\00000002\NTUSER.DAT
+ 2008-01-26 17:38:14 3,411,968 —-a-w C:\Windows\erdnt\Hiv-backup\Users\00000003\ntuser.dat
+ 2008-01-26 17:38:14 2,007,040 —-a-w C:\Windows\erdnt\Hiv-backup\Users\00000004\UsrClass.dat
- 2008-01-24 14:54:49 51,200 —-a-w C:\Windows\inf\infpub.dat
+ 2008-01-25 19:43:46 51,200 —-a-w C:\Windows\inf\infpub.dat
- 2008-01-24 14:54:49 86,016 —-a-w C:\Windows\inf\infstor.dat
+ 2008-01-25 19:43:39 86,016 —-a-w C:\Windows\inf\infstor.dat
- 2008-01-24 14:54:49 143,360 —-a-w C:\Windows\inf\infstrng.dat
+ 2008-01-25 19:43:46 143,360 —-a-w C:\Windows\inf\infstrng.dat
- 2008-01-25 16:19:56 102,400 —-a-r C:\Windows\Installer\{B85C4D19-6CEB-48CF-BD98-C887AC8C6F94}\iTunesIco.exe
+ 2008-01-25 19:27:17 102,400 —-a-r C:\Windows\Installer\{B85C4D19-6CEB-48CF-BD98-C887AC8C6F94}\iTunesIco.exe
- 2008-01-25 16:42:49 262,144 —-a-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\UsrClass.dat
+ 2008-01-26 17:13:05 262,144 —-a-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\UsrClass.dat
- 2008-01-25 17:31:53 262,144 –sha-w C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT
+ 2008-01-26 17:34:04 159,744 —-a-w C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT
- 2008-01-25 15:34:07 262,144 —-a-w C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\UsrClass.dat
+ 2008-01-26 15:25:59 262,144 —-a-w C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\UsrClass.dat
- 2008-01-25 17:31:53 262,144 –sha-w C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT
+ 2008-01-26 17:34:04 155,648 —-a-w C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT
- 2008-01-25 14:37:55 16,384 –sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2008-01-25 19:31:12 16,384 –sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2008-01-25 14:37:55 32,768 –sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2008-01-25 19:31:12 32,768 –sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2008-01-25 14:37:55 16,384 –sha-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2008-01-25 19:31:12 16,384 –sha-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2008-01-25 17:05:52 262,144 —-a-w C:\Windows\System32\config\systemprofile\ntuser.dat
+ 2008-01-26 17:38:24 262,144 —-a-w C:\Windows\System32\config\systemprofile\ntuser.dat
+ 2007-12-06 07:12:48 196,400 —-a-w C:\Windows\System32\DriverStore\FileRepository\synhid.inf_1e8398cb\SynTP.sys
+ 2006-03-08 22:58:00 1,060,424 —-a-w C:\Windows\System32\DriverStore\FileRepository\synhid.inf_1e8398cb\WdfCoInstaller01000.dll
+ 2007-12-06 07:12:46 124,200 —-a-w C:\Windows\System32\DriverStore\FileRepository\synpd.inf_04eaec4c\InstNT.exe
+ 2007-12-06 06:08:20 163,840 —-a-w C:\Windows\System32\DriverStore\FileRepository\synpd.inf_04eaec4c\SynCOM.dll
+ 2007-12-06 06:09:04 196,608 —-a-w C:\Windows\System32\DriverStore\FileRepository\synpd.inf_04eaec4c\SynCtrl.dll
+ 2007-12-06 06:52:16 626,688 —-a-w C:\Windows\System32\DriverStore\FileRepository\synpd.inf_04eaec4c\SynISDLL.dll
+ 2007-12-06 06:10:06 233,472 —-a-w C:\Windows\System32\DriverStore\FileRepository\synpd.inf_04eaec4c\SynMood.exe
+ 2007-12-06 07:12:48 196,400 —-a-w C:\Windows\System32\DriverStore\FileRepository\synpd.inf_04eaec4c\SynTP.sys
+ 2007-12-06 06:20:04 147,456 —-a-w C:\Windows\System32\DriverStore\FileRepository\synpd.inf_04eaec4c\SynTPAPI.dll
+ 2007-12-06 07:12:02 110,592 —-a-w C:\Windows\System32\DriverStore\FileRepository\synpd.inf_04eaec4c\SynTPCo4.dll
+ 2007-12-06 06:20:24 102,400 —-a-w C:\Windows\System32\DriverStore\FileRepository\synpd.inf_04eaec4c\SynTPCOM.dll
+ 2007-12-06 06:47:46 946,176 —-a-w C:\Windows\System32\DriverStore\FileRepository\synpd.inf_04eaec4c\SynTPCpl.dll
+ 2007-12-06 07:12:44 1,029,416 —-a-w C:\Windows\System32\DriverStore\FileRepository\synpd.inf_04eaec4c\SynTPEnh.exe
+ 2007-12-06 07:12:58 95,528 —-a-w C:\Windows\System32\DriverStore\FileRepository\synpd.inf_04eaec4c\SynTPHelper.exe
+ 2007-12-06 06:51:38 5,824,512 —-a-w C:\Windows\System32\DriverStore\FileRepository\synpd.inf_04eaec4c\SynTPRes.dll
+ 2007-12-06 06:10:56 241,664 —-a-w C:\Windows\System32\DriverStore\FileRepository\synpd.inf_04eaec4c\SynZMetr.exe
+ 2007-12-06 06:51:54 327,680 —-a-w C:\Windows\System32\DriverStore\FileRepository\synpd.inf_04eaec4c\Tutorial.exe
+ 2006-03-08 22:58:00 1,060,424 —-a-w C:\Windows\System32\DriverStore\FileRepository\synpd.inf_04eaec4c\WdfCoInstaller01000.dll
- 2008-01-25 14:32:40 109,878 —-a-w C:\Windows\System32\perfc009.dat
+ 2008-01-26 17:41:49 109,294 —-a-w C:\Windows\System32\perfc009.dat
- 2008-01-25 14:32:40 616,418 —-a-w C:\Windows\System32\perfh009.dat
+ 2008-01-26 17:41:49 615,432 —-a-w C:\Windows\System32\perfh009.dat
- 2008-01-25 17:33:19 9,830 —-a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1863655029-2327013909-1150771356-1000_UserData.bin
+ 2008-01-25 20:00:12 10,058 —-a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1863655029-2327013909-1150771356-1000_UserData.bin
- 2008-01-25 17:33:19 67,306 —-a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2008-01-25 20:00:12 67,490 —-a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
- 2008-01-25 17:33:16 45,192 —-a-w C:\Windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2008-01-25 19:40:53 45,760 —-a-w C:\Windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
.
– Snapshot reset to current date –
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2007-11-30 23:07 202240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-01-15 03:22 267048]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 20:25 6731312]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2007-12-06 18:12 1029416]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 23:44:06 29696]
ccXgui.lnk - C:\Program Files\ccxgui\ccx_gui.exe [2004-10-07 22:53:20 344576]
WinZip Quick Pick.lnk - C:\Program Files\WinZip\WZQKPICK.EXE [2007-11-17 01:49:25 122880]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 0 (0x0)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"ForceRunOnStartMenu"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgwlntf]
avgwlntf.dll 2008-01-25 20:13 9216 C:\Windows\System32\avgwlntf.dll

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Privoxy.lnk]
path=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Privoxy.lnk
backup=C:\Windows\pss\Privoxy.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^Users^Jesse Allomes^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Anapod Manager.lnk]
path=C:\Users\Jesse Allomes\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Anapod Manager.lnk
backup=C:\Windows\pss\Anapod Manager.lnk.Startup
backupExtension=.Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitComet]
–a—— 2008-01-08 21:25 2124088 C:\Program Files\BitComet\BitComet.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
–a—— 2008-01-15 03:22 267048 C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PowerForPhone]
–a—— 2007-01-16 10:17 778240 C:\Program Files\PowerForPhone\PowerForPhone.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE]
–a—— 2007-04-09 23:23 200704 C:\Program Files\PowerISO\PWRISOVM.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
–a—— 2008-01-10 15:27 385024 C:\Program Files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SMSERIAL]
–a—— 2006-10-09 22:43 729088 C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Vidalia]
C:\Program Files\Vidalia Bundle\Vidalia\vidalia.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Mobile-based device management]
%windir%\WindowsMobile\wmdSync.exe

R3 NETw3v32;Intel® PRO/Wireless 3945ABG Adapter Driver for Windows Vista 32 Bit;C:\Windows\system32\DRIVERS\NETw3v32.sys [2006-12-19 12:12]
R3 RasSstp;WAN Miniport (SSTP);C:\Windows\system32\DRIVERS\rassstp.sys [2007-11-30 21:30]
S2 ASLDRService;ASLDR Service;-C:\Program Files\ATK Hotkey\ASLDRSrv.exe []
S2 ccXgui;ccXgui;-C:\Program Files\ccxgui\ccXservice.exe []
S2 RapiMgr;Windows Mobile-based device connectivity;C:\Windows\system32\svchost.exe [2007-11-30 23:07]
S2 StkSSrv;Syntek AVStream USB2.0 WebCam Service;C:\Windows\System32\StkCSrv.exe [2006-12-11 03:31]
S2 UxTuneUp;TuneUp Theme Extension;C:\Windows\System32\svchost.exe [2007-11-30 23:07]
S2 WcesComm;Windows Mobile 2003-based device connectivity;C:\Windows\system32\svchost.exe [2007-11-30 23:07]
S3 exfat;exFAT File System Driver;C:\Windows\system32\drivers\exfat.sys [2007-11-30 21:01]
S3 igfx;igfx;C:\Windows\system32\DRIVERS\igdkmd32.sys [2007-08-24 19:39]
S3 RTL8169;Realtek 8169 NT Driver;C:\Windows\system32\DRIVERS\Rtlh86.sys [2006-11-02 18:30]
S3 SstpSvc;Secure Socket Tunneling Protocol Service;C:\Windows\system32\svchost.exe [2007-11-30 23:07]
S3 StkCMini;Syntek AVStream USB2.0 1.3M WebCam;C:\Windows\system32\Drivers\StkCMini.sys [2006-12-22 05:36]
S3 TPM;TPM;C:\Windows\system32\drivers\tpm.sys [2006-11-02 20:50]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\Windows\System32\TuneUpDefragService.exe [2008-01-26 06:32]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalService REG_MULTI_SZ nsi lltdsvc SSDPSRV upnphost SCardSvr w32time EventSystem RemoteRegistry WinHttpAutoProxySvc lanmanworkstation TBS SLUINotify THREADORDER fdrespub netprofm fdphost wcncsvc QWAVE WebClient SstpSvc
LocalSystemNetworkRestricted REG_MULTI_SZ hidserv UxSms WdiSystemHost Netman trkwks AudioEndpointBuilder WUDFSvc irmon sysmain IPBusEnum dot3svc PcaSvc CscService TabletInputService UmRdpService wlansvc WPDBusEnum EMDMgmt
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
LocalServiceNetworkRestricted REG_MULTI_SZ DHCP eventlog AudioSrv LmHosts wscsvc p2pimsvc PNRPSvc p2psvc PnrpAutoReg
bthsvcs REG_MULTI_SZ BthServ
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - LocalService
SstpSvc

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
\shell\AutoRun\command - F:\LaunchU3.exe -a

*Newly Created Service* - ECACHE

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{621FCD24-4498-4324-A81E-07D331376EDF}]
C:\Program Files\PixiePack Codec Pack\InstallerHelper.exe
.
Contents of the 'Scheduled Tasks' folder
"2008-01-25 19:38:43 C:\Windows\Tasks\1-Click Maintenance.job"
- C:\Program Files\TuneUp Utilities 2008\OneClick.exe
"2008-01-25 17:12:12 C:\Windows\Tasks\At1.job"
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-27 04:42:27
Windows 6.0.6001 Service Pack 1, v.668 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-27 4:43:10
ComboFix-quarantined-files.txt 2008-01-26 17:43:05
ComboFix2.txt 2008-01-25 17:38:16
.
2008-01-25 02:17:16 — E O F —

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:47:09 AM, on 1/27/2008
Platform: Windows Vista SP1, v.668 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.17052)
Boot mode: Safe mode with network support

Running processes:
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\System32\mobsync.exe
C:\Windows\Explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\iseeyou.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.asus.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.asus.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.1.2.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdm2.dll
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: ccXgui.lnk = C:\Program Files\ccxgui\ccx_gui.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Download all with Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm
O8 - Extra context menu item: Download selected with Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Download video with Free Download Manager - file://C:\Program Files\Free Download Manager\dlfvideo.htm
O8 - Extra context menu item: Download with Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.1.2.dll/206 (file missing)
O13 - Gopher Prefix:
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O20 - Winlogon Notify: avgwlntf - C:\Windows\SYSTEM32\avgwlntf.dll
O23 - Service: Adobe LM Service - Unknown owner - -"C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe" (file missing)
O23 - Service: Apple Mobile Device - Unknown owner - -"C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe" (file missing)
O23 - Service: ASLDR Service (ASLDRService) - Unknown owner - -C:\Program Files\ATK Hotkey\ASLDRSrv.exe (file missing)
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG7 Resident Shield Service (AvgCoreSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Unknown owner - -"C:\Program Files\Bonjour\mDNSResponder.exe" (file missing)
O23 - Service: ccXgui - Unknown owner - -C:\Program Files\ccxgui\ccXservice.exe (file missing)
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - -"C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: FLEXnet Licensing Service - Unknown owner - -"C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe" (file missing)
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Machine Debug Manager (MDM) - Unknown owner - -"C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe" (file missing)
O23 - Service: Microsoft Office Groove Audit Service - Unknown owner - -"C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe" (file missing)
O23 - Service: MSSQL$SONY_MEDIAMGR - Unknown owner - -C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe (file missing)
O23 - Service: MSSQLServerADHelper - Unknown owner - -C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqladhlp.exe (file missing)
O23 - Service: NBService - Unknown owner - -C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe (file missing)
O23 - Service: Microsoft Office Diagnostics Service (odserv) - Unknown owner - -"C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE" (file missing)
O23 - Service: Office Source Engine (ose) - Unknown owner - -"C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE" (file missing)
O23 - Service: ServiceLayer - Unknown owner - -"C:\Program Files\PC Connectivity Solution\ServiceLayer.exe" (file missing)
O23 - Service: spmgr - Unknown owner - -C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe (file missing)
O23 - Service: SQLAgent$SONY_MEDIAMGR - Unknown owner - -C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlagent.EXE (file missing)
O23 - Service: Syntek AVStream USB2.0 WebCam Service (StkSSrv) - Syntek America Inc. - C:\Windows\System32\StkCSrv.exe
O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software GmbH - C:\Windows\System32\TuneUpDefragService.exe
O23 - Service: Messenger Sharing Folders USN Journal Reader service (usnjsvc) - Unknown owner - -"C:\Program Files\Windows Live\Messenger\usnsvc.exe" (file missing)
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - -"C:\Program Files\Windows Live\installer\WLSetupSvc.exe" (file missing)

–
End of file - 8791 bytes

parlevoo

Post #11January 26, 2008, 5:48 PM UTC

kapersky log in a hour or so

parlevoo

Post #12January 27, 2008, 2:24 PM UTC

——————————————————————————- KASPERSKY ONLINE SCANNER REPORT Sunday, January 27, 2008 9:22:38 AM Operating System: Microsoft Windows Vista Professional, Service Pack 1, v.668 (Build 6001) Kaspersky Online Scanner version: 5.0.98.0 Kaspersky Anti-Virus database last update: 26/01/2008 Kaspersky Anti-Virus database records: 533507 ——————————————————————————- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - Critical Areas: C:\Windows C:\Users\JESSEA~1\AppData\Local\Temp\ Scan Statistics: Total number of scanned objects: 70741 Number of viruses found: 0 Number of infected objects: 0 Number of suspicious objects: 0 Duration of the scan process: 00:28:10 Infected Object Name / Virus Name / Last Action C:\Windows\bthservsdp.dat Object is locked skipped C:\Windows\CSC\v2.0.6\pq Object is locked skipped C:\Windows\CSC\v2.0.6\temp\ea-{a9a47517-ca8b-11dc-b08d-001a92c5f8ba} Object is locked skipped C:\Windows\Debug\PASSWD.LOG Object is locked skipped C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat Object is locked skipped C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat Object is locked skipped C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT Object is locked skipped C:\Windows\ServiceProfiles\LocalService\ntuser.dat.LOG1 Object is locked skipped C:\Windows\ServiceProfiles\LocalService\ntuser.dat.LOG2 Object is locked skipped C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT{13507ac9-cb7d-11dc-bd3e-001bfc0a4429}.TM.blf Object is locked skipped C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT{13507ac9-cb7d-11dc-bd3e-001bfc0a4429}.TMContainer00000000000000000001.regtrans-ms Object is locked skipped C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT{13507ac9-cb7d-11dc-bd3e-001bfc0a4429}.TMContainer00000000000000000002.regtrans-ms Object is locked skipped C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT Object is locked skipped C:\Windows\ServiceProfiles\NetworkService\ntuser.dat.LOG1 Object is locked skipped C:\Windows\ServiceProfiles\NetworkService\ntuser.dat.LOG2 Object is locked skipped C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT{13507ac7-cb7d-11dc-bd3e-001bfc0a4429}.TM.blf Object is locked skipped C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT{13507ac7-cb7d-11dc-bd3e-001bfc0a4429}.TMContainer00000000000000000001.regtrans-ms Object is locked skipped C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT{13507ac7-cb7d-11dc-bd3e-001bfc0a4429}.TMContainer00000000000000000002.regtrans-ms Object is locked skipped C:\Windows\System32\catroot2\edb.log Object is locked skipped C:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb Object is locked skipped C:\Windows\System32\catroot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb Object is locked skipped C:\Windows\System32\config\COMPONENTS Object is locked skipped C:\Windows\System32\config\COMPONENTS.LOG1 Object is locked skipped C:\Windows\System32\config\COMPONENTS.LOG2 Object is locked skipped C:\Windows\System32\config\DEFAULT Object is locked skipped C:\Windows\System32\config\DEFAULT.LOG1 Object is locked skipped C:\Windows\System32\config\DEFAULT.LOG2 Object is locked skipped C:\Windows\System32\config\RegBack\COMPONENTS Object is locked skipped C:\Windows\System32\config\RegBack\DEFAULT Object is locked skipped C:\Windows\System32\config\RegBack\SAM Object is locked skipped C:\Windows\System32\config\RegBack\SECURITY Object is locked skipped C:\Windows\System32\config\RegBack\SOFTWARE Object is locked skipped C:\Windows\System32\config\RegBack\SYSTEM Object is locked skipped C:\Windows\System32\config\SAM Object is locked skipped C:\Windows\System32\config\SAM.LOG1 Object is locked skipped C:\Windows\System32\config\SAM.LOG2 Object is locked skipped C:\Windows\System32\config\SECURITY Object is locked skipped C:\Windows\System32\config\SECURITY.LOG1 Object is locked skipped C:\Windows\System32\config\SECURITY.LOG2 Object is locked skipped C:\Windows\System32\config\SOFTWARE Object is locked skipped C:\Windows\System32\config\SOFTWARE.LOG1 Object is locked skipped C:\Windows\System32\config\SOFTWARE.LOG2 Object is locked skipped C:\Windows\System32\config\SYSTEM Object is locked skipped C:\Windows\System32\config\SYSTEM.LOG1 Object is locked skipped C:\Windows\System32\config\SYSTEM.LOG2 Object is locked skipped C:\Windows\System32\config\TxR\{250834B7-750C-494d-BDC3-DA86B6E2101B}.TM.blf Object is locked skipped C:\Windows\System32\config\TxR\{250834B7-750C-494d-BDC3-DA86B6E2101B}.TMContainer00000000000000000001.regtrans-ms Object is locked skipped C:\Windows\System32\config\TxR\{250834B7-750C-494d-BDC3-DA86B6E2101B}.TMContainer00000000000000000002.regtrans-ms Object is locked skipped C:\Windows\System32\config\TxR\{250834B7-750C-494d-BDC3-DA86B6E2101B}.TMContainer00000000000000000003.regtrans-ms Object is locked skipped C:\Windows\System32\config\TxR\{250834B7-750C-494d-BDC3-DA86B6E2101B}.TMContainer00000000000000000004.regtrans-ms Object is locked skipped C:\Windows\System32\LogFiles\Scm\SCM.EVM Object is locked skipped C:\Windows\System32\wbem\Logs\WMITracing.log Object is locked skipped C:\Windows\System32\wbem\repository\INDEX.BTR Object is locked skipped C:\Windows\System32\wbem\repository\MAPPING1.MAP Object is locked skipped C:\Windows\System32\wbem\repository\MAPPING2.MAP Object is locked skipped C:\Windows\System32\wbem\repository\OBJECTS.DATA Object is locked skipped C:\Windows\System32\WDI\LogFiles\WdiContextLog.etl.001 Object is locked skipped C:\Windows\System32\wfp\wfpdiag.etl Object is locked skipped C:\Windows\System32\winevt\Logs\Application.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\DFS Replication.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\HardwareEvents.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Internet Explorer.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Key Management Service.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-Backup.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-International%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-WHEA.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-NetworkAccessProtection%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-TaskScheduler%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-WLAN-AutoConfig%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\ODiag.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\OSession.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Security.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\System.evtx Object is locked skipped C:\Users\JESSEA~1\AppData\Local\Temp\FXSAPIDebugLogFile.txt Object is locked skipped Scan process completed.

Scotty

Post #13January 27, 2008, 4:21 PM UTC

Hi Do you still have the problems you started with? I expect you do. Could you list all of them?

parlevoo

Post #14January 27, 2008, 7:46 PM UTC

well the only residual thing i can notice at this point in time is that not all my programs arent starting up. i found info on getting my run, shut down, buttons back and my task manager and tegedit.. as of now i havent noticed any problems

Scotty

Post #15January 27, 2008, 8:28 PM UTC

Hi I noticed after you ran Combofix for the first time your HijackThis had a lot less 04 entries and assumed you had disabled some programs from starting up yourself. Did you fix anything in HijackThis yourself?

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] Help With A Dropper.DELF.MF virus

✨ Ask AI

Ask AI