Spyware / Malware / Virus Removal

[Resolved] My HJT Log

11 min read

Looking for the outcome? Ask AI

bOuT2JuMpOfF Topic Starter

Post #1January 31, 2008, 3:18 PM UTC

Computer Sluggish and Hangs. Ran Spybot. AVG Spyware Remover. Thanks in advance for the consideration.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:12:13 AM, on 1/31/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16575)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
c:\PROGRA~1\mcafee\VIRUSS~1\mcvsshld.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\System32\WLTRAY.EXE
C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Dell Support Center\bin\sprtcmd.exe
C:\Program Files\DVDneXtCOPY Virtual Drive\DVDneXtCOPY.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\AOL 9.1\waol.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Dell Support Center\gs_agent\dsc.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer provided by Dell
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: CDNSCacheObj Object - {376892AE-1825-4E5F-9F85-23F9640051CC} - C:\Windows\xmljacodec.dll (file missing)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\PROGRA~1\mcafee\VIRUSS~1\scriptcl.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\Windows\system32\WLTRAY.exe
O4 - HKLM\..\Run: [PDVDDXSrv] "C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - HKCU\..\Run: [DVDneXtCOPY] C:\Program Files\DVDneXtCOPY Virtual Drive\DVDneXtCOPY.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [AOL Fast Start] "C:\Program Files\AOL 9.1\AOL.EXE" -b
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O13 - Gopher Prefix:
O16 - DPF: {49312E18-AA92-4CC2-BB97-55DEA7BCADD6} (WMI Class) - http://support.dell.com/systemprofiler/SysProExe.CAB
O16 - DPF: {549F957E-2F89-11D6-8CFE-00C04F52B225} (CMV5 Class) - http://coupons.smartsource.com/download/cscmv5X.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: BugSoft AnyTrial (AnyTrial) - Dr.Pc Putte Corp

- C:\Windows\AnyTrial.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: DVDneXtCOPYService - DVD neXt COPY - C:\Program Files\DVDneXtCOPY Virtual Drive\DVDneXtCOPYService.exe
O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Advanced Networking Service (hnmsvc) - SingleClick Systems - C:\Program Files\Dell Network Assistant\hnm_svc.exe
O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe
O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\Windows\system32\STacSV.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\Windows\System32\WLTRYSVC.EXE
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

–
End of file - 9301 bytes

LDTate

Post #2February 7, 2008, 9:44 PM UTC

Download ComboFix from Here to your Desktop.

**Note: In the event you already have Combofix, please delete it from your desktop and download this new version . It is important that it is saved directly to your desktop**
——————————————————————–

Close any open browsers and make sure you are disconnected from the net. Unplug the cable if need be before running combofix.
WARNING: IF you have not already done so Combofix will disconnect your machine from the Internet when it starts
Please do not re-connect your machine back to the Internet until Combofix has completely finished.

——————————————————————–

Double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.
Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review

****Note: Do not mouseclick combofix's window while it's running. That may cause it to stall or freeze ****

*If there is no internet connection when Combofix has completely finished then restart your computer to restore back the connections.

bOuT2JuMpOfF

Post #3February 8, 2008, 3:50 PM UTC

Thanks so much for trying to help me with this!

ComboFix 08-01-30.1 - Rich 2008-02-08 10:10:43.1 - NTFSx86
Microsoft® Windows Vista™ Home Basic 6.0.6000.0.1252.1.1033.18.896 [GMT -5:00]
Running from: C:\Users\[removed]\Desktop\Combo-Fix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Users\Rich\AppData\Roaming\inst.exe

.
((((((((((((((((((((((((( Files Created from 2008-01-08 to 2008-02-08 )))))))))))))))))))))))))))))))
.

2008-02-04 07:15 . 2008-02-04 07:18 d——– C:\Users\All Users\Kaspersky Lab
2008-02-04 07:15 . 2008-02-04 07:18 d——– C:\ProgramData\Kaspersky Lab
2008-02-04 07:15 . 2008-02-04 07:15 d——– C:\Program Files\Kaspersky Lab
2008-02-04 07:14 . 2008-02-04 07:14 d——– C:\KAV
2008-02-03 10:24 . 2008-02-03 10:24 d——– C:\Program Files\Lavasoft
2008-02-03 10:23 . 2008-02-03 10:23 d——– C:\Program Files\Common Files\Wise Installation Wizard
2008-02-02 19:07 . 2008-02-02 19:09 d——– C:\Windows\System32\SmitfraudFix
2008-02-02 11:04 . 2008-02-02 18:59 38 –a—— C:\Windows\avisplitter.INI
2008-02-02 09:19 . 2008-02-07 08:00 d——– C:\Users\Rich\AppData\Roaming\AVG7
2008-02-02 09:19 . 2008-02-02 09:19 9,216 –a—— C:\Windows\System32\avgwlntf.dll
2008-02-02 09:18 . 2008-02-02 09:23 d——– C:\Users\All Users\avg7
2008-02-02 09:18 . 2008-02-02 09:23 d——– C:\ProgramData\avg7
2008-02-02 08:56 . 2008-02-02 08:56 250 –a—— C:\Windows\gmer.ini
2008-01-31 10:10 . 2008-01-31 10:10 d——– C:\Program Files\Trend Micro
2008-01-31 09:30 . 2008-01-31 09:30 d——– C:\Users\Rich\AppData\Roaming\Grisoft
2008-01-31 09:30 . 2008-02-02 09:18 d——– C:\Users\All Users\Grisoft
2008-01-31 09:30 . 2008-02-02 09:18 d——– C:\ProgramData\Grisoft
2008-01-31 09:30 . 2007-05-30 07:10 10,872 –a—— C:\Windows\System32\drivers\AvgAsCln.sys
2008-01-30 23:59 . 2008-01-31 00:04 d——– C:\Users\All Users\Spybot - Search & Destroy
2008-01-30 23:59 . 2008-01-31 00:04 d——– C:\ProgramData\Spybot - Search & Destroy
2008-01-30 22:55 . 2008-02-03 10:24 d——– C:\Users\All Users\Lavasoft
2008-01-30 22:55 . 2008-02-03 10:24 d——– C:\ProgramData\Lavasoft
2008-01-30 18:47 . 2008-01-30 18:47 d——– C:\Program Files\Enigma Software Group
2008-01-27 22:59 . 2008-01-27 22:59 d——– C:\Program Files\Motorola
2008-01-27 22:32 . 2008-01-27 22:32 25,600 –a—— C:\Users\Rich\usbsermptxp.sys
2008-01-27 22:32 . 2008-01-27 22:32 22,768 –a—— C:\Users\Rich\usbsermpt.sys
2008-01-27 21:32 . 2008-01-27 21:32 d——– C:\Program Files\GoldWave
2008-01-27 20:41 . 2008-01-27 20:41 d——– C:\Program Files\LiveUpdate
2008-01-27 20:40 . 2008-01-27 20:43 d——– C:\Users\All Users\BVRP Software
2008-01-27 20:40 . 2008-01-27 20:43 d——– C:\ProgramData\BVRP Software
2008-01-27 20:40 . 2008-01-27 20:40 d——– C:\Program Files\mobile PhoneTools
2008-01-27 17:16 . 2008-01-27 17:16 0 –ah—– C:\Windows\System32\drivers\Msft_Kernel_motmodem_01005.Wdf
2008-01-27 17:12 . 2008-01-27 17:12 d——– C:\Program Files\Common Files\Motorola Shared
2008-01-27 14:13 . 2008-01-27 14:13 d——– C:\Program Files\BitPim
2008-01-27 10:49 . 2007-08-12 13:07 516,096 –a—— C:\Windows\system\lame_enc.dll
2008-01-18 15:03 . 2008-01-31 00:49 d——– C:\Program Files\Common Files\Symantec Shared
2008-01-18 15:01 . 2008-01-25 19:24 d——– C:\Users\All Users\Symantec
2008-01-18 15:01 . 2008-01-25 19:24 d——– C:\ProgramData\Symantec
2008-01-14 07:22 . 2008-01-14 07:29 d——– C:\Users\Rich\AppData\Roaming\Vso
2008-01-14 07:22 . 2008-01-14 07:22 47,360 –a—— C:\Windows\System32\drivers\pcouffin.sys
2008-01-14 07:22 . 2008-01-14 07:29 47,360 –a—— C:\Users\Rich\AppData\Roaming\pcouffin.sys
2008-01-11 20:24 . 2008-01-11 20:25 354 –ah—– C:\IPH.PH
2008-01-09 03:04 . 2008-01-09 03:04 802,816 –a—— C:\Windows\System32\drivers\tcpip.sys
2008-01-09 03:04 . 2008-01-09 03:04 216,760 –a—— C:\Windows\System32\drivers\netio.sys
2008-01-09 03:04 . 2008-01-09 03:04 167,424 –a—— C:\Windows\System32\tcpipcfg.dll
2008-01-09 03:04 . 2008-01-09 03:04 24,064 –a—— C:\Windows\System32\netcfg.exe
2008-01-09 03:04 . 2008-01-09 03:04 22,016 –a—— C:\Windows\System32\netiougc.exe
2008-01-09 03:02 . 2008-01-09 03:02 4,247,552 –a—— C:\Windows\System32\GameUXLegacyGDFs.dll
2008-01-09 03:02 . 2008-01-09 03:02 1,686,016 –a—— C:\Windows\System32\gameux.dll
2008-01-09 03:02 . 2008-01-09 03:02 1,060,920 –a—— C:\Windows\System32\drivers\ntfs.sys
2008-01-09 03:02 . 2008-01-09 03:02 211,000 –a—— C:\Windows\System32\drivers\volsnap.sys
2008-01-09 03:02 . 2008-01-09 03:02 154,624 –a—— C:\Windows\System32\drivers\nwifi.sys
2008-01-09 03:02 . 2008-01-09 03:02 110,136 –a—— C:\Windows\System32\drivers\ataport.sys
2008-01-09 03:02 . 2008-01-09 03:02 45,112 –a—— C:\Windows\System32\drivers\pciidex.sys
2008-01-09 03:02 . 2008-01-09 03:02 21,560 –a—— C:\Windows\System32\drivers\atapi.sys
2008-01-09 03:02 . 2008-01-09 03:02 15,928 –a—— C:\Windows\System32\drivers\pciide.sys
2008-01-09 03:01 . 2008-01-09 03:01 11,776 –a—— C:\Windows\System32\sbunattend.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-02 05:55 83,456 —-a-w C:\Windows\System32\VACFix.exe
2008-01-28 01:41 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-01-27 19:37 81,920 —-a-w C:\Windows\System32\IEDFix.exe
2008-01-22 13:56 ——— d—–w C:\Program Files\DVDneXtCOPY2
2008-01-18 10:49 ——— d—–w C:\Program Files\McAfee
2008-01-09 08:12 ——— d—–w C:\Program Files\Windows Mail
2008-01-09 08:02 537,600 —-a-w C:\Windows\AppPatch\AcLayers.dll
2008-01-09 08:02 449,024 —-a-w C:\Windows\AppPatch\AcSpecfc.dll
2008-01-09 08:02 2,143,744 —-a-w C:\Windows\AppPatch\AcGenral.dll
2008-01-09 08:02 173,056 —-a-w C:\Windows\AppPatch\AcXtrnal.dll
2008-01-09 08:01 ——— d—–w C:\Program Files\Windows Sidebar
2008-01-04 06:16 ——— d—–w C:\Program Files\SlySoft
2008-01-01 20:07 ——— d—–w C:\Users\Rich\AppData\Roaming\UseNeXT
2007-12-30 05:43 ——— d—–w C:\Program Files\Ligos
2007-12-30 05:33 ——— d—–w C:\Users\Rich\AppData\Roaming\vlc
2007-12-30 05:33 ——— d—–w C:\Program Files\GSpot
2007-12-30 05:26 ——— d—–w C:\Program Files\VideoLAN
2007-12-30 01:10 ——— d—–w C:\Program Files\UseNeXT
2007-12-27 02:29 ——— d—–w C:\Program Files\AVI Movie Player
2007-12-27 02:24 ——— d—–w C:\Users\Rich\AppData\Roaming\Media Player Classic
2007-12-27 02:23 ——— d—–w C:\Program Files\K-Lite Codec Pack
2007-12-24 19:11 ——— d—–w C:\ProgramData\SlySoft
2007-12-24 14:52 ——— d—–w C:\Program Files\Audacity
2007-12-23 13:56 ——— d—–w C:\Program Files\DivX
2007-12-23 06:08 ——— d—–w C:\Program Files\PokerStars
2007-12-21 05:51 ——— d—–w C:\Program Files\CyberLink
2007-12-17 13:33 15,872 –sha-w C:\Windows\AnyTrial.exe
2007-12-14 16:32 12,632 —-a-w C:\Windows\System32\lsdelete.exe
2007-12-12 08:04 9,728 —-a-w C:\Windows\System32\LAPRXY.DLL
2007-12-12 08:04 223,232 —-a-w C:\Windows\System32\WMASF.DLL
2007-12-12 08:04 1,327,104 —-a-w C:\Windows\System32\quartz.dll
2007-12-12 08:03 824,832 —-a-w C:\Windows\System32\wininet.dll
2007-12-12 08:03 56,320 —-a-w C:\Windows\System32\iesetup.dll
2007-12-12 08:03 52,736 —-a-w C:\Windows\AppPatch\iebrshim.dll
2007-12-12 08:03 26,624 —-a-w C:\Windows\System32\ieUnatt.exe
2007-12-12 08:02 84,992 —-a-w C:\Windows\system32\drivers\srvnet.sys
2007-12-12 08:02 58,368 —-a-w C:\Windows\system32\drivers\mrxsmb20.sys
2007-12-12 08:02 130,048 —-a-w C:\Windows\system32\drivers\srv2.sys
2007-12-12 08:02 101,888 —-a-w C:\Windows\system32\drivers\mrxsmb.sys
2007-12-12 08:01 3,504,824 —-a-w C:\Windows\System32\ntkrnlpa.exe
2007-12-12 08:01 3,470,520 —-a-w C:\Windows\System32\ntoskrnl.exe
2007-12-11 19:46 524,288 —-a-w C:\Windows\System32\DivXsm.exe
2007-12-11 19:46 3,596,288 —-a-w C:\Windows\System32\qt-dx331.dll
2007-12-11 19:45 200,704 —-a-w C:\Windows\System32\ssldivx.dll
2007-12-11 19:45 1,044,480 —-a-w C:\Windows\System32\libdivx.dll
2007-12-11 19:44 823,296 —-a-w C:\Windows\System32\divx_xx0c.dll
2007-12-11 19:44 823,296 —-a-w C:\Windows\System32\divx_xx07.dll
2007-12-11 19:44 81,920 —-a-w C:\Windows\System32\dpl100.dll
2007-12-11 19:44 802,816 —-a-w C:\Windows\System32\divx_xx11.dll
2007-12-11 19:44 593,920 —-a-w C:\Windows\System32\dpuGUI11.dll
2007-12-11 19:44 57,344 —-a-w C:\Windows\System32\dpv11.dll
2007-12-11 19:44 53,248 —-a-w C:\Windows\System32\dpuGUI10.dll
2007-12-11 19:44 344,064 —-a-w C:\Windows\System32\dpus11.dll
2007-12-11 19:44 294,912 —-a-w C:\Windows\System32\dpu11.dll
2007-12-11 19:44 294,912 —-a-w C:\Windows\System32\dpu10.dll
2007-12-11 19:44 196,608 —-a-w C:\Windows\System32\dtu100.dll
2007-12-11 19:44 156,992 —-a-w C:\Windows\System32\DivXCodecVersionChecker.exe
2007-12-11 19:43 12,288 —-a-w C:\Windows\System32\DivXWMPExtType.dll
2007-12-09 11:46 ——— d—a-w C:\ProgramData\TEMP
2007-12-07 23:28 7,680 —-a-w C:\Windows\System32\ff_vfw.dll
2007-11-22 08:01 8,704 —-a-w C:\Windows\System32\hcrstco.dll
2007-11-22 08:01 8,704 —-a-w C:\Windows\System32\hccoin.dll
2007-11-19 08:03 704,000 —-a-w C:\Windows\System32\PhotoScreensaver.scr
2007-11-19 08:03 542,720 —-a-w C:\Windows\System32\sysmain.dll
2007-11-19 08:03 24,064 —-a-w C:\Windows\System32\wtsapi32.dll
2007-11-19 08:03 2,923,520 —-a-w C:\Windows\explorer.exe
2007-11-19 08:03 2,027,008 —-a-w C:\Windows\System32\win32k.sys
2007-11-19 08:02 67,584 —-a-w C:\Windows\System32\wlanhlp.dll
2007-11-19 08:02 502,784 —-a-w C:\Windows\System32\wlansvc.dll
2007-11-19 08:02 47,104 —-a-w C:\Windows\System32\wlanapi.dll
2007-11-19 08:02 297,984 —-a-w C:\Windows\System32\wlansec.dll
2007-11-19 08:02 290,816 —-a-w C:\Windows\System32\wlanmsm.dll
2007-10-13 07:10 174 –sha-w C:\Program Files\desktop.ini
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{376892AE-1825-4E5F-9F85-23F9640051CC}]
C:\Windows\xmljacodec.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DellSupportCenter"="C:\Program Files\Dell Support Center\bin\sprtcmd.exe" [2007-10-09 17:56 202544]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 07:34 201728]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488]
"AOL Fast Start"="C:\Program Files\AOL 9.1\AOL.exe" [2007-10-27 12:44 50528]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2007-10-03 15:09 1006264]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2007-05-24 00:09 857648]
"Broadcom Wireless Manager UI"="C:\Windows\system32\WLTRAY.exe" [2007-03-21 10:34 1548288]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 04:25 6731312]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-02-02 09:21 579072]
"PDVDDXSrv"="C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2007-06-08 18:40 128560]
"AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 SOS\avp.exe" [2007-11-19 14:40 231952]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-02-02 09:18 219136]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgwlntf]
avgwlntf.dll 2008-02-02 09:19 9216 C:\Windows\System32\avgwlntf.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
"LoadAppInit_DLLs"=1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"DVDneXtCOPY"=C:\Program Files\DVDneXtCOPY Virtual Drive\DVDneXtCOPY.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"BugSoft AnyTrial"=C:\Users\Rich\Documents\BitLord\Downloads\AnyDVD & AnyDVD HD 6.3.0.1 Beta\AnyTrialControl.exe

R0 AtiPcie;ATI PCI Express (3GIO) Filter;C:\Windows\system32\DRIVERS\AtiPcie.sys [2006-10-30 10:23]
R2 AnyTrial;BugSoft AnyTrial;C:\Windows\AnyTrial.exe [2007-12-17 08:33]
R2 DVDneXtCOPYService;DVDneXtCOPYService;"C:\Program Files\DVDneXtCOPY Virtual Drive\DVDneXtCOPYService.exe" [2007-03-19 11:17]
R2 HPSLPSVC;HP Network Devices Support;C:\Windows\system32\svchost.exe [2006-11-02 04:45]
R2 SBSDWSCService;SBSD Security Center Service;C:\Program Files\Spybot []
R2 sprtsvc_dellsupportcenter;SupportSoft Sprocket Service (dellsupportcenter);C:\Program Files\Dell Support Center\bin\sprtsvc.exe /service []
R2 XAudio;XAudio;C:\Windows\system32\DRIVERS\xaudio.sys [2007-04-29 00:24]
R3 atikmdag;atikmdag;C:\Windows\system32\DRIVERS\atikmdag.sys [2007-05-25 00:05]
R3 DVDneXtCOPY;DVDneXtCOPY;C:\Windows\system32\DRIVERS\DVDneXtCOPY.sys [2007-03-19 11:27]
S3 R300;R300;C:\Windows\system32\DRIVERS\atikmdag.sys [2007-05-25 00:05]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
HPService REG_MULTI_SZ HPSLPSVC
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

.
Contents of the 'Scheduled Tasks' folder
"2008-01-15 07:20:42 C:\Windows\Tasks\McDefragTask.job"
- c:\PROGRA~1\mcafee\mqc\QcConsol.exe'
"2008-01-01 06:00:15 C:\Windows\Tasks\McQcTask.job"
- c:\PROGRA~1\mcafee\mqc\QcConsol.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-08 10:13:33
Windows 6.0.6000 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-02-08 10:14:40
ComboFix-quarantined-files.txt 2008-02-08 15:14:36
.
2008-02-05 22:19:47 — E O F — Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:20:38 AM, on 2/8/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16575)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Program Files\Windows Defender\MSASCui.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\System32\WLTRAY.EXE
C:\Program Files\Grisoft\AVG7\avgcc.exe
C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe
C:\Program Files\Dell Support Center\bin\sprtcmd.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Common Files\aol\1192256479\ee\aolsoftware.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 SOS\avp.exe
c:\PROGRA~1\mcafee\VIRUSS~1\mcvsshld.exe
C:\Program Files\AOL 9.1\waol.exe
C:\Program Files\AOL 9.1\shellmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Windows\explorer.exe
C:\Windows\system32\notepad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: CDNSCacheObj Object - {376892AE-1825-4E5F-9F85-23F9640051CC} - C:\Windows\xmljacodec.dll (file missing)
O2 - BHO: Spybot-S&D; IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\PROGRA~1\mcafee\VIRUSS~1\scriptcl.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll
O3 - Toolbar: &Google; - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\Windows\system32\WLTRAY.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [PDVDDXSrv] "C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe"
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 SOS\avp.exe"
O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [AOL Fast Start] "C:\Program Files\AOL 9.1\AOL.EXE" -b
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-21-171449339-1904340565-232687155-1002\..\Run: [EasyLinkAdvisor] "C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe" /startup (User 'R yan')
O4 - HKUS\S-1-5-21-171449339-1904340565-232687155-1003\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup (User 'Nella')
O4 - HKUS\S-1-5-21-171449339-1904340565-232687155-1004\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'Alex')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O13 - Gopher Prefix:
O16 - DPF: {49312E18-AA92-4CC2-BB97-55DEA7BCADD6} (WMI Class) - http://support.dell.com/systemprofiler/SysProExe.CAB
O16 - DPF: {549F957E-2F89-11D6-8CFE-00C04F52B225} (CMV5 Class) - http://coupons.smartsource.com/download/cscmv5X.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
O20 - Winlogon Notify: avgwlntf - C:\Windows\SYSTEM32\avgwlntf.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: BugSoft AnyTrial (AnyTrial) - Dr.Pc Putte Corp

- C:\Windows\AnyTrial.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG7 Resident Shield Service (AvgCoreSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe
O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 SOS\avp.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: DVDneXtCOPYService - DVD neXt COPY - C:\Program Files\DVDneXtCOPY Virtual Drive\DVDneXtCOPYService.exe
O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Advanced Networking Service (hnmsvc) - SingleClick Systems - C:\Program Files\Dell Network Assistant\hnm_svc.exe
O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe
O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\Windows\system32\STacSV.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\Windows\System32\WLTRYSVC.EXE
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

–
End of file - 9536 bytes

LDTate

Post #4February 8, 2008, 9:56 PM UTC

Open notepad and copy/paste the text in the Codebox below into it:

File::
C:\Windows\xmljacodec.dll

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{376892AE-1825-4E5F-9F85-23F9640051CC}]

Save this as Save this as "CFScript"

[external image: Posted Image]

Refering to the picture above, drag CFScript.txt into ComboFix.exe

Then post the results log and a new HijackThis log.

Also please describe how your computer behaves at the moment.

bOuT2JuMpOfF

Post #5February 8, 2008, 11:32 PM UTC

Thanks again for you continued help. I wanted to get these posted right away and then I will reboot and add a post regarding how the computer is behaving. Thanks

ComboFix 08-01-30.1 - Rich 2008-02-08 18:20:45.2 - NTFSx86
Microsoft® Windows Vista™ Home Basic 6.0.6000.0.1252.1.1033.18.905 [GMT -5:00]
Running from: C:\Users\[removed]\Desktop\Combo-Fix.exe
Command switches used :: C:\Users\Rich\Desktop\CFScript.txt
* Created a new restore point

FILE
C:\Windows\xmljacodec.dll
.

((((((((((((((((((((((((( Files Created from 2008-01-08 to 2008-02-08 )))))))))))))))))))))))))))))))
.

2008-02-08 10:31 . 2008-02-08 10:34 194,906,415 –a—— C:\Windows\MEMORY.DMP
2008-02-04 07:15 . 2008-02-08 10:37 d——– C:\Users\All Users\Kaspersky Lab
2008-02-04 07:15 . 2008-02-08 10:37 d——– C:\ProgramData\Kaspersky Lab
2008-02-04 07:15 . 2008-02-04 07:15 d——– C:\Program Files\Kaspersky Lab
2008-02-04 07:14 . 2008-02-04 07:14 d——– C:\KAV
2008-02-03 10:24 . 2008-02-03 10:24 d——– C:\Program Files\Lavasoft
2008-02-03 10:23 . 2008-02-03 10:23 d——– C:\Program Files\Common Files\Wise Installation Wizard
2008-02-02 19:07 . 2008-02-02 19:09 d——– C:\Windows\System32\SmitfraudFix
2008-02-02 11:04 . 2008-02-02 18:59 38 –a—— C:\Windows\avisplitter.INI
2008-02-02 09:19 . 2008-02-08 10:37 d——– C:\Users\Rich\AppData\Roaming\AVG7
2008-02-02 09:19 . 2008-02-02 09:19 9,216 –a—— C:\Windows\System32\avgwlntf.dll
2008-02-02 09:18 . 2008-02-02 09:23 d——– C:\Users\All Users\avg7
2008-02-02 09:18 . 2008-02-02 09:23 d——– C:\ProgramData\avg7
2008-02-02 08:56 . 2008-02-02 08:56 250 –a—— C:\Windows\gmer.ini
2008-01-31 10:10 . 2008-01-31 10:10 d——– C:\Program Files\Trend Micro
2008-01-31 09:30 . 2008-01-31 09:30 d——– C:\Users\Rich\AppData\Roaming\Grisoft
2008-01-31 09:30 . 2008-02-02 09:18 d——– C:\Users\All Users\Grisoft
2008-01-31 09:30 . 2008-02-02 09:18 d——– C:\ProgramData\Grisoft
2008-01-31 09:30 . 2007-05-30 07:10 10,872 –a—— C:\Windows\System32\drivers\AvgAsCln.sys
2008-01-30 23:59 . 2008-01-31 00:04 d——– C:\Users\All Users\Spybot - Search & Destroy
2008-01-30 23:59 . 2008-01-31 00:04 d——– C:\ProgramData\Spybot - Search & Destroy
2008-01-30 22:55 . 2008-02-03 10:24 d——– C:\Users\All Users\Lavasoft
2008-01-30 22:55 . 2008-02-03 10:24 d——– C:\ProgramData\Lavasoft
2008-01-30 18:47 . 2008-01-30 18:47 d——– C:\Program Files\Enigma Software Group
2008-01-27 22:59 . 2008-01-27 22:59 d——– C:\Program Files\Motorola
2008-01-27 22:32 . 2008-01-27 22:32 25,600 –a—— C:\Users\Rich\usbsermptxp.sys
2008-01-27 22:32 . 2008-01-27 22:32 22,768 –a—— C:\Users\Rich\usbsermpt.sys
2008-01-27 21:32 . 2008-01-27 21:32 d——– C:\Program Files\GoldWave
2008-01-27 20:41 . 2008-01-27 20:41 d——– C:\Program Files\LiveUpdate
2008-01-27 20:40 . 2008-01-27 20:43 d——– C:\Users\All Users\BVRP Software
2008-01-27 20:40 . 2008-01-27 20:43 d——– C:\ProgramData\BVRP Software
2008-01-27 20:40 . 2008-01-27 20:40 d——– C:\Program Files\mobile PhoneTools
2008-01-27 17:16 . 2008-01-27 17:16 0 –ah—– C:\Windows\System32\drivers\Msft_Kernel_motmodem_01005.Wdf
2008-01-27 17:12 . 2008-01-27 17:12 d——– C:\Program Files\Common Files\Motorola Shared
2008-01-27 14:13 . 2008-01-27 14:13 d——– C:\Program Files\BitPim
2008-01-27 10:49 . 2007-08-12 13:07 516,096 –a—— C:\Windows\system\lame_enc.dll
2008-01-18 15:03 . 2008-01-31 00:49 d——– C:\Program Files\Common Files\Symantec Shared
2008-01-18 15:01 . 2008-01-25 19:24 d——– C:\Users\All Users\Symantec
2008-01-18 15:01 . 2008-01-25 19:24 d——– C:\ProgramData\Symantec
2008-01-14 07:22 . 2008-01-14 07:29 d——– C:\Users\Rich\AppData\Roaming\Vso
2008-01-14 07:22 . 2008-01-14 07:22 47,360 –a—— C:\Windows\System32\drivers\pcouffin.sys
2008-01-14 07:22 . 2008-01-14 07:29 47,360 –a—— C:\Users\Rich\AppData\Roaming\pcouffin.sys
2008-01-11 20:24 . 2008-01-11 20:25 354 –ah—– C:\IPH.PH
2008-01-09 03:04 . 2008-01-09 03:04 802,816 –a—— C:\Windows\System32\drivers\tcpip.sys
2008-01-09 03:04 . 2008-01-09 03:04 216,760 –a—— C:\Windows\System32\drivers\netio.sys
2008-01-09 03:04 . 2008-01-09 03:04 167,424 –a—— C:\Windows\System32\tcpipcfg.dll
2008-01-09 03:04 . 2008-01-09 03:04 24,064 –a—— C:\Windows\System32\netcfg.exe
2008-01-09 03:04 . 2008-01-09 03:04 22,016 –a—— C:\Windows\System32\netiougc.exe
2008-01-09 03:02 . 2008-01-09 03:02 4,247,552 –a—— C:\Windows\System32\GameUXLegacyGDFs.dll
2008-01-09 03:02 . 2008-01-09 03:02 1,686,016 –a—— C:\Windows\System32\gameux.dll
2008-01-09 03:02 . 2008-01-09 03:02 1,060,920 –a—— C:\Windows\System32\drivers\ntfs.sys
2008-01-09 03:02 . 2008-01-09 03:02 211,000 –a—— C:\Windows\System32\drivers\volsnap.sys
2008-01-09 03:02 . 2008-01-09 03:02 154,624 –a—— C:\Windows\System32\drivers\nwifi.sys
2008-01-09 03:02 . 2008-01-09 03:02 110,136 –a—— C:\Windows\System32\drivers\ataport.sys
2008-01-09 03:02 . 2008-01-09 03:02 45,112 –a—— C:\Windows\System32\drivers\pciidex.sys
2008-01-09 03:02 . 2008-01-09 03:02 21,560 –a—— C:\Windows\System32\drivers\atapi.sys
2008-01-09 03:02 . 2008-01-09 03:02 15,928 –a—— C:\Windows\System32\drivers\pciide.sys
2008-01-09 03:01 . 2008-01-09 03:01 11,776 –a—— C:\Windows\System32\sbunattend.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-02 05:55 83,456 —-a-w C:\Windows\System32\VACFix.exe
2008-01-28 01:41 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-01-27 19:37 81,920 —-a-w C:\Windows\System32\IEDFix.exe
2008-01-22 13:56 ——— d—–w C:\Program Files\DVDneXtCOPY2
2008-01-18 10:49 ——— d—–w C:\Program Files\McAfee
2008-01-09 08:12 ——— d—–w C:\Program Files\Windows Mail
2008-01-09 08:02 537,600 —-a-w C:\Windows\AppPatch\AcLayers.dll
2008-01-09 08:02 449,024 —-a-w C:\Windows\AppPatch\AcSpecfc.dll
2008-01-09 08:02 2,143,744 —-a-w C:\Windows\AppPatch\AcGenral.dll
2008-01-09 08:02 173,056 —-a-w C:\Windows\AppPatch\AcXtrnal.dll
2008-01-09 08:01 ——— d—–w C:\Program Files\Windows Sidebar
2008-01-04 06:16 ——— d—–w C:\Program Files\SlySoft
2008-01-01 20:07 ——— d—–w C:\Users\Rich\AppData\Roaming\UseNeXT
2007-12-30 05:43 ——— d—–w C:\Program Files\Ligos
2007-12-30 05:33 ——— d—–w C:\Users\Rich\AppData\Roaming\vlc
2007-12-30 05:33 ——— d—–w C:\Program Files\GSpot
2007-12-30 05:26 ——— d—–w C:\Program Files\VideoLAN
2007-12-30 01:10 ——— d—–w C:\Program Files\UseNeXT
2007-12-27 02:29 ——— d—–w C:\Program Files\AVI Movie Player
2007-12-27 02:24 ——— d—–w C:\Users\Rich\AppData\Roaming\Media Player Classic
2007-12-27 02:23 ——— d—–w C:\Program Files\K-Lite Codec Pack
2007-12-24 19:11 ——— d—–w C:\ProgramData\SlySoft
2007-12-24 14:52 ——— d—–w C:\Program Files\Audacity
2007-12-23 13:56 ——— d—–w C:\Program Files\DivX
2007-12-23 06:08 ——— d—–w C:\Program Files\PokerStars
2007-12-21 05:51 ——— d—–w C:\Program Files\CyberLink
2007-12-17 13:33 15,872 –sha-w C:\Windows\AnyTrial.exe
2007-12-14 16:32 12,632 —-a-w C:\Windows\System32\lsdelete.exe
2007-12-12 08:04 9,728 —-a-w C:\Windows\System32\LAPRXY.DLL
2007-12-12 08:04 223,232 —-a-w C:\Windows\System32\WMASF.DLL
2007-12-12 08:04 1,327,104 —-a-w C:\Windows\System32\quartz.dll
2007-12-12 08:03 824,832 —-a-w C:\Windows\System32\wininet.dll
2007-12-12 08:03 56,320 —-a-w C:\Windows\System32\iesetup.dll
2007-12-12 08:03 52,736 —-a-w C:\Windows\AppPatch\iebrshim.dll
2007-12-12 08:03 26,624 —-a-w C:\Windows\System32\ieUnatt.exe
2007-12-12 08:02 84,992 —-a-w C:\Windows\system32\drivers\srvnet.sys
2007-12-12 08:02 58,368 —-a-w C:\Windows\system32\drivers\mrxsmb20.sys
2007-12-12 08:02 130,048 —-a-w C:\Windows\system32\drivers\srv2.sys
2007-12-12 08:02 101,888 —-a-w C:\Windows\system32\drivers\mrxsmb.sys
2007-12-12 08:01 3,504,824 —-a-w C:\Windows\System32\ntkrnlpa.exe
2007-12-12 08:01 3,470,520 —-a-w C:\Windows\System32\ntoskrnl.exe
2007-12-11 19:46 524,288 —-a-w C:\Windows\System32\DivXsm.exe
2007-12-11 19:46 3,596,288 —-a-w C:\Windows\System32\qt-dx331.dll
2007-12-11 19:45 200,704 —-a-w C:\Windows\System32\ssldivx.dll
2007-12-11 19:45 1,044,480 —-a-w C:\Windows\System32\libdivx.dll
2007-12-11 19:44 823,296 —-a-w C:\Windows\System32\divx_xx0c.dll
2007-12-11 19:44 823,296 —-a-w C:\Windows\System32\divx_xx07.dll
2007-12-11 19:44 81,920 —-a-w C:\Windows\System32\dpl100.dll
2007-12-11 19:44 802,816 —-a-w C:\Windows\System32\divx_xx11.dll
2007-12-11 19:44 593,920 —-a-w C:\Windows\System32\dpuGUI11.dll
2007-12-11 19:44 57,344 —-a-w C:\Windows\System32\dpv11.dll
2007-12-11 19:44 53,248 —-a-w C:\Windows\System32\dpuGUI10.dll
2007-12-11 19:44 344,064 —-a-w C:\Windows\System32\dpus11.dll
2007-12-11 19:44 294,912 —-a-w C:\Windows\System32\dpu11.dll
2007-12-11 19:44 294,912 —-a-w C:\Windows\System32\dpu10.dll
2007-12-11 19:44 196,608 —-a-w C:\Windows\System32\dtu100.dll
2007-12-11 19:44 156,992 —-a-w C:\Windows\System32\DivXCodecVersionChecker.exe
2007-12-11 19:43 12,288 —-a-w C:\Windows\System32\DivXWMPExtType.dll
2007-12-09 11:46 ——— d—a-w C:\ProgramData\TEMP
2007-12-07 23:28 7,680 —-a-w C:\Windows\System32\ff_vfw.dll
2007-11-22 08:01 8,704 —-a-w C:\Windows\System32\hcrstco.dll
2007-11-22 08:01 8,704 —-a-w C:\Windows\System32\hccoin.dll
2007-11-19 08:03 704,000 —-a-w C:\Windows\System32\PhotoScreensaver.scr
2007-11-19 08:03 542,720 —-a-w C:\Windows\System32\sysmain.dll
2007-11-19 08:03 24,064 —-a-w C:\Windows\System32\wtsapi32.dll
2007-11-19 08:03 2,923,520 —-a-w C:\Windows\explorer.exe
2007-11-19 08:03 2,027,008 —-a-w C:\Windows\System32\win32k.sys
2007-11-19 08:02 67,584 —-a-w C:\Windows\System32\wlanhlp.dll
2007-11-19 08:02 502,784 —-a-w C:\Windows\System32\wlansvc.dll
2007-11-19 08:02 47,104 —-a-w C:\Windows\System32\wlanapi.dll
2007-11-19 08:02 297,984 —-a-w C:\Windows\System32\wlansec.dll
2007-11-19 08:02 290,816 —-a-w C:\Windows\System32\wlanmsm.dll
2007-10-13 07:10 174 –sha-w C:\Program Files\desktop.ini
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{376892AE-1825-4E5F-9F85-23F9640051CC}]
C:\Windows\xmljacodec.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DellSupportCenter"="C:\Program Files\Dell Support Center\bin\sprtcmd.exe" [2007-10-09 17:56 202544]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 07:34 201728]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488]
"AOL Fast Start"="C:\Program Files\AOL 9.1\AOL.exe" [2007-10-27 12:44 50528]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2007-10-03 15:09 1006264]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2007-05-24 00:09 857648]
"Broadcom Wireless Manager UI"="C:\Windows\system32\WLTRAY.exe" [2007-03-21 10:34 1548288]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 04:25 6731312]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-02-02 09:21 579072]
"PDVDDXSrv"="C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2007-06-08 18:40 128560]
"AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 SOS\avp.exe" [2007-11-19 14:40 231952]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-02-02 09:18 219136]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgwlntf]
avgwlntf.dll 2008-02-02 09:19 9216 C:\Windows\System32\avgwlntf.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"DVDneXtCOPY"=C:\Program Files\DVDneXtCOPY Virtual Drive\DVDneXtCOPY.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"BugSoft AnyTrial"=C:\Users\Rich\Documents\BitLord\Downloads\AnyDVD & AnyDVD HD 6.3.0.1 Beta\AnyTrialControl.exe

R0 AtiPcie;ATI PCI Express (3GIO) Filter;C:\Windows\system32\DRIVERS\AtiPcie.sys [2006-10-30 10:23]
R2 AnyTrial;BugSoft AnyTrial;C:\Windows\AnyTrial.exe [2007-12-17 08:33]
R2 DVDneXtCOPYService;DVDneXtCOPYService;"C:\Program Files\DVDneXtCOPY Virtual Drive\DVDneXtCOPYService.exe" [2007-03-19 11:17]
R2 HPSLPSVC;HP Network Devices Support;C:\Windows\system32\svchost.exe [2006-11-02 04:45]
R2 SBSDWSCService;SBSD Security Center Service;C:\Program Files\Spybot []
R2 sprtsvc_dellsupportcenter;SupportSoft Sprocket Service (dellsupportcenter);C:\Program Files\Dell Support Center\bin\sprtsvc.exe /service []
R2 XAudio;XAudio;C:\Windows\system32\DRIVERS\xaudio.sys [2007-04-29 00:24]
R3 atikmdag;atikmdag;C:\Windows\system32\DRIVERS\atikmdag.sys [2007-05-25 00:05]
R3 DVDneXtCOPY;DVDneXtCOPY;C:\Windows\system32\DRIVERS\DVDneXtCOPY.sys [2007-03-19 11:27]
S3 R300;R300;C:\Windows\system32\DRIVERS\atikmdag.sys [2007-05-25 00:05]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
HPService REG_MULTI_SZ HPSLPSVC
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

.
Contents of the 'Scheduled Tasks' folder
"2008-01-15 07:20:42 C:\Windows\Tasks\McDefragTask.job"
- c:\PROGRA~1\mcafee\mqc\QcConsol.exe'
"2008-01-01 06:00:15 C:\Windows\Tasks\McQcTask.job"
- c:\PROGRA~1\mcafee\mqc\QcConsol.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-08 18:23:20
Windows 6.0.6000 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

PROCESS: C:\Windows\Explorer.exe [6.00.6000.16549]
-> C:\Windows\system32\vorbis.dll
-> C:\Windows\system32\ogg.dll
-> C:\Windows\system32\vorbisenc.dll
.
Completion time: 2008-02-08 18:24:53
ComboFix-quarantined-files.txt 2008-02-08 23:24:48
ComboFix2.txt 2008-02-08 15:14:41
.
2008-02-05 22:19:47 — E O F —

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:27:33 PM, on 2/8/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16575)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\System32\WLTRAY.EXE
C:\Program Files\Grisoft\AVG7\avgcc.exe
C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Dell Support Center\bin\sprtcmd.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Common Files\aol\1192256479\ee\aolsoftware.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\AOL 9.1\waol.exe
C:\Program Files\AOL 9.1\shellmon.exe
C:\Windows\Explorer.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\system32\SearchFilterHost.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D; IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\PROGRA~1\mcafee\VIRUSS~1\scriptcl.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll
O3 - Toolbar: &Google; - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\Windows\system32\WLTRAY.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [PDVDDXSrv] "C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe"
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 SOS\avp.exe"
O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [AOL Fast Start] "C:\Program Files\AOL 9.1\AOL.EXE" -b
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-21-171449339-1904340565-232687155-1002\..\Run: [EasyLinkAdvisor] "C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe" /startup (User 'R yan')
O4 - HKUS\S-1-5-21-171449339-1904340565-232687155-1003\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup (User 'Nella')
O4 - HKUS\S-1-5-21-171449339-1904340565-232687155-1004\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'Alex')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O13 - Gopher Prefix:
O16 - DPF: {49312E18-AA92-4CC2-BB97-55DEA7BCADD6} (WMI Class) - http://support.dell.com/systemprofiler/SysProExe.CAB
O16 - DPF: {549F957E-2F89-11D6-8CFE-00C04F52B225} (CMV5 Class) - http://coupons.smartsource.com/download/cscmv5X.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
O20 - Winlogon Notify: avgwlntf - C:\Windows\SYSTEM32\avgwlntf.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: BugSoft AnyTrial (AnyTrial) - Dr.Pc Putte Corp

- C:\Windows\AnyTrial.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG7 Resident Shield Service (AvgCoreSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe
O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 SOS\avp.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: DVDneXtCOPYService - DVD neXt COPY - C:\Program Files\DVDneXtCOPY Virtual Drive\DVDneXtCOPYService.exe
O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Advanced Networking Service (hnmsvc) - SingleClick Systems - C:\Program Files\Dell Network Assistant\hnm_svc.exe
O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe
O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\Windows\system32\STacSV.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\Windows\System32\WLTRYSVC.EXE
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

–
End of file - 9414 bytes

LDTate

Post #6February 9, 2008, 12:42 PM UTC

1.Click Start > Settings > Control Panel.
2.Next, open Add/Remove Programs and remove if listed:
Kaspersky Anti-Virus
McAfee

Reboot and "copy/paste" a new HijackThis log file into this thread.

Also please describe how your computer behaves at the moment.

bOuT2JuMpOfF

Post #7February 9, 2008, 5:29 PM UTC

I haven't had a chance to perform your last suggestion yet, but although it isn't behaving as badly… it still is hanging and sluggish. I will followup when I get home today. Thanks again!

LDTate

Post #8February 9, 2008, 7:24 PM UTC

bOuT2JuMpOfF

Post #9February 9, 2008, 9:03 PM UTC

Here is my latest HJT logfile info. I did remove Kap & Mcafee. AVG Free Edition Resident Shield is now finding a virus? in the file win32/PEPatch when it tries to open a program called AnyTrial? Sorry my kids used this laptop on vacation to d/l music and movies and whatever 11 year olds do when we aren't looking

. I fully apreciate your trying to help. The machine is really sluggish… pages take forever to load, programs hang, desktop icons take forever to load. etc…

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:52:07 PM, on 2/9/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16575)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\System32\WLTRAY.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Grisoft\AVG7\avgcc.exe
C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe
C:\Program Files\Dell Support Center\bin\sprtcmd.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\AOL 9.1\waol.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Dell Support Center\gs_agent\dsc.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\AOL 9.1\shellmon.exe
C:\Program Files\Common Files\aol\1192256479\ee\aolsoftware.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\Windows\system32\WLTRAY.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [PDVDDXSrv] "C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe"
O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [AOL Fast Start] "C:\Program Files\AOL 9.1\AOL.EXE" -b
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-21-171449339-1904340565-232687155-1002\..\Run: [EasyLinkAdvisor] "C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe" /startup (User 'R yan')
O4 - HKUS\S-1-5-21-171449339-1904340565-232687155-1003\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup (User 'Nella')
O4 - HKUS\S-1-5-21-171449339-1904340565-232687155-1004\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'Alex')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O13 - Gopher Prefix:
O16 - DPF: {49312E18-AA92-4CC2-BB97-55DEA7BCADD6} (WMI Class) - http://support.dell.com/systemprofiler/SysProExe.CAB
O16 - DPF: {549F957E-2F89-11D6-8CFE-00C04F52B225} (CMV5 Class) - http://coupons.smartsource.com/download/cscmv5X.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
O20 - Winlogon Notify: avgwlntf - C:\Windows\SYSTEM32\avgwlntf.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: BugSoft AnyTrial (AnyTrial) - Unknown owner - C:\Windows\AnyTrial.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG7 Resident Shield Service (AvgCoreSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: DVDneXtCOPYService - DVD neXt COPY - C:\Program Files\DVDneXtCOPY Virtual Drive\DVDneXtCOPYService.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Advanced Networking Service (hnmsvc) - SingleClick Systems - C:\Program Files\Dell Network Assistant\hnm_svc.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe
O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\Windows\system32\STacSV.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\Windows\System32\WLTRYSVC.EXE
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

–
End of file - 7850 bytes

LDTate

Post #10February 9, 2008, 9:08 PM UTC

Open notepad and copy/paste the text in the quotebox below into it:

File::
C:\Users\Rich\Documents\BitLord\Downloads\AnyDVD & AnyDVD HD 6.3.0.1 Beta\AnyTrialControl.exe
C:\Windows\AnyTrial.exe 

Folder::
C:\Users\Rich\Documents\BitLord\Downloads\AnyDVD & AnyDVD HD 6.3.0.1 Beta

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"BugSoft AnyTrial"=-

Save this as Save this as "CFScript"

[external image: Posted Image]

Drag CFScript.txt into ComboFix.exe

Then post the results log and a new HijackThis log.

Also please describe how your computer behaves at the moment.

bOuT2JuMpOfF

Post #11February 9, 2008, 9:17 PM UTC

Have to spend a minute rebooting then testing the behavior. In the meantime, here is the logfile info from the last go-round of combofix. Thanks!

ComboFix 08-01-30.1 - Rich 2008-02-09 16:08:36.3 - NTFSx86
Microsoft® Windows Vista™ Home Basic 6.0.6000.0.1252.1.1033.18.1252 [GMT -5:00]
Running from: C:\Users\[removed]\Desktop\Combo-Fix.exe
Command switches used :: C:\Users\Rich\Desktop\CFScript.txt
* Created a new restore point

FILE
C:\Users\Rich\Documents\BitLord\Downloads\AnyDVD & AnyDVD HD 6.3.0.1 Beta\AnyTrialControl.exe
C:\Windows\AnyTrial.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Windows\AnyTrial.exe

.
((((((((((((((((((((((((( Files Created from 2008-01-09 to 2008-02-09 )))))))))))))))))))))))))))))))
.

2008-02-09 15:45 . 2008-02-09 15:45 d——– C:\Users\Nella\AppData\Roaming\Grisoft
2008-02-09 15:45 . 2008-02-09 15:46 d——– C:\Users\Nella\AppData\Roaming\AVG7
2008-02-08 10:31 . 2008-02-08 10:34 194,906,415 –a—— C:\Windows\MEMORY.DMP
2008-02-04 07:14 . 2008-02-04 07:14 d——– C:\KAV
2008-02-03 10:24 . 2008-02-03 10:24 d——– C:\Program Files\Lavasoft
2008-02-03 10:23 . 2008-02-03 10:23 d——– C:\Program Files\Common Files\Wise Installation Wizard
2008-02-02 19:07 . 2008-02-02 19:09 d——– C:\Windows\System32\SmitfraudFix
2008-02-02 11:04 . 2008-02-02 18:59 38 –a—— C:\Windows\avisplitter.INI
2008-02-02 09:19 . 2008-02-09 16:02 d——– C:\Users\Rich\AppData\Roaming\AVG7
2008-02-02 09:19 . 2008-02-02 09:19 9,216 –a—— C:\Windows\System32\avgwlntf.dll
2008-02-02 09:18 . 2008-02-02 09:23 d——– C:\Users\All Users\avg7
2008-02-02 09:18 . 2008-02-02 09:23 d——– C:\ProgramData\avg7
2008-02-02 08:56 . 2008-02-02 08:56 250 –a—— C:\Windows\gmer.ini
2008-01-31 10:10 . 2008-01-31 10:10 d——– C:\Program Files\Trend Micro
2008-01-31 09:30 . 2008-01-31 09:30 d——– C:\Users\Rich\AppData\Roaming\Grisoft
2008-01-31 09:30 . 2008-02-02 09:18 d——– C:\Users\All Users\Grisoft
2008-01-31 09:30 . 2008-02-02 09:18 d——– C:\ProgramData\Grisoft
2008-01-31 09:30 . 2007-05-30 07:10 10,872 –a—— C:\Windows\System32\drivers\AvgAsCln.sys
2008-01-30 23:59 . 2008-01-31 00:04 d——– C:\Users\All Users\Spybot - Search & Destroy
2008-01-30 23:59 . 2008-01-31 00:04 d——– C:\ProgramData\Spybot - Search & Destroy
2008-01-30 22:55 . 2008-02-03 10:24 d——– C:\Users\All Users\Lavasoft
2008-01-30 22:55 . 2008-02-03 10:24 d——– C:\ProgramData\Lavasoft
2008-01-30 18:47 . 2008-01-30 18:47 d——– C:\Program Files\Enigma Software Group
2008-01-27 22:59 . 2008-01-27 22:59 d——– C:\Program Files\Motorola
2008-01-27 22:32 . 2008-01-27 22:32 25,600 –a—— C:\Users\Rich\usbsermptxp.sys
2008-01-27 22:32 . 2008-01-27 22:32 22,768 –a—— C:\Users\Rich\usbsermpt.sys
2008-01-27 21:32 . 2008-01-27 21:32 d——– C:\Program Files\GoldWave
2008-01-27 20:41 . 2008-01-27 20:41 d——– C:\Program Files\LiveUpdate
2008-01-27 20:40 . 2008-01-27 20:43 d——– C:\Users\All Users\BVRP Software
2008-01-27 20:40 . 2008-01-27 20:43 d——– C:\ProgramData\BVRP Software
2008-01-27 20:40 . 2008-01-27 20:40 d——– C:\Program Files\mobile PhoneTools
2008-01-27 17:16 . 2008-01-27 17:16 0 –ah—– C:\Windows\System32\drivers\Msft_Kernel_motmodem_01005.Wdf
2008-01-27 17:12 . 2008-01-27 17:12 d——– C:\Program Files\Common Files\Motorola Shared
2008-01-27 14:13 . 2008-01-27 14:13 d——– C:\Program Files\BitPim
2008-01-27 10:49 . 2007-08-12 13:07 516,096 –a—— C:\Windows\system\lame_enc.dll
2008-01-18 15:03 . 2008-01-31 00:49 d——– C:\Program Files\Common Files\Symantec Shared
2008-01-18 15:01 . 2008-01-25 19:24 d——– C:\Users\All Users\Symantec
2008-01-18 15:01 . 2008-01-25 19:24 d——– C:\ProgramData\Symantec
2008-01-14 07:22 . 2008-01-14 07:29 d——– C:\Users\Rich\AppData\Roaming\Vso
2008-01-14 07:22 . 2008-01-14 07:22 47,360 –a—— C:\Windows\System32\drivers\pcouffin.sys
2008-01-14 07:22 . 2008-01-14 07:29 47,360 –a—— C:\Users\Rich\AppData\Roaming\pcouffin.sys
2008-01-11 20:24 . 2008-01-11 20:25 354 –ah—– C:\IPH.PH
2008-01-09 03:04 . 2008-01-09 03:04 802,816 –a—— C:\Windows\System32\drivers\tcpip.sys
2008-01-09 03:04 . 2008-01-09 03:04 216,760 –a—— C:\Windows\System32\drivers\netio.sys
2008-01-09 03:04 . 2008-01-09 03:04 167,424 –a—— C:\Windows\System32\tcpipcfg.dll
2008-01-09 03:04 . 2008-01-09 03:04 24,064 –a—— C:\Windows\System32\netcfg.exe
2008-01-09 03:04 . 2008-01-09 03:04 22,016 –a—— C:\Windows\System32\netiougc.exe
2008-01-09 03:02 . 2008-01-09 03:02 4,247,552 –a—— C:\Windows\System32\GameUXLegacyGDFs.dll
2008-01-09 03:02 . 2008-01-09 03:02 1,686,016 –a—— C:\Windows\System32\gameux.dll
2008-01-09 03:02 . 2008-01-09 03:02 1,060,920 –a—— C:\Windows\System32\drivers\ntfs.sys
2008-01-09 03:02 . 2008-01-09 03:02 211,000 –a—— C:\Windows\System32\drivers\volsnap.sys
2008-01-09 03:02 . 2008-01-09 03:02 154,624 –a—— C:\Windows\System32\drivers\nwifi.sys
2008-01-09 03:02 . 2008-01-09 03:02 110,136 –a—— C:\Windows\System32\drivers\ataport.sys
2008-01-09 03:02 . 2008-01-09 03:02 45,112 –a—— C:\Windows\System32\drivers\pciidex.sys
2008-01-09 03:02 . 2008-01-09 03:02 21,560 –a—— C:\Windows\System32\drivers\atapi.sys
2008-01-09 03:02 . 2008-01-09 03:02 15,928 –a—— C:\Windows\System32\drivers\pciide.sys
2008-01-09 03:01 . 2008-01-09 03:01 11,776 –a—— C:\Windows\System32\sbunattend.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-09 20:45 ——— d—–w C:\ProgramData\McAfee
2008-02-02 05:55 83,456 —-a-w C:\Windows\System32\VACFix.exe
2008-01-28 01:41 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-01-27 19:37 81,920 —-a-w C:\Windows\System32\IEDFix.exe
2008-01-22 13:56 ——— d—–w C:\Program Files\DVDneXtCOPY2
2008-01-09 08:12 ——— d—–w C:\Program Files\Windows Mail
2008-01-09 08:02 537,600 —-a-w C:\Windows\AppPatch\AcLayers.dll
2008-01-09 08:02 449,024 —-a-w C:\Windows\AppPatch\AcSpecfc.dll
2008-01-09 08:02 2,143,744 —-a-w C:\Windows\AppPatch\AcGenral.dll
2008-01-09 08:02 173,056 —-a-w C:\Windows\AppPatch\AcXtrnal.dll
2008-01-09 08:01 ——— d—–w C:\Program Files\Windows Sidebar
2008-01-04 06:16 ——— d—–w C:\Program Files\SlySoft
2008-01-01 20:07 ——— d—–w C:\Users\Rich\AppData\Roaming\UseNeXT
2007-12-30 05:43 ——— d—–w C:\Program Files\Ligos
2007-12-30 05:33 ——— d—–w C:\Users\Rich\AppData\Roaming\vlc
2007-12-30 05:33 ——— d—–w C:\Program Files\GSpot
2007-12-30 05:26 ——— d—–w C:\Program Files\VideoLAN
2007-12-30 01:10 ——— d—–w C:\Program Files\UseNeXT
2007-12-27 02:29 ——— d—–w C:\Program Files\AVI Movie Player
2007-12-27 02:24 ——— d—–w C:\Users\Rich\AppData\Roaming\Media Player Classic
2007-12-27 02:23 ——— d—–w C:\Program Files\K-Lite Codec Pack
2007-12-24 19:11 ——— d—–w C:\ProgramData\SlySoft
2007-12-24 14:52 ——— d—–w C:\Program Files\Audacity
2007-12-23 13:56 ——— d—–w C:\Program Files\DivX
2007-12-23 06:08 ——— d—–w C:\Program Files\PokerStars
2007-12-21 05:51 ——— d—–w C:\Program Files\CyberLink
2007-12-14 16:32 12,632 —-a-w C:\Windows\System32\lsdelete.exe
2007-12-12 08:04 9,728 —-a-w C:\Windows\System32\LAPRXY.DLL
2007-12-12 08:04 223,232 —-a-w C:\Windows\System32\WMASF.DLL
2007-12-12 08:04 1,327,104 —-a-w C:\Windows\System32\quartz.dll
2007-12-12 08:03 824,832 —-a-w C:\Windows\System32\wininet.dll
2007-12-12 08:03 56,320 —-a-w C:\Windows\System32\iesetup.dll
2007-12-12 08:03 52,736 —-a-w C:\Windows\AppPatch\iebrshim.dll
2007-12-12 08:03 26,624 —-a-w C:\Windows\System32\ieUnatt.exe
2007-12-12 08:02 84,992 —-a-w C:\Windows\system32\drivers\srvnet.sys
2007-12-12 08:02 58,368 —-a-w C:\Windows\system32\drivers\mrxsmb20.sys
2007-12-12 08:02 130,048 —-a-w C:\Windows\system32\drivers\srv2.sys
2007-12-12 08:02 101,888 —-a-w C:\Windows\system32\drivers\mrxsmb.sys
2007-12-12 08:01 3,504,824 —-a-w C:\Windows\System32\ntkrnlpa.exe
2007-12-12 08:01 3,470,520 —-a-w C:\Windows\System32\ntoskrnl.exe
2007-12-11 19:46 524,288 —-a-w C:\Windows\System32\DivXsm.exe
2007-12-11 19:46 3,596,288 —-a-w C:\Windows\System32\qt-dx331.dll
2007-12-11 19:45 200,704 —-a-w C:\Windows\System32\ssldivx.dll
2007-12-11 19:45 1,044,480 —-a-w C:\Windows\System32\libdivx.dll
2007-12-11 19:44 823,296 —-a-w C:\Windows\System32\divx_xx0c.dll
2007-12-11 19:44 823,296 —-a-w C:\Windows\System32\divx_xx07.dll
2007-12-11 19:44 81,920 —-a-w C:\Windows\System32\dpl100.dll
2007-12-11 19:44 802,816 —-a-w C:\Windows\System32\divx_xx11.dll
2007-12-11 19:44 593,920 —-a-w C:\Windows\System32\dpuGUI11.dll
2007-12-11 19:44 57,344 —-a-w C:\Windows\System32\dpv11.dll
2007-12-11 19:44 53,248 —-a-w C:\Windows\System32\dpuGUI10.dll
2007-12-11 19:44 344,064 —-a-w C:\Windows\System32\dpus11.dll
2007-12-11 19:44 294,912 —-a-w C:\Windows\System32\dpu11.dll
2007-12-11 19:44 294,912 —-a-w C:\Windows\System32\dpu10.dll
2007-12-11 19:44 196,608 —-a-w C:\Windows\System32\dtu100.dll
2007-12-11 19:44 156,992 —-a-w C:\Windows\System32\DivXCodecVersionChecker.exe
2007-12-11 19:43 12,288 —-a-w C:\Windows\System32\DivXWMPExtType.dll
2007-12-09 11:46 ——— d—a-w C:\ProgramData\TEMP
2007-12-07 23:28 7,680 —-a-w C:\Windows\System32\ff_vfw.dll
2007-11-22 08:01 8,704 —-a-w C:\Windows\System32\hcrstco.dll
2007-11-22 08:01 8,704 —-a-w C:\Windows\System32\hccoin.dll
2007-11-19 08:03 704,000 —-a-w C:\Windows\System32\PhotoScreensaver.scr
2007-11-19 08:03 542,720 —-a-w C:\Windows\System32\sysmain.dll
2007-11-19 08:03 24,064 —-a-w C:\Windows\System32\wtsapi32.dll
2007-11-19 08:03 2,923,520 —-a-w C:\Windows\explorer.exe
2007-11-19 08:03 2,027,008 —-a-w C:\Windows\System32\win32k.sys
2007-11-19 08:02 67,584 —-a-w C:\Windows\System32\wlanhlp.dll
2007-11-19 08:02 502,784 —-a-w C:\Windows\System32\wlansvc.dll
2007-11-19 08:02 47,104 —-a-w C:\Windows\System32\wlanapi.dll
2007-11-19 08:02 297,984 —-a-w C:\Windows\System32\wlansec.dll
2007-11-19 08:02 290,816 —-a-w C:\Windows\System32\wlanmsm.dll
2007-10-13 07:10 174 –sha-w C:\Program Files\desktop.ini
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DellSupportCenter"="C:\Program Files\Dell Support Center\bin\sprtcmd.exe" [2007-10-09 17:56 202544]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 07:34 201728]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488]
"AOL Fast Start"="C:\Program Files\AOL 9.1\AOL.exe" [2007-10-27 12:44 50528]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2007-10-03 15:09 1006264]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2007-05-24 00:09 857648]
"Broadcom Wireless Manager UI"="C:\Windows\system32\WLTRAY.exe" [2007-03-21 10:34 1548288]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 04:25 6731312]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-02-02 09:21 579072]
"PDVDDXSrv"="C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2007-06-08 18:40 128560]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-02-02 09:18 219136]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgwlntf]
avgwlntf.dll 2008-02-02 09:19 9216 C:\Windows\System32\avgwlntf.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"DVDneXtCOPY"=C:\Program Files\DVDneXtCOPY Virtual Drive\DVDneXtCOPY.exe

R0 AtiPcie;ATI PCI Express (3GIO) Filter;C:\Windows\system32\DRIVERS\AtiPcie.sys [2006-10-30 10:23]
R2 AnyTrial;BugSoft AnyTrial;C:\Windows\AnyTrial.exe []
R2 DVDneXtCOPYService;DVDneXtCOPYService;"C:\Program Files\DVDneXtCOPY Virtual Drive\DVDneXtCOPYService.exe" [2007-03-19 11:17]
R2 HPSLPSVC;HP Network Devices Support;C:\Windows\system32\svchost.exe [2006-11-02 04:45]
R2 SBSDWSCService;SBSD Security Center Service;C:\Program Files\Spybot []
R2 sprtsvc_dellsupportcenter;SupportSoft Sprocket Service (dellsupportcenter);C:\Program Files\Dell Support Center\bin\sprtsvc.exe /service []
R2 XAudio;XAudio;C:\Windows\system32\DRIVERS\xaudio.sys [2007-04-29 00:24]
R3 atikmdag;atikmdag;C:\Windows\system32\DRIVERS\atikmdag.sys [2007-05-25 00:05]
R3 DVDneXtCOPY;DVDneXtCOPY;C:\Windows\system32\DRIVERS\DVDneXtCOPY.sys [2007-03-19 11:27]
S3 R300;R300;C:\Windows\system32\DRIVERS\atikmdag.sys [2007-05-25 00:05]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
HPService REG_MULTI_SZ HPSLPSVC
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-09 16:10:35
Windows 6.0.6000 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-02-09 16:11:35
ComboFix-quarantined-files.txt 2008-02-09 21:11:30
ComboFix2.txt 2008-02-08 23:24:55
ComboFix3.txt 2008-02-08 15:14:41
.
2008-02-05 22:19:47 — E O F —

LDTate

Post #12February 9, 2008, 9:25 PM UTC

"copy/paste" a new HijackThis log file into this thread.

bOuT2JuMpOfF

Post #13February 9, 2008, 9:29 PM UTC

Seems to be less sluggish…

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:25:53 PM, on 2/9/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16575)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\System32\WLTRAY.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Grisoft\AVG7\avgcc.exe
C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe
C:\Program Files\Dell Support Center\bin\sprtcmd.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\AOL 9.1\waol.exe
C:\Program Files\AOL 9.1\shellmon.exe
C:\Program Files\Common Files\aol\1192256479\ee\aolsoftware.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Windows\explorer.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\DllHost.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\Windows\system32\WLTRAY.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [PDVDDXSrv] "C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe"
O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [AOL Fast Start] "C:\Program Files\AOL 9.1\AOL.EXE" -b
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-21-171449339-1904340565-232687155-1002\..\Run: [EasyLinkAdvisor] "C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe" /startup (User 'R yan')
O4 - HKUS\S-1-5-21-171449339-1904340565-232687155-1003\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup (User 'Nella')
O4 - HKUS\S-1-5-21-171449339-1904340565-232687155-1004\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'Alex')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O13 - Gopher Prefix:
O16 - DPF: {49312E18-AA92-4CC2-BB97-55DEA7BCADD6} (WMI Class) - http://support.dell.com/systemprofiler/SysProExe.CAB
O16 - DPF: {549F957E-2F89-11D6-8CFE-00C04F52B225} (CMV5 Class) - http://coupons.smartsource.com/download/cscmv5X.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
O20 - Winlogon Notify: avgwlntf - C:\Windows\SYSTEM32\avgwlntf.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: BugSoft AnyTrial (AnyTrial) - Unknown owner - C:\Windows\AnyTrial.exe (file missing)
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG7 Resident Shield Service (AvgCoreSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: DVDneXtCOPYService - DVD neXt COPY - C:\Program Files\DVDneXtCOPY Virtual Drive\DVDneXtCOPYService.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Advanced Networking Service (hnmsvc) - SingleClick Systems - C:\Program Files\Dell Network Assistant\hnm_svc.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe
O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\Windows\system32\STacSV.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\Windows\System32\WLTRYSVC.EXE
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

–
End of file - 7925 bytes

LDTate

Post #14February 9, 2008, 9:51 PM UTC

You need To disable TeaTimer, it can stop our fix.

1) Run Spybot-S&D
2) Go to the Mode menu, and make sure "Advanced Mode" is selected
3) On the left hand side, choose Tools -> Resident
4) Uncheck "Resident TeaTimer" and OK any prompts

The best way is to do both, Right click the system tray icon and shut down. This will reset TT's registry snapshot. Then, open spybot in advanced mode and turn it off. When cleaning is done, open Spybot in advanced mode to turn back on.

Once fix is completed in the all clear post!!

Enable Teatimer

Open Spybot
Click on Tools in bottom left hand corner.
Click on Resident.
Check Resident "TeaTimer" box.
Click on Allow change ONLY to popup box with:
Entry: SpybotSD Teatimer
Click on Mode, select Default mode
Close Spybot

1.Click Start > Settings > Control Panel.
2.Next, open Add/Remove Programs and remove if listed:
AVG Anti-Spyware 7.5 <–it's pretty worthless now. Only removes cookies and temp files.
Google Desktop Manager

I don't know which Toolbar you use, so remove the one you use from the below list

Run hijackthis. Hit None of the above, Click Do a System Scan Only. Put a checkmark/tick in the box on the left side on these:

O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)
O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-21-171449339-1904340565-232687155-1004\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'Alex')
O16 - DPF: {49312E18-AA92-4CC2-BB97-55DEA7BCADD6} (WMI Class) - http://support.dell.com/systemprofiler/SysProExe.CAB
O16 - DPF: {549F957E-2F89-11D6-8CFE-00C04F52B225} (CMV5 Class) - http://coupons.smartsource.com/download/cscmv5X.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O23 - Service: BugSoft AnyTrial (AnyTrial) - Unknown owner - C:\Windows\AnyTrial.exe (file missing)
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

Close ALL windows and browsers except HijackThis and click "Fix checked"

Reboot and "copy/paste" a new HijackThis log file into this thread.

Also please describe how your computer behaves at the moment.

bOuT2JuMpOfF

Post #15February 9, 2008, 10:55 PM UTC

Certainly is better than when we started… can't know quite yet if we are a-ok. I am going to put teatimer back on… forgot. Thanks! Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 5:49:41 PM, on 2/9/2008 Platform: Windows Vista (WinNT 6.00.1904) MSIE: Internet Explorer v7.00 (7.00.6000.16575) Boot mode: Normal Running processes: C:\Windows\system32\Dwm.exe C:\Windows\system32\taskeng.exe C:\Windows\Explorer.EXE C:\Program Files\Windows Defender\MSASCui.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Windows\System32\WLTRAY.EXE C:\Program Files\Grisoft\AVG7\avgcc.exe C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe C:\Program Files\AOL 9.1\waol.exe C:\Windows\system32\wbem\unsecapp.exe C:\Program Files\AOL 9.1\shellmon.exe C:\Program Files\Internet Explorer\IEUser.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe C:\Windows\system32\SearchFilterHost.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O1 - Hosts: ::1 localhost O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll (file missing) O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll (file missing) O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\Windows\system32\WLTRAY.exe O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP O4 - HKLM\..\Run: [PDVDDXSrv] "C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe" O4 - HKCU\..\Run: [AOL Fast Start] "C:\Program Files\AOL 9.1\AOL.EXE" -b O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-21-171449339-1904340565-232687155-1002\..\Run: [EasyLinkAdvisor] "C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe" /startup (User 'R yan') O4 - HKUS\S-1-5-21-171449339-1904340565-232687155-1002\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'R yan') O4 - HKUS\S-1-5-21-171449339-1904340565-232687155-1003\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup (User 'Nella') O4 - HKUS\S-1-5-21-171449339-1904340565-232687155-1004\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup (User 'Alex') O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user') O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll (file missing) O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O13 - Gopher Prefix: O20 - Winlogon Notify: avgwlntf - C:\Windows\SYSTEM32\avgwlntf.dll O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: BugSoft AnyTrial (AnyTrial) - Unknown owner - C:\Windows\AnyTrial.exe (file missing) O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: AVG7 Resident Shield Service (AvgCoreSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe O23 - Service: DVDneXtCOPYService - DVD neXt COPY - C:\Program Files\DVDneXtCOPY Virtual Drive\DVDneXtCOPYService.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Advanced Networking Service (hnmsvc) - SingleClick Systems - C:\Program Files\Dell Network Assistant\hnm_svc.exe O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\Windows\system32\STacSV.exe O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\Windows\System32\WLTRYSVC.EXE O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe – End of file - 5807 bytes

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] My HJT Log

✨ Ask AI

Ask AI