What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Hijack this

12 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Logfile of HijackThis v1.99.1
Scan saved at 08:57:45, on 27/01/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Nikon\Wireless Camera Setup Utility\NkPtpEnum.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\Program Files\Zone Labs\ZoneAlarm\MailFrontier\mantispm.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\WINDOWS\SoftwareDistribution\Download\Install\CAPICOM-KB931906-v2102.exe
C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.celticfc.net/
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~4\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MRC] "C:\Program Files\PC Tune-Up\PCTuneUp.exe" /MBRSTART
O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 4.00\MediaManager\grab.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.euro.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by116fd.bay116.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {AF2E62B6-F9E1-4D4F-A10A-9DC8E6DCBCC0} (VideoEgg ActiveX Loader) - http://update.videoegg.com/Install/Windows…ggPublisher.exe
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/…ro.cab56649.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://mppv2flash3.valueactive.com/PokerTime/FlashAX.cab
O16 - DPF: {E856B973-45FD-4559-8F82-EAB539144667} (Dell PC Checkup Installer Control) - http://pccheckup.dellfix.com/rel/41/install/gtdownde.cab
O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://by110fd.bay110.hotmail.msn.com/activex/HMAtchmt.ocx
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~4\Office12\GR99D3~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: dlcd_device - Unknown owner - C:\WINDOWS\system32\dlcdcoms.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: NkPtpEnumP2 - Unknown owner - C:\Program Files\Nikon\Wireless Camera Setup Utility\NkPtpEnum.exe" -a -d="C:\Program Files\Nikon\Wireless Camera Setup Utility\NkPtpip.dll (file missing)
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
Post #2

found Trojan Horse Downloader.Zlob.sx when running AVG

Where did AVG show it was located?


Lets run an F-Secure online scan it will scan for Viruses, Spyware and RootKits:
  • Click HERE
  • Scroll to the bottom of the page and click the Start scanning button. A window will pop up.
  • Allow the Active X control to be installed on your computer, then click the Accept button
  • Click Full System Scan and allow the components to download and the scan to complete.
  • If malware is found, check Submit samples to F-Secure then select Automatic cleaning
  • When cleaning has finitished, click Show report (this will open an Internet Explorer window containing the report)
  • Highlight and Copy (CTRL + C) the complete report, and Paste (CTRL + V) in a new reply to this post
If Automatic cleaning with Submit samples hangs, click Cancel, then New Scan
  • When the cleaning option is presented, Uncheck Submit samples to F-Secure
  • Click Automatic cleaning
  • When cleaning has finitished, click Show report (this will open an Internet Explorer window containing the report)
  • Highlight and Copy (CTRL + C) the complete report, and Paste (CTRL + V) in a new reply to this post

Note: This scan will only work with Internet Explorer.
You must be logged on a administrator rights to run this scan.
The scan may take a few hours.

Also let me know how the computer is running now.
Post #3

found Trojan Horse Downloader.Zlob.sx when running AVG

Where did AVG show it was located?


Lets run an F-Secure online scan it will scan for Viruses, Spyware and RootKits:
  • Click HERE
  • Scroll to the bottom of the page and click the Start scanning button. A window will pop up.
  • Allow the Active X control to be installed on your computer, then click the Accept button
  • Click Full System Scan and allow the components to download and the scan to complete.
  • If malware is found, check Submit samples to F-Secure then select Automatic cleaning
  • When cleaning has finitished, click Show report (this will open an Internet Explorer window containing the report)
  • Highlight and Copy (CTRL + C) the complete report, and Paste (CTRL + V) in a new reply to this post
If Automatic cleaning with Submit samples hangs, click Cancel, then New Scan
  • When the cleaning option is presented, Uncheck Submit samples to F-Secure
  • Click Automatic cleaning
  • When cleaning has finitished, click Show report (this will open an Internet Explorer window containing the report)
  • Highlight and Copy (CTRL + C) the complete report, and Paste (CTRL + V) in a new reply to this post

Note: This scan will only work with Internet Explorer.
You must be logged on a administrator rights to run this scan.
The scan may take a few hours.

Also let me know how the computer is running now.

the trojan was attached to videoaccesscodecinstall.exe in my documents within my profile;

i was half-way through responding to your comments when the system crashed again - not sure if it can handle your scan, but will let you know.

ZoneAlarm has detected CAPICOM-KB931906-V2102.EXE trying to access my system - I have denied this?

System is very slow at present.

Post #5

http://www.microsoft.com/downloads/details…;displaylang=en

Instructions
Click the Download button on this page to start the download and click Go.
To start the installation immediately, click Open or Run this program from its current location.

installed and ran capicom - then the system crashed. One thing tho' - a "scanning report" appears to initiate the crash - appears to quickly to note the details, but it highlights an item and suggests that "it is not a virus" … think it mentioned win32sky? don't know it that makes any sense.

Can't complete the f-secure scan!


Regards,
Post #6
We shall keep trying :thumbup:

Go here scroll down and download the scanner using the 2nd link.

It will directly download the set-up icon on your desktop.
Double-click the set-up icon on your desktop and click Next.
Accept the agreement and click Next until the program installs.
Click Finish, at the end.
Make sure you update the scanner, and perform a full scan.

Click on the go to Main Menu and a Notepad will open.
Using Edit > Select all Copy/Paste the report back here.
Anti-Malware Public Beta version 0.87

Go here scroll down and download the scanner using the 2nd link.

It will directly download the set-up icon on your desktop.
Double-click the set-up icon on your desktop and click Next.
Accept the agreement and click Next until the program installs.
Click Finish, at the end.
Make sure you update the scanner, and perform a full scan.

Click on the go to Main Menu and a Notepad will open.
Using Edit > Select all Copy/Paste the report back here.
Post #7

We shall keep trying :thumbup:

Go here scroll down and download the scanner using the 2nd link.

It will directly download the set-up icon on your desktop.
Double-click the set-up icon on your desktop and click Next.
Accept the agreement and click Next until the program installs.
Click Finish, at the end.
Make sure you update the scanner, and perform a full scan.

Click on the go to Main Menu and a Notepad will open.
Using Edit > Select all Copy/Paste the report back here.
Anti-Malware Public Beta version 0.87

Go here scroll down and download the scanner using the 2nd link.

It will directly download the set-up icon on your desktop.
Double-click the set-up icon on your desktop and click Next.
Accept the agreement and click Next until the program installs.
Click Finish, at the end.
Make sure you update the scanner, and perform a full scan.

Click on the go to Main Menu and a Notepad will open.
Using Edit > Select all Copy/Paste the report back here.


I think the application deleted the fake reports - please see below for results of the Quick Scan.

Malwarebytes' Anti-Malware 1.01
Database version: 287

Scan type: Quick Scan
Objects scanned: 22327
Time elapsed: 6 minute(s), 30 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 4
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\Interface\{c2a73c02-fe74-4258-a720-d3eddc6bb998} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{3ded4932-31d6-4489-8c17-9c19f82ee294} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\egodktf.bosp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\egodktf.toolbar.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Documents and Settings\amanda\Local Settings\Temp\BIT2.tmp (Trojan.Fakealert) -> Quarantined and deleted successfully.

Post #9

Not sure if that took care of it.
Any crashes?

unfortunately, that'll be a yes …

is this just a case of returning the hard drive to the manufacturer - it is still under warranty?


Regards,
Post #10
I'm not so sure it's a hard drive issue.

Let get the latest combofix.

Download ComboFix from Here to your Desktop.

**Note: In the event you already have Combofix, please delete it from your desktop and download this new version . It is important that it is saved directly to your desktop**
——————————————————————–
  • Close any open browsers and make sure you are disconnected from the net. Unplug the cable if need be before running combofix.
  • WARNING: IF you have not already done so Combofix will disconnect your machine from the Internet when it starts
  • Please do not re-connect your machine back to the Internet until Combofix has completely finished.
——————————————————————–

Double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.
Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review

****Note: Do not mouseclick combofix's window while it's running. That may cause it to stall or freeze ****

*If there is no internet connection when Combofix has completely finished then restart your computer to restore back the connections.
Post #11
After 4 aborted attempts to scan I finally scanned in safe mode - hope this is ok.

ComboFix 08-01-23.1C - chic 2008-01-27 22:00:43.7 - NTFSx86 MINIMAL
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.801 [GMT 0:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2007-12-27 to 2008-01-27 )))))))))))))))))))))))))))))))
.

2008-01-27 21:22 . 2000-08-31 08:00 51,200 –a—— C:\WINDOWS\Nircmd.exe
2008-01-27 17:20 . 2008-01-27 17:20 d——– C:\Program Files\Malwarebytes' Anti-Malware
2008-01-27 10:53 . 2001-08-17 22:36 90,200 –a—— C:\WINDOWS\system32\dllcache\OLD7D6.tmp
2008-01-27 10:53 . 2004-08-03 23:00 87,424 –a—— C:\WINDOWS\system32\dllcache\OLD7E1.tmp
2008-01-27 10:53 . 2001-08-17 12:12 45,632 –a—— C:\WINDOWS\system32\dllcache\OLD7DA.tmp
2008-01-27 10:53 . 2001-08-17 13:50 38,784 –a—— C:\WINDOWS\system32\dllcache\OLD7D2.tmp
2008-01-27 10:53 . 2004-08-04 05:00 35,328 –a—— C:\WINDOWS\system32\dllcache\OLD7DD.tmp
2008-01-27 10:53 . 2001-08-17 13:47 13,056 –a—— C:\WINDOWS\system32\dllcache\OLD7CE.tmp
2008-01-26 20:31 . 2001-08-17 13:28 714,762 –a—— C:\WINDOWS\system32\dllcache\OLDAED.tmp
2008-01-26 20:31 . 2004-08-04 05:00 20,736 –a—— C:\WINDOWS\system32\dllcache\OLDAF0.tmp
2008-01-26 20:01 . 2001-08-17 13:28 701,386 –a—— C:\WINDOWS\system32\dllcache\wdhaalba.sys
2008-01-26 20:00 . 2001-08-17 13:28 794,654 –a—— C:\WINDOWS\system32\dllcache\usr1801.sys
2008-01-26 19:59 . 2001-08-17 22:36 525,568 –a—— C:\WINDOWS\system32\dllcache\tridxp.dll
2008-01-26 19:58 . 2004-08-04 05:00 571,392 –a—— C:\WINDOWS\system32\dllcache\tintlgnt.ime
2008-01-26 19:57 . 2001-08-17 12:18 285,760 –a—— C:\WINDOWS\system32\dllcache\stlnata.sys
2008-01-26 19:56 . 2004-08-04 05:00 456,704 –a—— C:\WINDOWS\system32\dllcache\smtpsvc.dll
2008-01-26 19:55 . 2001-08-17 22:36 386,560 –a—— C:\WINDOWS\system32\dllcache\sgiul50.dll
2008-01-26 19:54 . 2001-08-17 22:36 495,616 –a—— C:\WINDOWS\system32\dllcache\sblfx.dll
2008-01-26 19:53 . 2001-08-17 13:28 899,146 –a—— C:\WINDOWS\system32\dllcache\r2mdkxga.sys
2008-01-26 19:52 . 2004-08-04 05:00 482,304 –a—— C:\WINDOWS\system32\dllcache\pintlgnt.ime
2008-01-26 19:51 . 2001-08-17 14:05 351,616 –a—— C:\WINDOWS\system32\dllcache\ovcodek2.sys
2008-01-26 19:50 . 2001-08-17 12:50 198,144 –a—— C:\WINDOWS\system32\dllcache\nv3.sys
2008-01-26 19:49 . 2004-08-04 00:56 1,737,856 –a—— C:\WINDOWS\system32\dllcache\mtxparhd.dll
2008-01-26 19:48 . 2004-08-04 05:00 1,875,968 –a—— C:\WINDOWS\system32\dllcache\msir3jp.lex
2008-01-26 19:47 . 2004-08-04 05:00 1,158,818 –a—— C:\WINDOWS\system32\dllcache\korwbrkr.lex
2008-01-26 19:46 . 2004-08-04 00:56 152,576 –a—— C:\WINDOWS\system32\dllcache\irftp.exe
2008-01-26 19:45 . 2004-08-04 05:00 13,463,552 –a—— C:\WINDOWS\system32\dllcache\hwxjpn.dll
2008-01-26 19:44 . 2004-08-03 22:41 1,041,536 –a—— C:\WINDOWS\system32\dllcache\hsfdpsp2.sys
2008-01-26 19:43 . 2001-08-17 14:56 1,733,120 –a—— C:\WINDOWS\system32\dllcache\g400d.dll
2008-01-26 19:42 . 2001-08-17 14:56 470,144 –a—— C:\WINDOWS\system32\dllcache\g200d.dll
2008-01-26 19:41 . 2001-08-17 13:28 634,134 –a—— C:\WINDOWS\system32\dllcache\el656ct5.sys
2008-01-26 19:40 . 2001-08-17 12:14 952,007 –a—— C:\WINDOWS\system32\dllcache\diwan.sys
2008-01-26 19:39 . 2004-08-04 05:00 1,677,824 –a—— C:\WINDOWS\system32\dllcache\chsbrkr.dll
2008-01-26 19:38 . 2001-08-17 13:28 871,388 –a—— C:\WINDOWS\system32\dllcache\bcmdm.sys
2008-01-26 19:37 . 2004-08-04 00:56 870,784 –a—— C:\WINDOWS\system32\dllcache\ati3d1ag.dll
2008-01-26 19:36 . 2001-08-17 13:28 762,780 –a—— C:\WINDOWS\system32\dllcache\3cwmcru.sys
2008-01-26 19:35 . 2004-05-13 00:39 876,653 –a—— C:\WINDOWS\system32\dllcache\fp4awel.dll
2008-01-26 15:42 . 2008-01-27 16:25 d——– C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-01-26 10:47 . 2008-01-26 10:47 d——– C:\Program Files\Windows Desktop Search
2008-01-26 10:43 . 2007-07-30 19:19 271,224 –a—— C:\WINDOWS\system32\mucltui.dll
2008-01-26 10:43 . 2007-07-30 19:19 207,736 –a—— C:\WINDOWS\system32\muweb.dll
2008-01-26 10:43 . 2007-07-30 19:19 30,072 –a—— C:\WINDOWS\system32\mucltui.dll.mui
2008-01-26 10:27 . 2006-10-26 19:56 32,592 –a—— C:\WINDOWS\system32\msonpmon.dll
2008-01-26 10:24 . 2008-01-26 10:24 d——– C:\Program Files\Microsoft Works
2008-01-26 10:23 . 2008-01-26 10:23 d——– C:\Program Files\MSBuild
2008-01-26 10:21 . 2008-01-26 10:21 d——– C:\Program Files\Microsoft.NET
2008-01-26 10:12 . 2008-01-26 10:12 dr-h—– C:\MSOCache
2008-01-20 18:23 . 2008-01-22 05:41 1,358 –a—— C:\WINDOWS\system32\tmp.reg
2008-01-18 21:16 . 2008-01-25 18:28 d——– C:\Program Files\Opera
2008-01-15 21:13 . 2008-01-15 21:13 54,156 –ah—– C:\WINDOWS\QTFont.qfn
2008-01-15 21:13 . 2008-01-15 21:13 1,409 –a—— C:\WINDOWS\QTFont.for
2007-12-30 19:16 . 2007-12-30 19:16 d——– C:\Program Files\Free DVD Ripper
2007-12-30 19:16 . 2002-07-17 09:03 45,056 –a—— C:\WINDOWS\system32\WNASPI32.DLL
2007-12-30 19:16 . 2002-07-17 08:05 16,512 –a—— C:\WINDOWS\system32\drivers\ASPI32.SYS

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-27 21:50 28,013,001 —-a-w C:\WINDOWS\Internet Logs\tvDebug.zip
2008-01-27 21:49 5,863,936 —-a-w C:\WINDOWS\Internet Logs\xDB8.tmp
2008-01-27 21:37 87,040 —-a-w C:\WINDOWS\Internet Logs\xDB7.tmp
2008-01-27 21:37 5,863,936 —-a-w C:\WINDOWS\Internet Logs\xDB9.tmp
2008-01-27 21:26 5,864,960 —-a-w C:\WINDOWS\Internet Logs\xDB3.tmp
2008-01-27 19:41 281,900 –sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2008-01-27 19:41 20,975,392 –sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2008-01-27 18:52 77,312 —-a-w C:\WINDOWS\Internet Logs\xDB2.tmp
2008-01-27 18:52 5,857,280 —-a-w C:\WINDOWS\Internet Logs\xDB6.tmp
2008-01-27 17:45 150,016 —-a-w C:\WINDOWS\Internet Logs\xDB5.tmp
2008-01-27 16:31 5,849,088 —-a-w C:\WINDOWS\Internet Logs\xDB4.tmp
2008-01-27 15:02 ——— d—–w C:\Program Files\Dl_cats
2008-01-26 18:12 2,768,896 —-a-w C:\WINDOWS\Internet Logs\xDB1.tmp
2008-01-26 14:59 5,834,752 —-a-w C:\WINDOWS\Internet Logs\xDBD.tmp
2008-01-20 17:10 ——— d—–w C:\Program Files\Enigma Software Group
2008-01-20 10:18 ——— d—–w C:\Program Files\Apple Software Update
2008-01-16 18:30 ——— d—–w C:\Program Files\PC Tune-Up
2007-12-30 19:30 ——— d—–w C:\Program Files\DivX
2007-12-29 15:09 ——— d—–w C:\Program Files\Common Files\Synacast
2007-12-29 15:05 ——— d—–w C:\Program Files\PPLive
2007-12-11 19:46 524,288 —-a-w C:\WINDOWS\system32\DivXsm.exe
2007-12-11 19:46 3,596,288 —-a-w C:\WINDOWS\system32\qt-dx331.dll
2007-12-11 19:45 200,704 —-a-w C:\WINDOWS\system32\ssldivx.dll
2007-12-11 19:45 1,044,480 —-a-w C:\WINDOWS\system32\libdivx.dll
2007-12-11 19:44 823,296 —-a-w C:\WINDOWS\system32\divx_xx0c.dll
2007-12-11 19:44 823,296 —-a-w C:\WINDOWS\system32\divx_xx07.dll
2007-12-11 19:44 81,920 —-a-w C:\WINDOWS\system32\dpl100.dll
2007-12-11 19:44 802,816 —-a-w C:\WINDOWS\system32\divx_xx11.dll
2007-12-11 19:44 682,496 —-a-w C:\WINDOWS\system32\DivX.dll
2007-12-11 19:44 593,920 —-a-w C:\WINDOWS\system32\dpuGUI11.dll
2007-12-11 19:44 57,344 —-a-w C:\WINDOWS\system32\dpv11.dll
2007-12-11 19:44 53,248 —-a-w C:\WINDOWS\system32\dpuGUI10.dll
2007-12-11 19:44 344,064 —-a-w C:\WINDOWS\system32\dpus11.dll
2007-12-11 19:44 294,912 —-a-w C:\WINDOWS\system32\dpu11.dll
2007-12-11 19:44 294,912 —-a-w C:\WINDOWS\system32\dpu10.dll
2007-12-11 19:44 196,608 —-a-w C:\WINDOWS\system32\dtu100.dll
2007-12-11 19:44 156,992 —-a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2007-12-11 19:43 12,288 —-a-w C:\WINDOWS\system32\DivXWMPExtType.dll
2007-12-08 19:27 ——— d—–w C:\Program Files\DVDCoverPrint
2007-12-08 13:08 ——— d—–w C:\Program Files\Acoustica CD Label Maker
2007-12-05 20:39 ——— d—–w C:\Program Files\CheckPoint
2007-11-14 16:05 75,248 —-a-w C:\WINDOWS\zllsputility.exe
2007-11-14 16:05 1,086,952 —-a-w C:\WINDOWS\system32\zpeng24.dll
2007-11-08 19:03 512 —-a-w C:\ScanSectorLog.dat
2007-11-07 09:26 721,920 —-a-w C:\WINDOWS\system32\lsasrv.dll
2007-11-07 09:26 721,920 —-a-w C:\WINDOWS\system32\dllcache\lsasrv.dll
2007-10-30 23:42 3,590,656 —-a-w C:\WINDOWS\system32\dllcache\mshtml.dll
2007-10-30 17:20 360,064 —-a-w C:\WINDOWS\system32\dllcache\tcpip.sys
2007-10-29 22:43 1,287,680 —-a-w C:\WINDOWS\system32\quartz.dll
2007-10-29 22:43 1,287,680 —-a-w C:\WINDOWS\system32\dllcache\quartz.dll
2007-10-27 17:40 222,720 —-a-w C:\WINDOWS\system32\wmasf.dll
2007-10-27 17:40 222,720 —-a-w C:\WINDOWS\system32\dllcache\wmasf.dll
2007-03-15 18:04 26,622,970 —-a-w C:\WINDOWS\Internet Logs\vsmon_on_demand_2007_03_14_18_05_40_full.dmp.zip
2006-05-25 05:56 80,132 —-a-w C:\WINDOWS\Internet Logs\vsmon_2nd_2006_05_25_00_42_13_small.dmp.zip
2006-05-22 16:23 23,882,343 —-a-w C:\WINDOWS\Internet Logs\vsmon_on_demand_2006_05_22_10_08_03_full.dmp.zip
2006-05-22 16:23 23,877,553 —-a-w C:\WINDOWS\Internet Logs\vsmon_on_demand_2006_05_22_10_07_55_full.dmp.zip
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= C:\Program Files\Winamp Toolbar\winamptb.dll [2007-10-04 20:06 1135968]

[HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 05:00 15360]
"MRC"="C:\Program Files\PC Tune-Up\PCTuneUp.exe" [2007-10-12 07:57 2435072]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-11-14 16:05 919016]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-01-26 08:02 579072]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 05:24 286720]
"WinShrink"="\AutoJob.exe" [ ]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 05:00 15360]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-01-25 19:28 219136]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2004-08-04 05:00 53760 C:\WINDOWS\system32\narrator.exe]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Windows Desktop Search.lnk - C:\Program Files\Windows Desktop Search\WindowsSearch.exe [2007-02-05 15:40:46 118784]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{88485281-8b4b-4f8d-9ede-82e29a064277}"= C:\PROGRA~1\MarkAny\CONTEN~1\MACSMA~1.DLL [2004-11-23 15:51 192512]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll [2007-02-05 15:39 294400]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dla]
–a—— 2004-08-13 00:05 122939 C:\WINDOWS\system32\dla\tfswctrl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EverioService]
——— 2006-11-22 20:10 151552 C:\Program Files\CyberLink\PCM4Everio\EverioService.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
–a—— 2007-07-31 17:44 271672 C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MAAgent]
–a—— 2007-01-30 19:36 57344 C:\Program Files\MarkAny\ContentSafer\MAAgent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
–a—— 2007-06-29 05:24 286720 C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SMSTray]
–a—— 2007-02-23 15:32 126976 C:\Program Files\Samsung\Samsung Media Studio 5\SMSTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
–a—— 2007-03-14 02:43 83608 C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
–a—— 2005-12-18 14:26 180269 C:\Program Files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdateManager]
–a—— 2004-01-07 00:01 110592 C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe

S0 ntcdrdrv;ntcdrdrv;C:\WINDOWS\system32\DRIVERS\ntcdrdrv.sys []
S2 Ca536av;5.0M MPEG4 DV Video Capture;C:\WINDOWS\system32\Drivers\Ca536av.sys [2003-07-09 03:49]
S2 NkPtpEnumP2;NkPtpEnumP2;"C:\Program Files\Nikon\Wireless Camera Setup Utility\NkPtpEnum.exe" -a []
S3 ambitucm;Ambit USB Cable Modem NDIS Driver;C:\WINDOWS\system32\DRIVERS\ambitucm.sys [2001-11-12 05:40]
S3 ASPI;Advanced SCSI Programming Interface Driver;C:\WINDOWS\System32\DRIVERS\ASPI32.sys [2002-07-17 08:05]
S3 dlcd_device;dlcd_device;C:\WINDOWS\system32\dlcdcoms.exe [2005-06-21 08:19]
S3 DTV_Capture_2X0;DVB-T Receiver;C:\WINDOWS\system32\Drivers\DTV_Capture_2X0.sys [2004-09-06 13:40]
S3 DTV_Loader_2X1;DVB-T Loader;C:\WINDOWS\system32\Drivers\DTV_Loader_2X1.sys [2005-06-29 10:21]
S3 k600bus;Sony Ericsson 600i driver (WDM);C:\WINDOWS\system32\DRIVERS\k600bus.sys [2005-03-04 19:08]
S3 k600mdfl;Sony Ericsson 600i USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\k600mdfl.sys [2005-03-04 19:11]
S3 k600mdm;Sony Ericsson 600i USB WMC Modem Drivers;C:\WINDOWS\system32\DRIVERS\k600mdm.sys [2005-03-04 19:11]
S3 k600mgmt;Sony Ericsson 600i USB WMC Device Management Drivers;C:\WINDOWS\system32\DRIVERS\k600mgmt.sys [2005-03-04 19:13]
S3 k600obex;Sony Ericsson 600i USB WMC OBEX Interface Drivers;C:\WINDOWS\system32\DRIVERS\k600obex.sys [2005-03-04 19:15]
S3 ss_bus;SAMSUNG Mobile USB Device 1.0 driver (WDM);C:\WINDOWS\system32\DRIVERS\ss_bus.sys [2005-08-30 17:57]
S3 ss_mdfl;SAMSUNG Mobile USB Modem 1.0 Filter;C:\WINDOWS\system32\DRIVERS\ss_mdfl.sys [2005-08-30 17:58]
S3 ss_mdm;SAMSUNG Mobile USB Modem 1.0 Drivers;C:\WINDOWS\system32\DRIVERS\ss_mdm.sys [2005-08-30 17:59]
S3 USBCamera;5.0M MPEG4 DV Bulk Driver;C:\WINDOWS\system32\Drivers\Bulk536.sys [2003-05-14 09:28]
S3 VBus;Virtual Bus;C:\WINDOWS\system32\DRIVERS\NkVBus.sys [2005-06-17 11:11]

.
Contents of the 'Scheduled Tasks' folder
"2008-01-21 22:36:02 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-01-27 21:18:26 C:\WINDOWS\Tasks\User_Feed_Synchronization-{8ED3B4A8-B4E1-4007-B1F7-212178E5A582}.job"
- C:\WINDOWS\system32\msfeedssync.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-27 22:05:09
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-27 22:06:01
ComboFix-quarantined-files.txt 2008-01-27 22:05:52
ComboFix2.txt 2008-01-25 22:47:26
.
2008-01-09 05:20:19 — E O F —


Hijack this file below.

Logfile of HijackThis v1.99.1
Scan saved at 22:11:35, on 27/01/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Nikon\Wireless Camera Setup Utility\NkPtpEnum.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Zone Labs\ZoneAlarm\MailFrontier\mantispm.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Documents and Settings\chic\disaster recovery\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.celticfc.net/
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~4\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [WinShrink] \AutoJob.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MRC] "C:\Program Files\PC Tune-Up\PCTuneUp.exe" /MBRSTART
O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 4.00\MediaManager\grab.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.euro.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} (F-Secure Online Scanner 3.1) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by116fd.bay116.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {AF2E62B6-F9E1-4D4F-A10A-9DC8E6DCBCC0} (VideoEgg ActiveX Loader) - http://update.videoegg.com/Install/Windows…ggPublisher.exe
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/…ro.cab56649.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://mppv2flash3.valueactive.com/PokerTime/FlashAX.cab
O16 - DPF: {E856B973-45FD-4559-8F82-EAB539144667} (Dell PC Checkup Installer Control) - http://pccheckup.dellfix.com/rel/41/install/gtdownde.cab
O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://by110fd.bay110.hotmail.msn.com/activex/HMAtchmt.ocx
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~4\Office12\GR99D3~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: dlcd_device - Unknown owner - C:\WINDOWS\system32\dlcdcoms.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: NkPtpEnumP2 - Unknown owner - C:\Program Files\Nikon\Wireless Camera Setup Utility\NkPtpEnum.exe" -a -d="C:\Program Files\Nikon\Wireless Camera Setup Utility\NkPtpip.dll (file missing)
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
Post #12
Run hijackthis. Hit None of the above, Click Do a System Scan Only. Put a checkmark/tick in the box on the left side on these:

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [WinShrink] \AutoJob.exe
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.euro.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} (F-Secure Online Scanner 3.1) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://mppv2flash3.valueactive.com/PokerTime/FlashAX.cab
O16 - DPF: {E856B973-45FD-4559-8F82-EAB539144667} (Dell PC Checkup Installer Control) - http://pccheckup.dellfix.com/rel/41/install/gtdownde.

Close ALL windows and browsers except HijackThis and click "Fix checked"

Next:

Open notepad and copy/paste the text in the quotebox below into it:

File::
C:\WINDOWS\system32\dllcache\OLD7D6.tmp
C:\WINDOWS\system32\dllcache\OLD7E1.tmp
C:\WINDOWS\system32\dllcache\OLD7DA.tmp
C:\WINDOWS\system32\dllcache\OLD7D2.tmp
C:\WINDOWS\system32\dllcache\OLD7DD.tmp
C:\WINDOWS\system32\dllcache\OLD7CE.tmp
C:\WINDOWS\system32\dllcache\OLDAED.tmp
C:\WINDOWS\system32\dllcache\OLDAF0.tmp

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WinShrink"=-


Save this as Save this as "CFScript"


[external image: Posted Image]

Refering to the picture above, drag CFScript.txt into ComboFix.exe

Then post the results log and a new HijackThis log.


Also please describe how your computer behaves at the moment.
Post #13
Logfile of HijackThis v1.99.1
Scan saved at 18:38:57, on 28/01/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Nikon\Wireless Camera Setup Utility\NkPtpEnum.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Program Files\Zone Labs\ZoneAlarm\MailFrontier\mantispm.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\chic\disaster recovery\HijackThis.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\chic\disaster recovery\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.celticfc.net/
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~4\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [WinShrink] \AutoJob.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MRC] "C:\Program Files\PC Tune-Up\PCTuneUp.exe" /MBRSTART
O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 4.00\MediaManager\grab.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by116fd.bay116.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {AF2E62B6-F9E1-4D4F-A10A-9DC8E6DCBCC0} (VideoEgg ActiveX Loader) - http://update.videoegg.com/Install/Windows…ggPublisher.exe
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/…ro.cab56649.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://by110fd.bay110.hotmail.msn.com/activex/HMAtchmt.ocx
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~4\Office12\GR99D3~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: dlcd_device - Unknown owner - C:\WINDOWS\system32\dlcdcoms.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: NkPtpEnumP2 - Unknown owner - C:\Program Files\Nikon\Wireless Camera Setup Utility\NkPtpEnum.exe" -a -d="C:\Program Files\Nikon\Wireless Camera Setup Utility\NkPtpip.dll (file missing)
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

ComboFix 08-01-23.1C - chic 2008-01-28 18:29:25.8 - NTFSx86 MINIMAL
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.802 [GMT 0:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2007-12-28 to 2008-01-28 )))))))))))))))))))))))))))))))
.

2008-01-27 21:22 . 2000-08-31 08:00 51,200 –a—— C:\WINDOWS\Nircmd.exe
2008-01-27 17:20 . 2008-01-27 17:20 d——– C:\Program Files\Malwarebytes' Anti-Malware
2008-01-27 10:53 . 2001-08-17 22:36 90,200 –a—— C:\WINDOWS\system32\dllcache\OLD7D6.tmp
2008-01-27 10:53 . 2004-08-03 23:00 87,424 –a—— C:\WINDOWS\system32\dllcache\OLD7E1.tmp
2008-01-27 10:53 . 2001-08-17 12:12 45,632 –a—— C:\WINDOWS\system32\dllcache\OLD7DA.tmp
2008-01-27 10:53 . 2001-08-17 13:50 38,784 –a—— C:\WINDOWS\system32\dllcache\OLD7D2.tmp
2008-01-27 10:53 . 2004-08-04 05:00 35,328 –a—— C:\WINDOWS\system32\dllcache\OLD7DD.tmp
2008-01-27 10:53 . 2001-08-17 13:47 13,056 –a—— C:\WINDOWS\system32\dllcache\OLD7CE.tmp
2008-01-26 20:31 . 2001-08-17 13:28 714,762 –a—— C:\WINDOWS\system32\dllcache\OLDAED.tmp
2008-01-26 20:31 . 2004-08-04 05:00 20,736 –a—— C:\WINDOWS\system32\dllcache\OLDAF0.tmp
2008-01-26 20:01 . 2001-08-17 13:28 701,386 –a—— C:\WINDOWS\system32\dllcache\wdhaalba.sys
2008-01-26 20:00 . 2001-08-17 13:28 794,654 –a—— C:\WINDOWS\system32\dllcache\usr1801.sys
2008-01-26 19:59 . 2001-08-17 22:36 525,568 –a—— C:\WINDOWS\system32\dllcache\tridxp.dll
2008-01-26 19:58 . 2004-08-04 05:00 571,392 –a—— C:\WINDOWS\system32\dllcache\tintlgnt.ime
2008-01-26 19:57 . 2001-08-17 12:18 285,760 –a—— C:\WINDOWS\system32\dllcache\stlnata.sys
2008-01-26 19:56 . 2004-08-04 05:00 456,704 –a—— C:\WINDOWS\system32\dllcache\smtpsvc.dll
2008-01-26 19:55 . 2001-08-17 22:36 386,560 –a—— C:\WINDOWS\system32\dllcache\sgiul50.dll
2008-01-26 19:54 . 2001-08-17 22:36 495,616 –a—— C:\WINDOWS\system32\dllcache\sblfx.dll
2008-01-26 19:53 . 2001-08-17 13:28 899,146 –a—— C:\WINDOWS\system32\dllcache\r2mdkxga.sys
2008-01-26 19:52 . 2004-08-04 05:00 482,304 –a—— C:\WINDOWS\system32\dllcache\pintlgnt.ime
2008-01-26 19:51 . 2001-08-17 14:05 351,616 –a—— C:\WINDOWS\system32\dllcache\ovcodek2.sys
2008-01-26 19:50 . 2001-08-17 12:50 198,144 –a—— C:\WINDOWS\system32\dllcache\nv3.sys
2008-01-26 19:49 . 2004-08-04 00:56 1,737,856 –a—— C:\WINDOWS\system32\dllcache\mtxparhd.dll
2008-01-26 19:48 . 2004-08-04 05:00 1,875,968 –a—— C:\WINDOWS\system32\dllcache\msir3jp.lex
2008-01-26 19:47 . 2004-08-04 05:00 1,158,818 –a—— C:\WINDOWS\system32\dllcache\korwbrkr.lex
2008-01-26 19:46 . 2004-08-04 00:56 152,576 –a—— C:\WINDOWS\system32\dllcache\irftp.exe
2008-01-26 19:45 . 2004-08-04 05:00 13,463,552 –a—— C:\WINDOWS\system32\dllcache\hwxjpn.dll
2008-01-26 19:44 . 2004-08-03 22:41 1,041,536 –a—— C:\WINDOWS\system32\dllcache\hsfdpsp2.sys
2008-01-26 19:43 . 2001-08-17 14:56 1,733,120 –a—— C:\WINDOWS\system32\dllcache\g400d.dll
2008-01-26 19:42 . 2001-08-17 14:56 470,144 –a—— C:\WINDOWS\system32\dllcache\g200d.dll
2008-01-26 19:41 . 2001-08-17 13:28 634,134 –a—— C:\WINDOWS\system32\dllcache\el656ct5.sys
2008-01-26 19:40 . 2001-08-17 12:14 952,007 –a—— C:\WINDOWS\system32\dllcache\diwan.sys
2008-01-26 19:39 . 2004-08-04 05:00 1,677,824 –a—— C:\WINDOWS\system32\dllcache\chsbrkr.dll
2008-01-26 19:38 . 2001-08-17 13:28 871,388 –a—— C:\WINDOWS\system32\dllcache\bcmdm.sys
2008-01-26 19:37 . 2004-08-04 00:56 870,784 –a—— C:\WINDOWS\system32\dllcache\ati3d1ag.dll
2008-01-26 19:36 . 2001-08-17 13:28 762,780 –a—— C:\WINDOWS\system32\dllcache\3cwmcru.sys
2008-01-26 19:35 . 2004-05-13 00:39 876,653 –a—— C:\WINDOWS\system32\dllcache\fp4awel.dll
2008-01-26 15:42 . 2008-01-27 16:25 d——– C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-01-26 10:47 . 2008-01-26 10:47 d——– C:\Program Files\Windows Desktop Search
2008-01-26 10:43 . 2007-07-30 19:19 271,224 –a—— C:\WINDOWS\system32\mucltui.dll
2008-01-26 10:43 . 2007-07-30 19:19 207,736 –a—— C:\WINDOWS\system32\muweb.dll
2008-01-26 10:43 . 2007-07-30 19:19 30,072 –a—— C:\WINDOWS\system32\mucltui.dll.mui
2008-01-26 10:27 . 2006-10-26 19:56 32,592 –a—— C:\WINDOWS\system32\msonpmon.dll
2008-01-26 10:24 . 2008-01-26 10:24 d——– C:\Program Files\Microsoft Works
2008-01-26 10:23 . 2008-01-26 10:23 d——– C:\Program Files\MSBuild
2008-01-26 10:21 . 2008-01-26 10:21 d——– C:\Program Files\Microsoft.NET
2008-01-26 10:12 . 2008-01-26 10:12 dr-h—– C:\MSOCache
2008-01-20 18:23 . 2008-01-22 05:41 1,358 –a—— C:\WINDOWS\system32\tmp.reg
2008-01-18 21:16 . 2008-01-25 18:28 d——– C:\Program Files\Opera
2008-01-15 21:13 . 2008-01-15 21:13 54,156 –ah—– C:\WINDOWS\QTFont.qfn
2008-01-15 21:13 . 2008-01-15 21:13 1,409 –a—— C:\WINDOWS\QTFont.for
2007-12-30 19:16 . 2007-12-30 19:16 d——– C:\Program Files\Free DVD Ripper
2007-12-30 19:16 . 2002-07-17 09:03 45,056 –a—— C:\WINDOWS\system32\WNASPI32.DLL
2007-12-30 19:16 . 2002-07-17 08:05 16,512 –a—— C:\WINDOWS\system32\drivers\ASPI32.SYS

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-28 18:26 283,124 –sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2008-01-28 18:26 20,975,392 –sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2008-01-27 21:57 5,863,936 —-a-w C:\WINDOWS\Internet Logs\xDBA.tmp
2008-01-27 21:50 28,013,001 —-a-w C:\WINDOWS\Internet Logs\tvDebug.zip
2008-01-27 21:49 5,863,936 —-a-w C:\WINDOWS\Internet Logs\xDB8.tmp
2008-01-27 21:37 87,040 —-a-w C:\WINDOWS\Internet Logs\xDB7.tmp
2008-01-27 21:37 5,863,936 —-a-w C:\WINDOWS\Internet Logs\xDB9.tmp
2008-01-27 21:26 5,864,960 —-a-w C:\WINDOWS\Internet Logs\xDB3.tmp
2008-01-27 18:52 77,312 —-a-w C:\WINDOWS\Internet Logs\xDB2.tmp
2008-01-27 18:52 5,857,280 —-a-w C:\WINDOWS\Internet Logs\xDB6.tmp
2008-01-27 17:45 150,016 —-a-w C:\WINDOWS\Internet Logs\xDB5.tmp
2008-01-27 16:31 5,849,088 —-a-w C:\WINDOWS\Internet Logs\xDB4.tmp
2008-01-27 15:02 ——— d—–w C:\Program Files\Dl_cats
2008-01-26 18:12 2,768,896 —-a-w C:\WINDOWS\Internet Logs\xDB1.tmp
2008-01-26 14:59 5,834,752 —-a-w C:\WINDOWS\Internet Logs\xDBD.tmp
2008-01-20 17:10 ——— d—–w C:\Program Files\Enigma Software Group
2008-01-20 10:18 ——— d—–w C:\Program Files\Apple Software Update
2008-01-16 18:30 ——— d—–w C:\Program Files\PC Tune-Up
2007-12-30 19:30 ——— d—–w C:\Program Files\DivX
2007-12-29 15:09 ——— d—–w C:\Program Files\Common Files\Synacast
2007-12-29 15:05 ——— d—–w C:\Program Files\PPLive
2007-12-11 19:46 524,288 —-a-w C:\WINDOWS\system32\DivXsm.exe
2007-12-11 19:46 3,596,288 —-a-w C:\WINDOWS\system32\qt-dx331.dll
2007-12-11 19:45 200,704 —-a-w C:\WINDOWS\system32\ssldivx.dll
2007-12-11 19:45 1,044,480 —-a-w C:\WINDOWS\system32\libdivx.dll
2007-12-11 19:44 823,296 —-a-w C:\WINDOWS\system32\divx_xx0c.dll
2007-12-11 19:44 823,296 —-a-w C:\WINDOWS\system32\divx_xx07.dll
2007-12-11 19:44 81,920 —-a-w C:\WINDOWS\system32\dpl100.dll
2007-12-11 19:44 802,816 —-a-w C:\WINDOWS\system32\divx_xx11.dll
2007-12-11 19:44 682,496 —-a-w C:\WINDOWS\system32\DivX.dll
2007-12-11 19:44 593,920 —-a-w C:\WINDOWS\system32\dpuGUI11.dll
2007-12-11 19:44 57,344 —-a-w C:\WINDOWS\system32\dpv11.dll
2007-12-11 19:44 53,248 —-a-w C:\WINDOWS\system32\dpuGUI10.dll
2007-12-11 19:44 344,064 —-a-w C:\WINDOWS\system32\dpus11.dll
2007-12-11 19:44 294,912 —-a-w C:\WINDOWS\system32\dpu11.dll
2007-12-11 19:44 294,912 —-a-w C:\WINDOWS\system32\dpu10.dll
2007-12-11 19:44 196,608 —-a-w C:\WINDOWS\system32\dtu100.dll
2007-12-11 19:44 156,992 —-a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2007-12-11 19:43 12,288 —-a-w C:\WINDOWS\system32\DivXWMPExtType.dll
2007-12-08 19:27 ——— d—–w C:\Program Files\DVDCoverPrint
2007-12-08 13:08 ——— d—–w C:\Program Files\Acoustica CD Label Maker
2007-12-05 20:39 ——— d—–w C:\Program Files\CheckPoint
2007-11-14 16:05 75,248 —-a-w C:\WINDOWS\zllsputility.exe
2007-11-14 16:05 1,086,952 —-a-w C:\WINDOWS\system32\zpeng24.dll
2007-11-08 19:03 512 —-a-w C:\ScanSectorLog.dat
2007-11-07 09:26 721,920 —-a-w C:\WINDOWS\system32\lsasrv.dll
2007-11-07 09:26 721,920 —-a-w C:\WINDOWS\system32\dllcache\lsasrv.dll
2007-10-30 23:42 3,590,656 —-a-w C:\WINDOWS\system32\dllcache\mshtml.dll
2007-10-30 17:20 360,064 —-a-w C:\WINDOWS\system32\dllcache\tcpip.sys
2007-10-29 22:43 1,287,680 —-a-w C:\WINDOWS\system32\quartz.dll
2007-10-29 22:43 1,287,680 —-a-w C:\WINDOWS\system32\dllcache\quartz.dll
2007-03-15 18:04 26,622,970 —-a-w C:\WINDOWS\Internet Logs\vsmon_on_demand_2007_03_14_18_05_40_full.dmp.zip
2006-05-25 05:56 80,132 —-a-w C:\WINDOWS\Internet Logs\vsmon_2nd_2006_05_25_00_42_13_small.dmp.zip
2006-05-22 16:23 23,882,343 —-a-w C:\WINDOWS\Internet Logs\vsmon_on_demand_2006_05_22_10_08_03_full.dmp.zip
2006-05-22 16:23 23,877,553 —-a-w C:\WINDOWS\Internet Logs\vsmon_on_demand_2006_05_22_10_07_55_full.dmp.zip
.

((((((((((((((((((((((((((((( snapshot@2008-01-27_22.05.18.21 )))))))))))))))))))))))))))))))))))))))))
.
+ 2000-08-31 08:00:00 163,328 —-a-w C:\WINDOWS\erdnt\Hiv-backup\ERDNT.EXE
+ 2008-01-28 18:23:00 733,184 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000001\NTUSER.DAT
+ 2008-01-28 18:23:00 512,000 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000002\UsrClass.dat
+ 2008-01-28 18:23:00 737,280 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000003\ntuser.dat
+ 2008-01-28 18:23:01 512,000 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000004\UsrClass.dat
+ 2008-01-28 18:23:01 6,598,656 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000005\ntuser.dat
+ 2008-01-28 18:23:01 1,347,584 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000006\UsrClass.dat
- 2008-01-27 21:52:33 778,188 —-a-w C:\WINDOWS\system32\ZoneLabs\avsys\bases\sfdb.dat
+ 2008-01-28 18:25:03 778,664 —-a-w C:\WINDOWS\system32\ZoneLabs\avsys\bases\sfdb.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= C:\Program Files\Winamp Toolbar\winamptb.dll [2007-10-04 20:06 1135968]

[HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 05:00 15360]
"MRC"="C:\Program Files\PC Tune-Up\PCTuneUp.exe" [2007-10-12 07:57 2435072]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-11-14 16:05 919016]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-01-26 08:02 579072]
"WinShrink"="\AutoJob.exe" [ ]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 05:00 15360]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-01-25 19:28 219136]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2004-08-04 05:00 53760 C:\WINDOWS\system32\narrator.exe]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Windows Desktop Search.lnk - C:\Program Files\Windows Desktop Search\WindowsSearch.exe [2007-02-05 15:40:46 118784]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{88485281-8b4b-4f8d-9ede-82e29a064277}"= C:\PROGRA~1\MarkAny\CONTEN~1\MACSMA~1.DLL [2004-11-23 15:51 192512]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll [2007-02-05 15:39 294400]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dla]
–a—— 2004-08-13 00:05 122939 C:\WINDOWS\system32\dla\tfswctrl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EverioService]
——— 2006-11-22 20:10 151552 C:\Program Files\CyberLink\PCM4Everio\EverioService.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
–a—— 2007-07-31 17:44 271672 C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MAAgent]
–a—— 2007-01-30 19:36 57344 C:\Program Files\MarkAny\ContentSafer\MAAgent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
–a—— 2007-06-29 05:24 286720 C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SMSTray]
–a—— 2007-02-23 15:32 126976 C:\Program Files\Samsung\Samsung Media Studio 5\SMSTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
–a—— 2007-03-14 02:43 83608 C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
–a—— 2005-12-18 14:26 180269 C:\Program Files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdateManager]
–a—— 2004-01-07 00:01 110592 C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe

S0 ntcdrdrv;ntcdrdrv;C:\WINDOWS\system32\DRIVERS\ntcdrdrv.sys []
S2 Ca536av;5.0M MPEG4 DV Video Capture;C:\WINDOWS\system32\Drivers\Ca536av.sys [2003-07-09 03:49]
S2 NkPtpEnumP2;NkPtpEnumP2;"C:\Program Files\Nikon\Wireless Camera Setup Utility\NkPtpEnum.exe" -a []
S3 ambitucm;Ambit USB Cable Modem NDIS Driver;C:\WINDOWS\system32\DRIVERS\ambitucm.sys [2001-11-12 05:40]
S3 ASPI;Advanced SCSI Programming Interface Driver;C:\WINDOWS\System32\DRIVERS\ASPI32.sys [2002-07-17 08:05]
S3 dlcd_device;dlcd_device;C:\WINDOWS\system32\dlcdcoms.exe [2005-06-21 08:19]
S3 DTV_Capture_2X0;DVB-T Receiver;C:\WINDOWS\system32\Drivers\DTV_Capture_2X0.sys [2004-09-06 13:40]
S3 DTV_Loader_2X1;DVB-T Loader;C:\WINDOWS\system32\Drivers\DTV_Loader_2X1.sys [2005-06-29 10:21]
S3 k600bus;Sony Ericsson 600i driver (WDM);C:\WINDOWS\system32\DRIVERS\k600bus.sys [2005-03-04 19:08]
S3 k600mdfl;Sony Ericsson 600i USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\k600mdfl.sys [2005-03-04 19:11]
S3 k600mdm;Sony Ericsson 600i USB WMC Modem Drivers;C:\WINDOWS\system32\DRIVERS\k600mdm.sys [2005-03-04 19:11]
S3 k600mgmt;Sony Ericsson 600i USB WMC Device Management Drivers;C:\WINDOWS\system32\DRIVERS\k600mgmt.sys [2005-03-04 19:13]
S3 k600obex;Sony Ericsson 600i USB WMC OBEX Interface Drivers;C:\WINDOWS\system32\DRIVERS\k600obex.sys [2005-03-04 19:15]
S3 ss_bus;SAMSUNG Mobile USB Device 1.0 driver (WDM);C:\WINDOWS\system32\DRIVERS\ss_bus.sys [2005-08-30 17:57]
S3 ss_mdfl;SAMSUNG Mobile USB Modem 1.0 Filter;C:\WINDOWS\system32\DRIVERS\ss_mdfl.sys [2005-08-30 17:58]
S3 ss_mdm;SAMSUNG Mobile USB Modem 1.0 Drivers;C:\WINDOWS\system32\DRIVERS\ss_mdm.sys [2005-08-30 17:59]
S3 USBCamera;5.0M MPEG4 DV Bulk Driver;C:\WINDOWS\system32\Drivers\Bulk536.sys [2003-05-14 09:28]
S3 VBus;Virtual Bus;C:\WINDOWS\system32\DRIVERS\NkVBus.sys [2005-06-17 11:11]

.
Contents of the 'Scheduled Tasks' folder
"2008-01-21 22:36:02 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-01-28 18:13:38 C:\WINDOWS\Tasks\User_Feed_Synchronization-{8ED3B4A8-B4E1-4007-B1F7-212178E5A582}.job"
- C:\WINDOWS\system32\msfeedssync.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-28 18:33:55
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-28 18:34:50
ComboFix-quarantined-files.txt 2008-01-28 18:34:41
ComboFix2.txt 2008-01-27 22:06:02
ComboFix3.txt 2008-01-25 22:47:26
.
2008-01-09 05:20:19 — E O F —


System performance funereal
Post #14
Open notepad and copy/paste the text in the quotebox below into it:

File::
C:\WINDOWS\system32\dllcache\OLD7D6.tmp
C:\WINDOWS\system32\dllcache\OLD7E1.tmp
C:\WINDOWS\system32\dllcache\OLD7DA.tmp
C:\WINDOWS\system32\dllcache\OLD7D2.tmp
C:\WINDOWS\system32\dllcache\OLD7DD.tmp
C:\WINDOWS\system32\dllcache\OLD7CE.tmp
C:\WINDOWS\system32\dllcache\OLDAED.tmp
C:\WINDOWS\system32\dllcache\OLDAF0.tmp
C:\WINDOWS\Internet Logs\xDBA.tmp
C:\WINDOWS\Internet Logs\xDB8.tmp
C:\WINDOWS\Internet Logs\xDB7.tmp
C:\WINDOWS\Internet Logs\xDB9.tmp
C:\WINDOWS\Internet Logs\xDB3.tmp
C:\WINDOWS\Internet Logs\xDB2.tmp
C:\WINDOWS\Internet Logs\xDB6.tmp
C:\WINDOWS\Internet Logs\xDB5.tmp
C:\WINDOWS\Internet Logs\xDB4.tmp
C:\WINDOWS\Internet Logs\xDB1.tmp
C:\WINDOWS\Internet Logs\xDBD.tmp

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WinShrink"=-


Save this as Save this as "CFScript"


[external image: Posted Image]

Refering to the picture above, drag CFScript.txt into ComboFix.exe

Then post the results log and a new HijackThis log.


Also please describe how your computer behaves at the moment.
Post #15
Logfile of HijackThis v1.99.1
Scan saved at 05:33:00, on 29/01/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\savedump.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Nikon\Wireless Camera Setup Utility\NkPtpEnum.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\dumprep.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Documents and Settings\chic\disaster recovery\HijackThis.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\WINDOWS\system32\wuauclt.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.celticfc.net/
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~4\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MRC] "C:\Program Files\PC Tune-Up\PCTuneUp.exe" /MBRSTART
O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 4.00\MediaManager\grab.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by116fd.bay116.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {AF2E62B6-F9E1-4D4F-A10A-9DC8E6DCBCC0} (VideoEgg ActiveX Loader) - http://update.videoegg.com/Install/Windows…ggPublisher.exe
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/…ro.cab56649.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://by110fd.bay110.hotmail.msn.com/activex/HMAtchmt.ocx
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~4\Office12\GR99D3~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: dlcd_device - Unknown owner - C:\WINDOWS\system32\dlcdcoms.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: NkPtpEnumP2 - Unknown owner - C:\Program Files\Nikon\Wireless Camera Setup Utility\NkPtpEnum.exe" -a -d="C:\Program Files\Nikon\Wireless Camera Setup Utility\NkPtpip.dll (file missing)
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
ComboFix 08-01-23.1C - chic 2008-01-29 5:17:41.9 - NTFSx86 MINIMAL
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.800 [GMT 0:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\chic\Desktop\CFScript.txt

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE
C:\WINDOWS\Internet Logs\xDB1.tmp
C:\WINDOWS\Internet Logs\xDB2.tmp
C:\WINDOWS\Internet Logs\xDB3.tmp
C:\WINDOWS\Internet Logs\xDB4.tmp
C:\WINDOWS\Internet Logs\xDB5.tmp
C:\WINDOWS\Internet Logs\xDB6.tmp
C:\WINDOWS\Internet Logs\xDB7.tmp
C:\WINDOWS\Internet Logs\xDB8.tmp
C:\WINDOWS\Internet Logs\xDB9.tmp
C:\WINDOWS\Internet Logs\xDBA.tmp
C:\WINDOWS\Internet Logs\xDBD.tmp
C:\WINDOWS\system32\dllcache\OLD7CE.tmp
C:\WINDOWS\system32\dllcache\OLD7D2.tmp
C:\WINDOWS\system32\dllcache\OLD7D6.tmp
C:\WINDOWS\system32\dllcache\OLD7DA.tmp
C:\WINDOWS\system32\dllcache\OLD7DD.tmp
C:\WINDOWS\system32\dllcache\OLD7E1.tmp
C:\WINDOWS\system32\dllcache\OLDAED.tmp
C:\WINDOWS\system32\dllcache\OLDAF0.tmp
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\Internet Logs\xDB1.tmp
C:\WINDOWS\Internet Logs\xDB2.tmp
C:\WINDOWS\Internet Logs\xDB3.tmp
C:\WINDOWS\Internet Logs\xDB4.tmp
C:\WINDOWS\Internet Logs\xDB5.tmp
C:\WINDOWS\Internet Logs\xDB6.tmp
C:\WINDOWS\Internet Logs\xDB7.tmp
C:\WINDOWS\Internet Logs\xDB8.tmp
C:\WINDOWS\Internet Logs\xDB9.tmp
C:\WINDOWS\Internet Logs\xDBA.tmp
C:\WINDOWS\Internet Logs\xDBD.tmp
C:\WINDOWS\system32\dllcache\OLD7CE.tmp
C:\WINDOWS\system32\dllcache\OLD7D2.tmp
C:\WINDOWS\system32\dllcache\OLD7D6.tmp
C:\WINDOWS\system32\dllcache\OLD7DA.tmp
C:\WINDOWS\system32\dllcache\OLD7DD.tmp
C:\WINDOWS\system32\dllcache\OLD7E1.tmp
C:\WINDOWS\system32\dllcache\OLDAED.tmp
C:\WINDOWS\system32\dllcache\OLDAF0.tmp

.
((((((((((((((((((((((((( Files Created from 2007-12-28 to 2008-01-29 )))))))))))))))))))))))))))))))
.

2008-01-27 21:22 . 2000-08-31 08:00 51,200 –a—— C:\WINDOWS\Nircmd.exe
2008-01-27 17:20 . 2008-01-27 17:20 d——– C:\Program Files\Malwarebytes' Anti-Malware
2008-01-26 20:02 . 2001-08-17 13:28 771,581 –a—— C:\WINDOWS\system32\dllcache\winacisa.sys
2008-01-26 20:01 . 2001-08-17 13:28 701,386 –a—— C:\WINDOWS\system32\dllcache\wdhaalba.sys
2008-01-26 20:00 . 2001-08-17 13:28 794,654 –a—— C:\WINDOWS\system32\dllcache\usr1801.sys
2008-01-26 19:59 . 2001-08-17 22:36 525,568 –a—— C:\WINDOWS\system32\dllcache\tridxp.dll
2008-01-26 19:58 . 2004-08-04 05:00 571,392 –a—— C:\WINDOWS\system32\dllcache\tintlgnt.ime
2008-01-26 19:57 . 2001-08-17 12:18 285,760 –a—— C:\WINDOWS\system32\dllcache\stlnata.sys
2008-01-26 19:56 . 2004-08-04 05:00 456,704 –a—— C:\WINDOWS\system32\dllcache\smtpsvc.dll
2008-01-26 19:55 . 2001-08-17 22:36 386,560 –a—— C:\WINDOWS\system32\dllcache\sgiul50.dll
2008-01-26 19:54 . 2001-08-17 22:36 495,616 –a—— C:\WINDOWS\system32\dllcache\sblfx.dll
2008-01-26 19:53 . 2001-08-17 13:28 899,146 –a—— C:\WINDOWS\system32\dllcache\r2mdkxga.sys
2008-01-26 19:52 . 2004-08-04 05:00 482,304 –a—— C:\WINDOWS\system32\dllcache\pintlgnt.ime
2008-01-26 19:51 . 2001-08-17 14:05 351,616 –a—— C:\WINDOWS\system32\dllcache\ovcodek2.sys
2008-01-26 19:50 . 2001-08-17 12:50 198,144 –a—— C:\WINDOWS\system32\dllcache\nv3.sys
2008-01-26 19:49 . 2004-08-04 00:56 1,737,856 –a—— C:\WINDOWS\system32\dllcache\mtxparhd.dll
2008-01-26 19:48 . 2004-08-04 05:00 1,875,968 –a—— C:\WINDOWS\system32\dllcache\msir3jp.lex
2008-01-26 19:47 . 2004-08-04 05:00 1,158,818 –a—— C:\WINDOWS\system32\dllcache\korwbrkr.lex
2008-01-26 19:46 . 2004-08-04 00:56 152,576 –a—— C:\WINDOWS\system32\dllcache\irftp.exe
2008-01-26 19:45 . 2004-08-04 05:00 13,463,552 –a—— C:\WINDOWS\system32\dllcache\hwxjpn.dll
2008-01-26 19:44 . 2004-08-03 22:41 1,041,536 –a—— C:\WINDOWS\system32\dllcache\hsfdpsp2.sys
2008-01-26 19:43 . 2001-08-17 14:56 1,733,120 –a—— C:\WINDOWS\system32\dllcache\g400d.dll
2008-01-26 19:42 . 2001-08-17 14:56 470,144 –a—— C:\WINDOWS\system32\dllcache\g200d.dll
2008-01-26 19:41 . 2001-08-17 13:28 634,134 –a—— C:\WINDOWS\system32\dllcache\el656ct5.sys
2008-01-26 19:40 . 2001-08-17 12:14 952,007 –a—— C:\WINDOWS\system32\dllcache\diwan.sys
2008-01-26 19:39 . 2004-08-04 05:00 1,677,824 –a—— C:\WINDOWS\system32\dllcache\chsbrkr.dll
2008-01-26 19:38 . 2001-08-17 13:28 871,388 –a—— C:\WINDOWS\system32\dllcache\bcmdm.sys
2008-01-26 19:37 . 2004-08-04 00:56 870,784 –a—— C:\WINDOWS\system32\dllcache\ati3d1ag.dll
2008-01-26 19:36 . 2001-08-17 13:28 762,780 –a—— C:\WINDOWS\system32\dllcache\3cwmcru.sys
2008-01-26 19:35 . 2004-05-13 00:39 876,653 –a—— C:\WINDOWS\system32\dllcache\fp4awel.dll
2008-01-26 15:42 . 2008-01-27 16:25 d——– C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-01-26 10:47 . 2008-01-26 10:47 d——– C:\Program Files\Windows Desktop Search
2008-01-26 10:43 . 2007-07-30 19:19 271,224 –a—— C:\WINDOWS\system32\mucltui.dll
2008-01-26 10:43 . 2007-07-30 19:19 207,736 –a—— C:\WINDOWS\system32\muweb.dll
2008-01-26 10:43 . 2007-07-30 19:19 30,072 –a—— C:\WINDOWS\system32\mucltui.dll.mui
2008-01-26 10:27 . 2006-10-26 19:56 32,592 –a—— C:\WINDOWS\system32\msonpmon.dll
2008-01-26 10:24 . 2008-01-26 10:24 d——– C:\Program Files\Microsoft Works
2008-01-26 10:23 . 2008-01-26 10:23 d——– C:\Program Files\MSBuild
2008-01-26 10:21 . 2008-01-26 10:21 d——– C:\Program Files\Microsoft.NET
2008-01-26 10:12 . 2008-01-26 10:12 dr-h—– C:\MSOCache
2008-01-20 18:23 . 2008-01-22 05:41 1,358 –a—— C:\WINDOWS\system32\tmp.reg
2008-01-18 21:16 . 2008-01-25 18:28 d——– C:\Program Files\Opera
2008-01-15 21:13 . 2008-01-15 21:13 54,156 –ah—– C:\WINDOWS\QTFont.qfn
2008-01-15 21:13 . 2008-01-15 21:13 1,409 –a—— C:\WINDOWS\QTFont.for
2007-12-30 19:16 . 2007-12-30 19:16 d——– C:\Program Files\Free DVD Ripper
2007-12-30 19:16 . 2002-07-17 09:03 45,056 –a—— C:\WINDOWS\system32\WNASPI32.DLL
2007-12-30 19:16 . 2002-07-17 08:05 16,512 –a—— C:\WINDOWS\system32\drivers\ASPI32.SYS

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-29 05:14 284,252 –sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2008-01-29 05:14 20,987,936 –sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2008-01-28 22:23 64,000 —-a-w C:\WINDOWS\Internet Logs\xDBE.tmp
2008-01-28 19:26 5,865,984 —-a-w C:\WINDOWS\Internet Logs\xDBC.tmp
2008-01-28 19:26 121,344 —-a-w C:\WINDOWS\Internet Logs\xDBB.tmp
2008-01-27 21:50 28,013,001 —-a-w C:\WINDOWS\Internet Logs\tvDebug.zip
2008-01-27 15:02 ——— d—–w C:\Program Files\Dl_cats
2008-01-20 17:10 ——— d—–w C:\Program Files\Enigma Software Group
2008-01-20 10:18 ——— d—–w C:\Program Files\Apple Software Update
2008-01-16 18:30 ——— d—–w C:\Program Files\PC Tune-Up
2007-12-30 19:30 ——— d—–w C:\Program Files\DivX
2007-12-29 15:09 ——— d—–w C:\Program Files\Common Files\Synacast
2007-12-29 15:05 ——— d—–w C:\Program Files\PPLive
2007-12-11 19:46 524,288 —-a-w C:\WINDOWS\system32\DivXsm.exe
2007-12-11 19:46 3,596,288 —-a-w C:\WINDOWS\system32\qt-dx331.dll
2007-12-11 19:45 200,704 —-a-w C:\WINDOWS\system32\ssldivx.dll
2007-12-11 19:45 1,044,480 —-a-w C:\WINDOWS\system32\libdivx.dll
2007-12-11 19:44 823,296 —-a-w C:\WINDOWS\system32\divx_xx0c.dll
2007-12-11 19:44 823,296 —-a-w C:\WINDOWS\system32\divx_xx07.dll
2007-12-11 19:44 81,920 —-a-w C:\WINDOWS\system32\dpl100.dll
2007-12-11 19:44 802,816 —-a-w C:\WINDOWS\system32\divx_xx11.dll
2007-12-11 19:44 682,496 —-a-w C:\WINDOWS\system32\DivX.dll
2007-12-11 19:44 593,920 —-a-w C:\WINDOWS\system32\dpuGUI11.dll
2007-12-11 19:44 57,344 —-a-w C:\WINDOWS\system32\dpv11.dll
2007-12-11 19:44 53,248 —-a-w C:\WINDOWS\system32\dpuGUI10.dll
2007-12-11 19:44 344,064 —-a-w C:\WINDOWS\system32\dpus11.dll
2007-12-11 19:44 294,912 —-a-w C:\WINDOWS\system32\dpu11.dll
2007-12-11 19:44 294,912 —-a-w C:\WINDOWS\system32\dpu10.dll
2007-12-11 19:44 196,608 —-a-w C:\WINDOWS\system32\dtu100.dll
2007-12-11 19:44 156,992 —-a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2007-12-11 19:43 12,288 —-a-w C:\WINDOWS\system32\DivXWMPExtType.dll
2007-12-08 19:27 ——— d—–w C:\Program Files\DVDCoverPrint
2007-12-08 13:08 ——— d—–w C:\Program Files\Acoustica CD Label Maker
2007-12-05 20:39 ——— d—–w C:\Program Files\CheckPoint
2007-11-14 16:05 75,248 —-a-w C:\WINDOWS\zllsputility.exe
2007-11-14 16:05 1,086,952 —-a-w C:\WINDOWS\system32\zpeng24.dll
2007-11-08 19:03 512 —-a-w C:\ScanSectorLog.dat
2007-11-07 09:26 721,920 —-a-w C:\WINDOWS\system32\lsasrv.dll
2007-11-07 09:26 721,920 —-a-w C:\WINDOWS\system32\dllcache\lsasrv.dll
2007-10-30 23:42 3,590,656 —-a-w C:\WINDOWS\system32\dllcache\mshtml.dll
2007-10-30 17:20 360,064 —-a-w C:\WINDOWS\system32\dllcache\tcpip.sys
2007-10-29 22:43 1,287,680 —-a-w C:\WINDOWS\system32\quartz.dll
2007-10-29 22:43 1,287,680 —-a-w C:\WINDOWS\system32\dllcache\quartz.dll
2007-03-15 18:04 26,622,970 —-a-w C:\WINDOWS\Internet Logs\vsmon_on_demand_2007_03_14_18_05_40_full.dmp.zip
2006-05-25 05:56 80,132 —-a-w C:\WINDOWS\Internet Logs\vsmon_2nd_2006_05_25_00_42_13_small.dmp.zip
2006-05-22 16:23 23,882,343 —-a-w C:\WINDOWS\Internet Logs\vsmon_on_demand_2006_05_22_10_08_03_full.dmp.zip
2006-05-22 16:23 23,877,553 —-a-w C:\WINDOWS\Internet Logs\vsmon_on_demand_2006_05_22_10_07_55_full.dmp.zip
.

((((((((((((((((((((((((((((( snapshot@2008-01-27_22.05.18.21 )))))))))))))))))))))))))))))))))))))))))
.
+ 2000-08-31 08:00:00 163,328 —-a-w C:\WINDOWS\erdnt\Hiv-backup\ERDNT.EXE
+ 2008-01-29 05:17:12 733,184 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000001\NTUSER.DAT
+ 2008-01-29 05:17:12 512,000 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000002\UsrClass.dat
+ 2008-01-29 05:17:14 6,598,656 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000003\ntuser.dat
+ 2008-01-29 05:17:15 1,347,584 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000004\UsrClass.dat
- 2008-01-27 21:52:33 778,188 —-a-w C:\WINDOWS\system32\ZoneLabs\avsys\bases\sfdb.dat
+ 2008-01-29 05:14:04 779,084 —-a-w C:\WINDOWS\system32\ZoneLabs\avsys\bases\sfdb.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= C:\Program Files\Winamp Toolbar\winamptb.dll [2007-10-04 20:06 1135968]

[HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 05:00 15360]
"MRC"="C:\Program Files\PC Tune-Up\PCTuneUp.exe" [2007-10-12 07:57 2435072]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-11-14 16:05 919016]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-01-26 08:02 579072]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 05:24 286720]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 05:00 15360]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-01-25 19:28 219136]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2004-08-04 05:00 53760 C:\WINDOWS\system32\narrator.exe]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Windows Desktop Search.lnk - C:\Program Files\Windows Desktop Search\WindowsSearch.exe [2007-02-05 15:40:46 118784]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{88485281-8b4b-4f8d-9ede-82e29a064277}"= C:\PROGRA~1\MarkAny\CONTEN~1\MACSMA~1.DLL [2004-11-23 15:51 192512]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll [2007-02-05 15:39 294400]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dla]
–a—— 2004-08-13 00:05 122939 C:\WINDOWS\system32\dla\tfswctrl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EverioService]
——— 2006-11-22 20:10 151552 C:\Program Files\CyberLink\PCM4Everio\EverioService.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
–a—— 2007-07-31 17:44 271672 C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MAAgent]
–a—— 2007-01-30 19:36 57344 C:\Program Files\MarkAny\ContentSafer\MAAgent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
–a—— 2007-06-29 05:24 286720 C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SMSTray]
–a—— 2007-02-23 15:32 126976 C:\Program Files\Samsung\Samsung Media Studio 5\SMSTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
–a—— 2007-03-14 02:43 83608 C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
–a—— 2005-12-18 14:26 180269 C:\Program Files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdateManager]
–a—— 2004-01-07 00:01 110592 C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe

S0 ntcdrdrv;ntcdrdrv;C:\WINDOWS\system32\DRIVERS\ntcdrdrv.sys []
S2 Ca536av;5.0M MPEG4 DV Video Capture;C:\WINDOWS\system32\Drivers\Ca536av.sys [2003-07-09 03:49]
S2 NkPtpEnumP2;NkPtpEnumP2;"C:\Program Files\Nikon\Wireless Camera Setup Utility\NkPtpEnum.exe" -a []
S3 ambitucm;Ambit USB Cable Modem NDIS Driver;C:\WINDOWS\system32\DRIVERS\ambitucm.sys [2001-11-12 05:40]
S3 ASPI;Advanced SCSI Programming Interface Driver;C:\WINDOWS\System32\DRIVERS\ASPI32.sys [2002-07-17 08:05]
S3 dlcd_device;dlcd_device;C:\WINDOWS\system32\dlcdcoms.exe [2005-06-21 08:19]
S3 DTV_Capture_2X0;DVB-T Receiver;C:\WINDOWS\system32\Drivers\DTV_Capture_2X0.sys [2004-09-06 13:40]
S3 DTV_Loader_2X1;DVB-T Loader;C:\WINDOWS\system32\Drivers\DTV_Loader_2X1.sys [2005-06-29 10:21]
S3 k600bus;Sony Ericsson 600i driver (WDM);C:\WINDOWS\system32\DRIVERS\k600bus.sys [2005-03-04 19:08]
S3 k600mdfl;Sony Ericsson 600i USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\k600mdfl.sys [2005-03-04 19:11]
S3 k600mdm;Sony Ericsson 600i USB WMC Modem Drivers;C:\WINDOWS\system32\DRIVERS\k600mdm.sys [2005-03-04 19:11]
S3 k600mgmt;Sony Ericsson 600i USB WMC Device Management Drivers;C:\WINDOWS\system32\DRIVERS\k600mgmt.sys [2005-03-04 19:13]
S3 k600obex;Sony Ericsson 600i USB WMC OBEX Interface Drivers;C:\WINDOWS\system32\DRIVERS\k600obex.sys [2005-03-04 19:15]
S3 ss_bus;SAMSUNG Mobile USB Device 1.0 driver (WDM);C:\WINDOWS\system32\DRIVERS\ss_bus.sys [2005-08-30 17:57]
S3 ss_mdfl;SAMSUNG Mobile USB Modem 1.0 Filter;C:\WINDOWS\system32\DRIVERS\ss_mdfl.sys [2005-08-30 17:58]
S3 ss_mdm;SAMSUNG Mobile USB Modem 1.0 Drivers;C:\WINDOWS\system32\DRIVERS\ss_mdm.sys [2005-08-30 17:59]
S3 USBCamera;5.0M MPEG4 DV Bulk Driver;C:\WINDOWS\system32\Drivers\Bulk536.sys [2003-05-14 09:28]
S3 VBus;Virtual Bus;C:\WINDOWS\system32\DRIVERS\NkVBus.sys [2005-06-17 11:11]

.
Contents of the 'Scheduled Tasks' folder
"2008-01-21 22:36:02 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-01-29 05:10:58 C:\WINDOWS\Tasks\User_Feed_Synchronization-{8ED3B4A8-B4E1-4007-B1F7-212178E5A582}.job"
- C:\WINDOWS\system32\msfeedssync.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-29 05:21:22
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-29 5:22:10
ComboFix-quarantined-files.txt 2008-01-29 05:22:02
ComboFix2.txt 2008-01-28 18:34:51
ComboFix3.txt 2008-01-27 22:06:02
ComboFix4.txt 2008-01-25 22:47:26
.
2008-01-09 05:20:19 — E O F —

5 mins between crashes - everything very slow.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI