Spyware / Malware / Virus Removal

[Resolved] W32.TRATS!INF ....VUNDO IS GONE BUT, metajuan stil

8 min read

Looking for the outcome? Ask AI

notsosmart Topic Starter

Post #1February 2, 2008, 4:57 PM UTC

Good Day!

I took my computer into a computer place and when it went in it had an Alphabet B virus that had a helper9.dll message stopped by symantec and was running extremely slowly…when it came out it had W32.Trats!INF, Vundo, zlob, metajuan, spybot alot of spyware and malware and programs that were not there before plus they uninstalled my symantec and took pieces of my windows out causing error messages oh yeah and it was still running super slow….I have since been recommended to run various programs…AVG, XoftSpy SE, AD-Aware/AD-Watch, SmitFraudFix and Housecall. I have done everything that was asked of me from those programs and I am still coming up with the Trats! and the metajuan. My brother directed me to this forum which had a stream on w32.Trats!inf infection, Vundo seems gone. between patnhank and simon V. I followed everything I could to get a report or two. i downloaded and ran ccleaner first, then i downloaded and ran combofix, then to complete it i downloaded hijackthis…i will paste them into here in the order they were ran and hope that everything is okay. Could you please help me?!? I did not delete or erase anything and I do not have a major anti-virus program running. Does everything look okay now, did I fix it?!? Thanks in advance!

This is from ccleaner:

ABBYY FineReader 6.0 Sprint
Ad-Aware 2007
Adobe Reader 8.1.1
Apple Software Update
CCleaner (remove only)
Creative DVD Audio Plugin for Audigy Series
Diskeeper Professional Edition
Hotfix for Windows XP (KB909394)
Hotfix for Windows XP (KB914440)
InterActual Player
InterVideo WinDVD 7
J2SE Runtime Environment 5.0 Update 3
Lexmark 4300 Series
Lexmark Fax Solutions
LiveUpdate (Symantec Corporation)
Microsoft .NET Framework 2.0 Service Pack 1
Microsoft ActiveSync
Microsoft Application Error Reporting
Microsoft Office Professional Edition 2003
Microsoft Visual C++ 2005 Redistributable
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 Parser and SDK
NETGEAR WG511v2 wireless PC card
Paint Shop Pro 7
QuickTime
Security Update for CAPICOM (KB931906)
Security Update for Windows Internet Explorer 7 (KB928090)
Security Update for Windows Internet Explorer 7 (KB929969)
Security Update for Windows Internet Explorer 7 (KB937143)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB939653)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 10 (KB936782)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows Media Player 9 (KB917734)
Security Update for Windows XP (KB890046)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896424)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911567)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB912919)
Security Update for Windows XP (KB913433)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB917159)
Security Update for Windows XP (KB917422)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB918118)
Security Update for Windows XP (KB918439)
Security Update for Windows XP (KB919007)
Security Update for Windows XP (KB920213)
Security Update for Windows XP (KB920214)
Security Update for Windows XP (KB920670)
Security Update for Windows XP (KB920683)
Security Update for Windows XP (KB920685)
Security Update for Windows XP (KB921398)
Security Update for Windows XP (KB921503)
Security Update for Windows XP (KB921883)
Security Update for Windows XP (KB922616)
Security Update for Windows XP (KB922819)
Security Update for Windows XP (KB923191)
Security Update for Windows XP (KB923414)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB923694)
Security Update for Windows XP (KB923980)
Security Update for Windows XP (KB924191)
Security Update for Windows XP (KB924270)
Security Update for Windows XP (KB924667)
Security Update for Windows XP (KB925902)
Security Update for Windows XP (KB926255)
Security Update for Windows XP (KB926436)
Security Update for Windows XP (KB927779)
Security Update for Windows XP (KB927802)
Security Update for Windows XP (KB928255)
Security Update for Windows XP (KB928843)
Security Update for Windows XP (KB929123)
Security Update for Windows XP (KB930178)
Security Update for Windows XP (KB931261)
Security Update for Windows XP (KB931784)
Security Update for Windows XP (KB932168)
Security Update for Windows XP (KB933729)
Security Update for Windows XP (KB935839)
Security Update for Windows XP (KB935840)
Security Update for Windows XP (KB936021)
Security Update for Windows XP (KB938829)
Security Update for Windows XP (KB941202)
Security Update for Windows XP (KB941568)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB941644)
Security Update for Windows XP (KB943460)
Security Update for Windows XP (KB943485)
Security Update for Windows XP (KB944653)
SMC2862W-G 54Mbps WLAN Utility
Symantec AntiVirus Client
Update for Windows XP (KB894391)
Update for Windows XP (KB898461)
Update for Windows XP (KB900485)
Update for Windows XP (KB904942)
Update for Windows XP (KB908531)
Update for Windows XP (KB910437)
Update for Windows XP (KB911280)
Update for Windows XP (KB914882)
Update for Windows XP (KB916595)
Update for Windows XP (KB920872)
Update for Windows XP (KB922582)
Update for Windows XP (KB923845)
Update for Windows XP (KB927891)
Update for Windows XP (KB929338)
Update for Windows XP (KB930916)
Update for Windows XP (KB931836)
Update for Windows XP (KB933360)
Update for Windows XP (KB936357)
Update for Windows XP (KB938828)
Update for Windows XP (KB942763)
WebFldrs XP
Windows Installer 3.1 (KB893803)
Windows Internet Explorer 7
Windows Live Messenger
Windows Live Sign-in Assistant
Windows Media Format Runtime
Windows Media Player 10
Windows Media Player 10 Hotfix - KB894476
Windows XP Hotfix - KB890859
WinRAR archiver
XoftSpySE

combofix:

ComboFix 08-02.02.5 - brett 2008-02-02 10:37:04.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.110 [GMT -5:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\urspm.dll
C:\WINDOWS\cookies.ini
C:\WINDOWS\system32\bfbuieif.dll
C:\WINDOWS\system32\ctfmon.exe.tmp
C:\WINDOWS\system32\dqimfwhb.dll
C:\WINDOWS\system32\fieiubfb.ini
C:\WINDOWS\system32\fijjl.ini
C:\WINDOWS\system32\fijjl.ini2
C:\WINDOWS\system32\hcwgmscv.ini
C:\WINDOWS\system32\ivbimyck.dllbox
C:\WINDOWS\system32\kejoduao.dll
C:\WINDOWS\system32\mpsru.ini
C:\WINDOWS\system32\mpsru.ini2
C:\WINDOWS\system32\oaudojek.ini
C:\WINDOWS\system32\rhftrcta.ini
C:\WINDOWS\system32\sfousabs.dllbox
C:\WINDOWS\system32\trlvibjw.dll
C:\WINDOWS\system32\urspm.dll
C:\WINDOWS\system32\urspm.exe
C:\WINDOWS\system32\vcsmgwch.dll
C:\WINDOWS\system32\ybviphbg.ini
C:\WINDOWS\system32\ygzvcxdn.dll
C:\WINDOWS\system32\ygzvcxdn.dllbox
C:\WINDOWS\system32\ynremmsr.ini

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
——-\LEGACY_DOMAINSERVICE

((((((((((((((((((((((((( Files Created from 2008-01-02 to 2008-02-02 )))))))))))))))))))))))))))))))
.

2008-02-02 09:56 . 2004-08-04 07:00 260,272 -r-hs—- C:\cmldr
2008-02-02 09:56 . 2008-01-18 21:57 211 –ahs—- C:\BOOT.BAK
2008-02-02 09:10 . 2008-02-02 09:10 d——– C:\Program Files\CCleaner
2008-01-27 10:19 . 2008-01-27 10:27 d——– C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-01-27 10:16 . 2008-01-27 10:16 d——– C:\Program Files\Common Files\Wise Installation Wizard
2008-01-26 23:44 . 2008-01-26 23:44 d——– C:\Program Files\Symantec_Client_Security
2008-01-26 23:35 . 2008-01-26 23:35 d——– C:\WINDOWS\E80F62FF5D3C4A1984099721F2928206.TMP
2008-01-25 16:01 . 2008-01-25 16:01 1,580 –a—— C:\WINDOWS\system32\tmp.reg
2008-01-25 16:00 . 2007-09-05 23:22 289,144 –a—— C:\WINDOWS\system32\VCCLSID.exe
2008-01-25 16:00 . 2007-12-20 23:11 81,920 –a—— C:\WINDOWS\system32\IEDFix.exe
2008-01-25 16:00 . 2007-10-03 23:36 25,600 –a—— C:\WINDOWS\system32\WS2Fix.exe
2008-01-25 07:34 . 2008-01-25 07:34 11 –a—— C:\AuResult.ini
2008-01-24 22:24 . 2008-01-26 12:03 d——– C:\Documents and Settings\brett\.housecall6.6
2008-01-24 22:23 . 2008-01-24 22:23 d——– C:\WINDOWS\Sun
2008-01-24 21:48 . 2005-04-13 03:48 49,265 –a—— C:\WINDOWS\system32\jpicpl32.cpl
2008-01-24 21:43 . 2008-01-24 21:47 d——– C:\Program Files\Java
2008-01-24 21:41 . 2008-01-24 21:41 d——– C:\Program Files\Common Files\Java
2008-01-24 20:49 . 2008-01-24 22:24 102,664 –a—— C:\WINDOWS\system32\drivers\tmcomm.sys
2008-01-24 20:46 . 2008-01-26 22:56 d——– C:\WINDOWS\system32\HouseCall 6.6
2008-01-20 12:56 . 2008-01-20 12:56 d——– C:\Documents and Settings\brett\Application Data\Symantec
2008-01-19 23:37 . 2008-01-19 23:39 d——– C:\Program Files\Apple Software Update
2008-01-19 23:37 . 2008-01-19 23:37 d——– C:\Documents and Settings\All Users\Application Data\Apple
2008-01-18 22:59 . 2008-02-02 10:29 d——– C:\Program Files\Common Files\Symantec Shared
2008-01-18 20:40 . 2008-01-18 20:40 d——– C:\WINDOWS\system32\bits
2008-01-18 20:40 . 2007-03-29 07:56 7,168 —–c— C:\WINDOWS\system32\dllcache\bitsprx4.dll
2008-01-18 20:40 . 2007-03-29 07:56 7,168 –a—— C:\WINDOWS\system32\bitsprx4.dll
2008-01-17 21:15 . 2008-01-17 21:15 d——– C:\Documents and Settings\All Users\Application Data\Grisoft
2008-01-17 17:11 . 2008-01-17 17:11 406 –a—— C:\WINDOWS\system32\ioloBootDefrag.cfg
2008-01-17 17:05 . 2007-07-30 19:19 207,736 –a—— C:\WINDOWS\system32\muweb.dll
2008-01-17 16:55 . 2008-02-02 08:54 15,360 –a—— C:\WINDOWS\system32\ctfmon .exe
2008-01-17 16:45 . 2008-01-17 16:45 d——– C:\Documents and Settings\LocalService\Application Data\iolo
2008-01-17 16:38 . 2008-01-17 16:38 74,703 –a—— C:\WINDOWS\system32\mfc45.dll
2008-01-17 16:32 . 2008-01-17 17:10 d——– C:\Documents and Settings\brett\Application Data\iolo
2008-01-17 16:32 . 2008-01-17 17:10 d——– C:\Documents and Settings\All Users\Application Data\iolo
2008-01-17 15:41 . 2006-04-27 17:49 288,417 –a—— C:\WINDOWS\system32\SrchSTS.exe
2008-01-17 15:41 . 2003-06-05 21:13 53,248 –a—— C:\WINDOWS\system32\Process.exe
2008-01-17 15:41 . 2004-07-31 18:50 51,200 –a—— C:\WINDOWS\system32\dumphive.exe
2008-01-17 12:36 . 2008-01-17 15:56 d——– C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-01-17 12:25 . 2008-01-17 12:25 d——– C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-01-15 22:52 . 2008-01-15 22:52 224 –a—— C:\WINDOWS\system32\9B13A86D.plf
2008-01-15 22:49 . 2008-01-27 11:28 d——– C:\Program Files\XoftSpySE
2008-01-15 22:48 . 2008-01-15 22:48 d——– C:\Documents and Settings\All Users\Application Data\Downloaded Installations
2008-01-13 08:23 . 2008-01-13 08:23 d–hs—- C:\Documents and Settings\LocalService\UserData
2008-01-12 17:57 . 2008-01-12 17:57 145 –a—— C:\WINDOWS\system32\winver.bat

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-02 15:30 ——— d—–w C:\Program Files\Symantec
2008-01-27 15:22 ——— d—–w C:\Program Files\Lavasoft
2008-01-27 15:22 ——— d—–w C:\Documents and Settings\brett\Application Data\Lavasoft
2008-01-27 05:02 ——— d—–w C:\Documents and Settings\All Users\Application Data\Symantec
2008-01-27 04:08 ——— d—–w C:\Program Files\Microsoft ActiveSync
2008-01-17 21:11 ——— d—–w C:\Program Files\QuickTime
2008-01-13 00:35 ——— d—–w C:\Program Files\Lexmark Fax Solutions
2008-01-13 00:35 ——— d—–w C:\Program Files\Lexmark 4300 Series
2007-05-24 18:58 249,856 —-a-w C:\WINDOWS\inf\WG511v2\InsDrv2k.exe
2006-12-04 15:38 53,248 —-a-w C:\WINDOWS\inf\WG511v2\snetcfg .exe
2006-12-04 15:38 265,984 —-a-w C:\WINDOWS\inf\WG511v2\WG511v2XP.sys
2006-12-04 15:38 249,856 —-a-w C:\WINDOWS\inf\WG511v2\InsDrvlh.exe
2006-12-04 15:38 212,992 —-a-w C:\WINDOWS\inf\WG511v2\CopyWHQLDriver.exe
2006-12-04 15:38 21,376 —-a-w C:\WINDOWS\inf\WG511v2\wlndis51.sys
.

—-a-w			51,048 2008-01-26 18:33:07  C:\Program Files\Common Files\Symantec Shared\ccApp .exe
—-a-w		   180,312 2008-01-19 14:31:25  C:\Program Files\Executive Software\Diskeeper\DkIcon .exe
—-a-w			53,248 2006-12-04 15:38:30  C:\WINDOWS\inf\WG511v2\snetcfg .exe
—-a-w			15,360 2008-02-02 13:54:06  C:\WINDOWS\system32\ctfmon .exe

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AA9ED250-EB1D-4690-B0FD-2F1336CE14BD}]
C:\WINDOWS\system32\ljjif.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-01-17 17:04 15360]
"H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\wcescomm .exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe" [ ]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\hggghfc]
hggghfc.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ivbimyck]
ivbimyck.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ljjhihf]
ljjhihf.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winbns32]
winbns32.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, wowfx.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^NETGEAR WG511v2 Smart Wizard.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\NETGEAR WG511v2 Smart Wizard.lnk
backup=C:\WINDOWS\pss\NETGEAR WG511v2 Smart Wizard.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^SMC2862W-G 54Mbps WLAN Monitor.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\SMC2862W-G 54Mbps WLAN Monitor.lnk
backup=C:\WINDOWS\pss\SMC2862W-G 54Mbps WLAN Monitor.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
–a—— 2008-01-12 21:38 39792 C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avp]
C:\WINDOWS\TEMP\winE0.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp]
C:\Program Files\Common Files\Symantec Shared\ccApp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
–a—— 2008-01-17 17:04 15360 C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DiskeeperSystray]
C:\Program Files\Executive Software\Diskeeper\DkIcon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EzPrint]
–a—— 2008-01-12 21:12 94208 C:\Program Files\Lexmark 4300 Series\ezprint.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FaxCenterServer]
–a—— 2008-01-12 21:39 299008 C:\Program Files\Lexmark Fax Solutions\fm3032.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H/PC Connection Agent]
–a—— 2008-01-26 22:39 1697280 C:\PROGRA~1\MI3AA1~1\wcescomm.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Load]
C:\WINDOWS\system32\ljjif.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\lsass]
C:\WINDOWS\lsass.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\lxcemon.exe]
–a—— 2008-01-12 21:11 192512 C:\Program Files\Lexmark 4300 Series\lxcemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Outerinfo]
C:\Program Files\Outerinfo\Outerinfo.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OuterinfoUpdate]
C:\Program Files\Outerinfo\OuterinfoUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Printer]
C:\WINDOWS\system32\printer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\smgr]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Spoolsv]
C:\WINDOWS\system32\spoolvs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\vptray]
C:\PROGRA~1\SYMANT~1\VPTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Winupdate Engine]
C:\WINDOWS\system32\wupeng.exe

R3 CBEN5;Xircom CardBus Ethernet 10/100 Adapter family Driver;C:\WINDOWS\system32\DRIVERS\cben5.sys [2001-08-17 07:13]
R3 Maestro;ESS Maestro2E Audio Driver (WDM);C:\WINDOWS\system32\drivers\essm2e.sys [2002-06-03 09:20]
S3 SymIM;Symantec Network Security Intermediate Filter Service;C:\WINDOWS\system32\DRIVERS\SymIM.sys []
S3 SymIMMP;SymIMMP;C:\WINDOWS\system32\DRIVERS\SymIM.sys []
S3 WlanUIG;SMC 802.11g 2862W-G Driver;C:\WINDOWS\system32\DRIVERS\2862w.sys [2004-04-06 11:52]

.
Contents of the 'Scheduled Tasks' folder
"2008-02-02 15:23:39 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-02-02 15:53:36 C:\WINDOWS\Tasks\XoftSpySE 2.job"
- C:\Program Files\XoftSpySE\XoftSpy.exe
"2008-01-27 16:29:03 C:\WINDOWS\Tasks\XoftSpySE.job"
- C:\Program Files\XoftSpySE\XoftSpy.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-02 10:52:34
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
———————— Other Running Processes ————————
.
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\atievxx.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\Executive Software\Diskeeper\DkService.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe
C:\WINDOWS\system32\wdfmgr.exe
.
**************************************************************************
.
Completion time: 2008-02-02 10:57:38 - machine was rebooted
ComboFix-quarantined-files.txt 2008-02-02 15:56:37
.
2008-01-20 10:17:29 — E O F —

and this is from HijackThis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:24:39 AM, on 2/2/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\atievxx.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\Executive Software\Diskeeper\DkService.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {AA9ED250-EB1D-4690-B0FD-2F1336CE14BD} - C:\WINDOWS\system32\ljjif.dll (file missing)
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm .exe"
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_03\bin\npjpi150_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_03\bin\npjpi150_03.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.5.0) - http://javadl-esd.sun.com/update/1.5.0/jin…indows-i586.cab
O20 - Winlogon Notify: hggghfc - hggghfc.dll (file missing)
O20 - Winlogon Notify: ivbimyck - ivbimyck.dll (file missing)
O20 - Winlogon Notify: ljjhihf - ljjhihf.dll (file missing)
O20 - Winlogon Notify: winbns32 - winbns32.dll (file missing)
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\Diskeeper\DkService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE

–
End of file - 3568 bytes

LDTate

Post #2February 7, 2008, 9:42 PM UTC

Hello and Welcome to the forum.

Be sure to delete the combofix you have now.

I suggest you do this:

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Clear "Hide file extensions for known file types."
Under the "Hidden files" folder, select "Show hidden files and folders."
Clear "Hide protected operating system files."
Click Apply, and then click OK.

Please do not delete anything unless instructed to.

Next:

Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»

Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

(If you use FireFox or the Opera browser
To keep saved passwords, click No at the prompt.)

It's normal after running ATF cleaner that the PC will be slower to boot the first time.

Next:

Download ComboFix from Here to your Desktop.

**Note: In the event you already have Combofix, please delete it from your desktop and download this new version . It is important that it is saved directly to your desktop**
——————————————————————–

Close any open browsers and make sure you are disconnected from the net. Unplug the cable if need be before running combofix.
WARNING: IF you have not already done so Combofix will disconnect your machine from the Internet when it starts
Please do not re-connect your machine back to the Internet until Combofix has completely finished.

——————————————————————–

Double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.
Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review

****Note: Do not mouseclick combofix's window while it's running. That may cause it to stall or freeze ****

*If there is no internet connection when Combofix has completely finished then restart your computer to restore back the connections.

notsosmart

Post #3February 7, 2008, 11:21 PM UTC

okay here is the information you requested….

COMBOFIX RAN FIRST

ComboFix 08-02.05.3 - brett 2008-02-07 18:07:10.2 - NTFSx86
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat

—– BITS: Possible infected sites —–

hxxp://www.download.windowsupdate.com
.
((((((((((((((((((((((((( Files Created from 2008-01-07 to 2008-02-07 )))))))))))))))))))))))))))))))
.

2008-02-02 11:24 . 2008-02-02 11:24 d——– C:\Program Files\Trend Micro
2008-02-02 09:56 . 2004-08-04 07:00 260,272 -r-hs—- C:\cmldr
2008-01-27 10:19 . 2008-01-27 10:27 d——– C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-01-27 10:16 . 2008-01-27 10:16 d——– C:\Program Files\Common Files\Wise Installation Wizard
2008-01-26 23:44 . 2008-01-26 23:44 d——– C:\Program Files\Symantec_Client_Security
2008-01-26 23:35 . 2008-01-26 23:35 d——– C:\WINDOWS\E80F62FF5D3C4A1984099721F2928206.TMP
2008-01-25 16:01 . 2008-01-25 16:01 1,580 –a—— C:\WINDOWS\system32\tmp.reg
2008-01-25 16:00 . 2007-09-05 23:22 289,144 –a—— C:\WINDOWS\system32\VCCLSID.exe
2008-01-25 16:00 . 2007-12-20 23:11 81,920 –a—— C:\WINDOWS\system32\IEDFix.exe
2008-01-25 16:00 . 2007-10-03 23:36 25,600 –a—— C:\WINDOWS\system32\WS2Fix.exe
2008-01-25 07:34 . 2008-01-25 07:34 11 –a—— C:\AuResult.ini
2008-01-24 22:24 . 2008-01-26 12:03 d——– C:\Documents and Settings\brett\.housecall6.6
2008-01-24 22:23 . 2008-01-24 22:23 d——– C:\WINDOWS\Sun
2008-01-24 21:48 . 2005-04-13 03:48 49,265 –a—— C:\WINDOWS\system32\jpicpl32.cpl
2008-01-24 21:43 . 2008-01-24 21:47 d——– C:\Program Files\Java
2008-01-24 21:41 . 2008-01-24 21:41 d——– C:\Program Files\Common Files\Java
2008-01-24 20:49 . 2008-01-24 22:24 102,664 –a—— C:\WINDOWS\system32\drivers\tmcomm.sys
2008-01-24 20:46 . 2008-01-26 22:56 d——– C:\WINDOWS\system32\HouseCall 6.6
2008-01-20 12:56 . 2008-01-20 12:56 d——– C:\Documents and Settings\brett\Application Data\Symantec
2008-01-19 23:37 . 2008-01-19 23:39 d——– C:\Program Files\Apple Software Update
2008-01-19 23:37 . 2008-01-19 23:37 d——– C:\Documents and Settings\All Users\Application Data\Apple
2008-01-18 22:59 . 2008-02-02 10:29 d——– C:\Program Files\Common Files\Symantec Shared
2008-01-18 20:40 . 2008-01-18 20:40 d——– C:\WINDOWS\system32\bits
2008-01-18 20:40 . 2007-03-29 07:56 7,168 —–c— C:\WINDOWS\system32\dllcache\bitsprx4.dll
2008-01-18 20:40 . 2007-03-29 07:56 7,168 –a—— C:\WINDOWS\system32\bitsprx4.dll
2008-01-17 21:15 . 2008-01-17 21:15 d——– C:\Documents and Settings\All Users\Application Data\Grisoft
2008-01-17 17:11 . 2008-01-17 17:11 406 –a—— C:\WINDOWS\system32\ioloBootDefrag.cfg
2008-01-17 17:05 . 2007-07-30 19:19 207,736 –a—— C:\WINDOWS\system32\muweb.dll
2008-01-17 16:55 . 2008-02-02 08:54 15,360 –a—— C:\WINDOWS\system32\ctfmon .exe
2008-01-17 16:45 . 2008-01-17 16:45 d——– C:\Documents and Settings\LocalService\Application Data\iolo
2008-01-17 16:38 . 2008-01-17 16:38 74,703 –a—— C:\WINDOWS\system32\mfc45.dll
2008-01-17 16:32 . 2008-01-17 17:10 d——– C:\Documents and Settings\brett\Application Data\iolo
2008-01-17 16:32 . 2008-01-17 17:10 d——– C:\Documents and Settings\All Users\Application Data\iolo
2008-01-17 15:41 . 2006-04-27 17:49 288,417 –a—— C:\WINDOWS\system32\SrchSTS.exe
2008-01-17 15:41 . 2003-06-05 21:13 53,248 –a—— C:\WINDOWS\system32\Process.exe
2008-01-17 15:41 . 2004-07-31 18:50 51,200 –a—— C:\WINDOWS\system32\dumphive.exe
2008-01-17 12:36 . 2008-01-17 15:56 d——– C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-01-17 12:25 . 2008-01-17 12:25 d——– C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-01-15 22:52 . 2008-01-15 22:52 224 –a—— C:\WINDOWS\system32\9B13A86D.plf
2008-01-15 22:49 . 2008-02-02 11:42 d——– C:\Program Files\XoftSpySE
2008-01-15 22:48 . 2008-01-15 22:48 d——– C:\Documents and Settings\All Users\Application Data\Downloaded Installations
2008-01-13 08:23 . 2008-01-13 08:23 d–hs—- C:\Documents and Settings\LocalService\UserData
2008-01-12 17:57 . 2008-01-12 17:57 145 –a—— C:\WINDOWS\system32\winver.bat

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-02 15:30 ——— d—–w C:\Program Files\Symantec
2008-01-27 15:22 ——— d—–w C:\Program Files\Lavasoft
2008-01-27 15:22 ——— d—–w C:\Documents and Settings\brett\Application Data\Lavasoft
2008-01-27 05:02 ——— d—–w C:\Documents and Settings\All Users\Application Data\Symantec
2008-01-27 04:08 ——— d—–w C:\Program Files\Microsoft ActiveSync
2008-01-17 22:04 15,360 —-a-w C:\WINDOWS\system32\ctfmon.exe
2008-01-17 21:11 ——— d—–w C:\Program Files\QuickTime
2008-01-13 00:35 ——— d—–w C:\Program Files\Lexmark Fax Solutions
2008-01-13 00:35 ——— d—–w C:\Program Files\Lexmark 4300 Series
2007-12-14 16:32 12,632 —-a-w C:\WINDOWS\system32\lsdelete.exe
2007-11-07 09:26 721,920 —-a-w C:\WINDOWS\system32\lsasrv.dll
2007-05-24 18:58 249,856 —-a-w C:\WINDOWS\inf\WG511v2\InsDrv2k.exe
2006-12-04 15:38 53,248 —-a-w C:\WINDOWS\inf\WG511v2\snetcfg .exe
2006-12-04 15:38 265,984 —-a-w C:\WINDOWS\inf\WG511v2\WG511v2XP.sys
2006-12-04 15:38 249,856 —-a-w C:\WINDOWS\inf\WG511v2\InsDrvlh.exe
2006-12-04 15:38 212,992 —-a-w C:\WINDOWS\inf\WG511v2\CopyWHQLDriver.exe
2006-12-04 15:38 21,376 —-a-w C:\WINDOWS\inf\WG511v2\wlndis51.sys
.

—-a-w			51,048 2008-01-26 18:33:07  C:\Program Files\Common Files\Symantec Shared\ccApp .exe
—-a-w		   180,312 2008-01-19 14:31:25  C:\Program Files\Executive Software\Diskeeper\DkIcon .exe
—-a-w			53,248 2006-12-04 15:38:30  C:\WINDOWS\inf\WG511v2\snetcfg .exe
—-a-w			15,360 2008-02-02 13:54:06  C:\WINDOWS\system32\ctfmon .exe

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AA9ED250-EB1D-4690-B0FD-2F1336CE14BD}]
C:\WINDOWS\system32\ljjif.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-01-17 17:04 15360]
"H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\wcescomm .exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe" [ ]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\hggghfc]
hggghfc.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ivbimyck]
ivbimyck.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ljjhihf]
ljjhihf.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winbns32]
winbns32.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, wowfx.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^NETGEAR WG511v2 Smart Wizard.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\NETGEAR WG511v2 Smart Wizard.lnk
backup=C:\WINDOWS\pss\NETGEAR WG511v2 Smart Wizard.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^SMC2862W-G 54Mbps WLAN Monitor.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\SMC2862W-G 54Mbps WLAN Monitor.lnk
backup=C:\WINDOWS\pss\SMC2862W-G 54Mbps WLAN Monitor.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
–a—— 2008-01-12 21:38 39792 C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avp]
C:\WINDOWS\TEMP\winE0.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp]
C:\Program Files\Common Files\Symantec Shared\ccApp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
–a—— 2008-01-17 17:04 15360 C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DiskeeperSystray]
C:\Program Files\Executive Software\Diskeeper\DkIcon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EzPrint]
–a—— 2008-01-12 21:12 94208 C:\Program Files\Lexmark 4300 Series\ezprint.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FaxCenterServer]
–a—— 2008-01-12 21:39 299008 C:\Program Files\Lexmark Fax Solutions\fm3032.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H/PC Connection Agent]
–a—— 2008-01-26 22:39 1697280 C:\PROGRA~1\MI3AA1~1\wcescomm.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Load]
C:\WINDOWS\system32\ljjif.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\lsass]
C:\WINDOWS\lsass.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\lxcemon.exe]
–a—— 2008-01-12 21:11 192512 C:\Program Files\Lexmark 4300 Series\lxcemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Outerinfo]
C:\Program Files\Outerinfo\Outerinfo.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OuterinfoUpdate]
C:\Program Files\Outerinfo\OuterinfoUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Printer]
C:\WINDOWS\system32\printer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\smgr]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Spoolsv]
C:\WINDOWS\system32\spoolvs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\vptray]
C:\PROGRA~1\SYMANT~1\VPTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Winupdate Engine]
C:\WINDOWS\system32\wupeng.exe

R3 CBEN5;Xircom CardBus Ethernet 10/100 Adapter family Driver;C:\WINDOWS\system32\DRIVERS\cben5.sys [2001-08-17 07:13]
R3 Maestro;ESS Maestro2E Audio Driver (WDM);C:\WINDOWS\system32\drivers\essm2e.sys [2002-06-03 09:20]
S3 SymIM;Symantec Network Security Intermediate Filter Service;C:\WINDOWS\system32\DRIVERS\SymIM.sys []
S3 SymIMMP;SymIMMP;C:\WINDOWS\system32\DRIVERS\SymIM.sys []
S3 WlanUIG;SMC 802.11g 2862W-G Driver;C:\WINDOWS\system32\DRIVERS\2862w.sys [2004-04-06 11:52]

.
Contents of the 'Scheduled Tasks' folder
"2008-02-02 15:23:39 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-02-07 22:41:58 C:\WINDOWS\Tasks\XoftSpySE 2.job"
- C:\Program Files\XoftSpySE\XoftSpy.exe
"2008-01-27 16:29:03 C:\WINDOWS\Tasks\XoftSpySE.job"
- C:\Program Files\XoftSpySE\XoftSpy.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-07 18:09:53
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-02-07 18:11:00
ComboFix-quarantined-files.txt 2008-02-07 23:10:37
ComboFix2.txt 2008-02-02 15:57:39
.
2008-01-20 10:17:29 — E O F —

THEN RAN HIJACKTHIS

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:12:25 PM, on 2/7/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\atievxx.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\Executive Software\Diskeeper\DkService.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {AA9ED250-EB1D-4690-B0FD-2F1336CE14BD} - C:\WINDOWS\system32\ljjif.dll (file missing)
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm .exe"
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_03\bin\npjpi150_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_03\bin\npjpi150_03.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.5.0) - http://javadl-esd.sun.com/update/1.5.0/jin…indows-i586.cab
O20 - Winlogon Notify: hggghfc - hggghfc.dll (file missing)
O20 - Winlogon Notify: ivbimyck - ivbimyck.dll (file missing)
O20 - Winlogon Notify: ljjhihf - ljjhihf.dll (file missing)
O20 - Winlogon Notify: winbns32 - winbns32.dll (file missing)
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\Diskeeper\DkService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE

–
End of file - 3270 bytes

Is everything good?

Thanks in advance

LDTate

Post #4February 7, 2008, 11:45 PM UTC

Open notepad and copy/paste the text in the Codebox below into it:

File::
C:\WINDOWS\system32\ljjif.dll
C:\WINDOWS\TEMP\winE0.exe
C:\WINDOWS\lsass.exe
C:\Program Files\Outerinfo\Outerinfo.exe
C:\Program Files\Outerinfo\OuterinfoUpdate.exe
C:\WINDOWS\system32\spoolvs.exe
C:\WINDOWS\system32\wupeng.exe

RenV::
C:\Program Files\Common Files\Symantec Shared\ccApp .exe
C:\Program Files\Executive Software\Diskeeper\DkIcon .exe
C:\WINDOWS\inf\WG511v2\snetcfg .exe
C:\WINDOWS\system32\ctfmon .exe
C:\WINDOWS\system32\printer.exe

Folder::
C:\Program Files\Outerinfo

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AA9ED250-EB1D-4690-B0FD-2F1336CE14BD}]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\hggghfc]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ivbimyck]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ljjhihf]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winbns32]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\lsass]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Outerinfo]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OuterinfoUpdate]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Printer]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Spoolsv]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Winupdate Engine]

Save this as Save this as "CFScript"

[external image: Posted Image]

Refering to the picture above, drag CFScript.txt into ComboFix.exe

Then post the results log and a new HijackThis log.

Also please describe how your computer behaves at the moment.

notsosmart

Post #5February 8, 2008, 2:23 AM UTC

these are the logs…..

ComboFix 08-02.05.3 - brett 2008-02-07 19:35:38.3 - NTFSx86
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\brett\Desktop\CFScript.txt

FILE
C:\Program Files\Outerinfo\Outerinfo.exe
C:\Program Files\Outerinfo\OuterinfoUpdate.exe
C:\WINDOWS\lsass.exe
C:\WINDOWS\system32\ljjif.dll
C:\WINDOWS\system32\spoolvs.exe
C:\WINDOWS\system32\wupeng.exe
C:\WINDOWS\TEMP\winE0.exe
.

((((((((((((((((((((((((( Files Created from 2008-01-08 to 2008-02-08 )))))))))))))))))))))))))))))))
.

2008-02-07 18:02 . 2004-08-04 07:00 388,608 –a—— C:\kmd.exe
2008-02-02 11:24 . 2008-02-02 11:24 d——– C:\Program Files\Trend Micro
2008-02-02 09:56 . 2004-08-04 07:00 260,272 -r-hs—- C:\cmldr
2008-01-27 10:19 . 2008-01-27 10:27 d——– C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-01-27 10:16 . 2008-01-27 10:16 d——– C:\Program Files\Common Files\Wise Installation Wizard
2008-01-26 23:44 . 2008-01-26 23:44 d——– C:\Program Files\Symantec_Client_Security
2008-01-26 23:35 . 2008-01-26 23:35 d——– C:\WINDOWS\E80F62FF5D3C4A1984099721F2928206.TMP
2008-01-25 16:01 . 2008-01-25 16:01 1,580 –a—— C:\WINDOWS\system32\tmp.reg
2008-01-25 16:00 . 2007-09-05 23:22 289,144 –a—— C:\WINDOWS\system32\VCCLSID.exe
2008-01-25 16:00 . 2007-12-20 23:11 81,920 –a—— C:\WINDOWS\system32\IEDFix.exe
2008-01-25 16:00 . 2007-10-03 23:36 25,600 –a—— C:\WINDOWS\system32\WS2Fix.exe
2008-01-25 07:34 . 2008-01-25 07:34 11 –a—— C:\AuResult.ini
2008-01-24 22:24 . 2008-01-26 12:03 d——– C:\Documents and Settings\brett\.housecall6.6
2008-01-24 22:23 . 2008-01-24 22:23 d——– C:\WINDOWS\Sun
2008-01-24 21:48 . 2005-04-13 03:48 49,265 –a—— C:\WINDOWS\system32\jpicpl32.cpl
2008-01-24 21:43 . 2008-01-24 21:47 d——– C:\Program Files\Java
2008-01-24 21:41 . 2008-01-24 21:41 d——– C:\Program Files\Common Files\Java
2008-01-24 20:49 . 2008-01-24 22:24 102,664 –a—— C:\WINDOWS\system32\drivers\tmcomm.sys
2008-01-24 20:46 . 2008-01-26 22:56 d——– C:\WINDOWS\system32\HouseCall 6.6
2008-01-20 12:56 . 2008-01-20 12:56 d——– C:\Documents and Settings\brett\Application Data\Symantec
2008-01-19 23:37 . 2008-01-19 23:39 d——– C:\Program Files\Apple Software Update
2008-01-19 23:37 . 2008-01-19 23:37 d——– C:\Documents and Settings\All Users\Application Data\Apple
2008-01-18 22:59 . 2008-02-07 19:35 d——– C:\Program Files\Common Files\Symantec Shared
2008-01-18 20:40 . 2008-01-18 20:40 d——– C:\WINDOWS\system32\bits
2008-01-18 20:40 . 2007-03-29 07:56 7,168 —–c— C:\WINDOWS\system32\dllcache\bitsprx4.dll
2008-01-18 20:40 . 2007-03-29 07:56 7,168 –a—— C:\WINDOWS\system32\bitsprx4.dll
2008-01-17 21:15 . 2008-01-17 21:15 d——– C:\Documents and Settings\All Users\Application Data\Grisoft
2008-01-17 17:11 . 2008-01-17 17:11 406 –a—— C:\WINDOWS\system32\ioloBootDefrag.cfg
2008-01-17 17:05 . 2007-07-30 19:19 207,736 –a—— C:\WINDOWS\system32\muweb.dll
2008-01-17 16:45 . 2008-01-17 16:45 d——– C:\Documents and Settings\LocalService\Application Data\iolo
2008-01-17 16:38 . 2008-01-17 16:38 74,703 –a—— C:\WINDOWS\system32\mfc45.dll
2008-01-17 16:32 . 2008-01-17 17:10 d——– C:\Documents and Settings\brett\Application Data\iolo
2008-01-17 16:32 . 2008-01-17 17:10 d——– C:\Documents and Settings\All Users\Application Data\iolo
2008-01-17 15:41 . 2006-04-27 17:49 288,417 –a—— C:\WINDOWS\system32\SrchSTS.exe
2008-01-17 15:41 . 2003-06-05 21:13 53,248 –a—— C:\WINDOWS\system32\Process.exe
2008-01-17 15:41 . 2004-07-31 18:50 51,200 –a—— C:\WINDOWS\system32\dumphive.exe
2008-01-17 12:36 . 2008-01-17 15:56 d——– C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-01-17 12:25 . 2008-01-17 12:25 d——– C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-01-15 22:52 . 2008-01-15 22:52 224 –a—— C:\WINDOWS\system32\9B13A86D.plf
2008-01-15 22:49 . 2008-02-02 11:42 d——– C:\Program Files\XoftSpySE
2008-01-15 22:48 . 2008-01-15 22:48 d——– C:\Documents and Settings\All Users\Application Data\Downloaded Installations
2008-01-13 08:23 . 2008-01-13 08:23 d–hs—- C:\Documents and Settings\LocalService\UserData
2008-01-12 17:57 . 2008-01-12 17:57 145 –a—— C:\WINDOWS\system32\winver.bat

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-02 15:30 ——— d—–w C:\Program Files\Symantec
2008-01-27 15:22 ——— d—–w C:\Program Files\Lavasoft
2008-01-27 15:22 ——— d—–w C:\Documents and Settings\brett\Application Data\Lavasoft
2008-01-27 05:02 ——— d—–w C:\Documents and Settings\All Users\Application Data\Symantec
2008-01-27 04:08 ——— d—–w C:\Program Files\Microsoft ActiveSync
2008-01-17 21:11 ——— d—–w C:\Program Files\QuickTime
2008-01-13 00:35 ——— d—–w C:\Program Files\Lexmark Fax Solutions
2008-01-13 00:35 ——— d—–w C:\Program Files\Lexmark 4300 Series
2007-05-24 18:58 249,856 —-a-w C:\WINDOWS\inf\WG511v2\InsDrv2k.exe
2006-12-04 15:38 53,248 —-a-w C:\WINDOWS\inf\WG511v2\snetcfg.exe
2006-12-04 15:38 265,984 —-a-w C:\WINDOWS\inf\WG511v2\WG511v2XP.sys
2006-12-04 15:38 249,856 —-a-w C:\WINDOWS\inf\WG511v2\InsDrvlh.exe
2006-12-04 15:38 212,992 —-a-w C:\WINDOWS\inf\WG511v2\CopyWHQLDriver.exe
2006-12-04 15:38 21,376 —-a-w C:\WINDOWS\inf\WG511v2\wlndis51.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-01-17 17:04 15360]
"H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\wcescomm .exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe" [ ]
"combofix"="C:\WINDOWS\system32\kmd.exe" [2004-08-04 07:00 388608]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, wowfx.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^NETGEAR WG511v2 Smart Wizard.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\NETGEAR WG511v2 Smart Wizard.lnk
backup=C:\WINDOWS\pss\NETGEAR WG511v2 Smart Wizard.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^SMC2862W-G 54Mbps WLAN Monitor.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\SMC2862W-G 54Mbps WLAN Monitor.lnk
backup=C:\WINDOWS\pss\SMC2862W-G 54Mbps WLAN Monitor.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
–a—— 2008-01-12 21:38 39792 C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avp]
C:\WINDOWS\TEMP\winE0.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp]
–a—— 2008-01-26 13:33 51048 C:\Program Files\Common Files\Symantec Shared\ccApp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
–a—— 2008-01-17 17:04 15360 C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DiskeeperSystray]
–a—— 2008-01-19 09:31 180312 C:\Program Files\Executive Software\Diskeeper\DkIcon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EzPrint]
–a—— 2008-01-12 21:12 94208 C:\Program Files\Lexmark 4300 Series\ezprint.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FaxCenterServer]
–a—— 2008-01-12 21:39 299008 C:\Program Files\Lexmark Fax Solutions\fm3032.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H/PC Connection Agent]
–a—— 2008-01-26 22:39 1697280 C:\PROGRA~1\MI3AA1~1\wcescomm.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Load]
C:\WINDOWS\system32\ljjif.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\lxcemon.exe]
–a—— 2008-01-12 21:11 192512 C:\Program Files\Lexmark 4300 Series\lxcemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\smgr]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\vptray]
C:\PROGRA~1\SYMANT~1\VPTray.exe

R3 CBEN5;Xircom CardBus Ethernet 10/100 Adapter family Driver;C:\WINDOWS\system32\DRIVERS\cben5.sys [2001-08-17 07:13]
R3 Maestro;ESS Maestro2E Audio Driver (WDM);C:\WINDOWS\system32\drivers\essm2e.sys [2002-06-03 09:20]
S3 SymIM;Symantec Network Security Intermediate Filter Service;C:\WINDOWS\system32\DRIVERS\SymIM.sys []
S3 SymIMMP;SymIMMP;C:\WINDOWS\system32\DRIVERS\SymIM.sys []
S3 WlanUIG;SMC 802.11g 2862W-G Driver;C:\WINDOWS\system32\DRIVERS\2862w.sys [2004-04-06 11:52]

.
Contents of the 'Scheduled Tasks' folder
"2008-02-02 15:23:39 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-02-08 00:49:46 C:\WINDOWS\Tasks\XoftSpySE 2.job"
- C:\Program Files\XoftSpySE\XoftSpy.exe
"2008-01-27 16:29:03 C:\WINDOWS\Tasks\XoftSpySE.job"
- C:\Program Files\XoftSpySE\XoftSpy.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-07 19:50:53
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

**************************************************************************
.
———————— Other Running Processes ————————
.
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\atievxx.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\Executive Software\Diskeeper\DkService.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe
.
**************************************************************************
.
Completion time: 2008-02-07 19:54:24 - machine was rebooted
ComboFix-quarantined-files.txt 2008-02-08 00:53:20
ComboFix2.txt 2008-02-07 23:11:01
ComboFix3.txt 2008-02-02 15:57:39
.
2008-01-20 10:17:29 — E O F —

this is the second….

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:56:26 PM, on 2/7/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\atievxx.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\Executive Software\Diskeeper\DkService.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm .exe"
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_03\bin\npjpi150_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_03\bin\npjpi150_03.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.5.0) - http://javadl-esd.sun.com/update/1.5.0/jin…indows-i586.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\Diskeeper\DkService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE

–
End of file - 2999 bytes

it changes the privacy settings to low but, it seems not to be doing it right now…and i dont have a virus scanner so i cant tell if there is anything wrong….there are no messages just running slow….does it look like all is okay?

LDTate

Post #6February 8, 2008, 2:37 AM UTC last edited February 8, 2008, 2:37 AM UTC

We're not finished yet, so wait until I give you my all clean post.

Open notepad and copy/paste the text in the quotebox below into it:

File::
C:\WINDOWS\system32\wowfx.dll

Folder::
C:\WINDOWS\E80F62FF5D3C4A1984099721F2928206.TMP

Registry::
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders = msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll

Save this as Save this as "CFScript"

[external image: Posted Image]

Drag CFScript.txt into ComboFix.exe

Then post the results log and a new HijackThis log.

Also please describe how your computer behaves at the moment.

notsosmart

Post #7February 8, 2008, 3:15 AM UTC

hi again, btw thanks for all the help!

here are the two logs that you asked for:

ComboFix 08-02.05.3 - brett 2008-02-07 22:09:49.4 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.105 [GMT -5:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\brett\Desktop\CFScript.txt
* Created a new restore point

FILE
C:\WINDOWS\system32\wowfx.dll
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\E80F62FF5D3C4A1984099721F2928206.TMP
C:\WINDOWS\E80F62FF5D3C4A1984099721F2928206.TMP\WiseCustomCall.dll

.
((((((((((((((((((((((((( Files Created from 2008-01-08 to 2008-02-08 )))))))))))))))))))))))))))))))
.

2008-02-07 19:25 . 2004-08-04 07:00 388,608 –a—— C:\kmd.exe
2008-02-02 11:24 . 2008-02-02 11:24 d——– C:\Program Files\Trend Micro
2008-02-02 09:56 . 2004-08-04 07:00 260,272 -r-hs—- C:\cmldr
2008-01-27 10:19 . 2008-01-27 10:27 d——– C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-01-27 10:16 . 2008-01-27 10:16 d——– C:\Program Files\Common Files\Wise Installation Wizard
2008-01-26 23:44 . 2008-01-26 23:44 d——– C:\Program Files\Symantec_Client_Security
2008-01-25 16:01 . 2008-01-25 16:01 1,580 –a—— C:\WINDOWS\system32\tmp.reg
2008-01-25 16:00 . 2007-09-05 23:22 289,144 –a—— C:\WINDOWS\system32\VCCLSID.exe
2008-01-25 16:00 . 2007-12-20 23:11 81,920 –a—— C:\WINDOWS\system32\IEDFix.exe
2008-01-25 16:00 . 2007-10-03 23:36 25,600 –a—— C:\WINDOWS\system32\WS2Fix.exe
2008-01-25 07:34 . 2008-01-25 07:34 11 –a—— C:\AuResult.ini
2008-01-24 22:24 . 2008-01-26 12:03 d——– C:\Documents and Settings\brett\.housecall6.6
2008-01-24 22:23 . 2008-01-24 22:23 d——– C:\WINDOWS\Sun
2008-01-24 21:48 . 2005-04-13 03:48 49,265 –a—— C:\WINDOWS\system32\jpicpl32.cpl
2008-01-24 21:43 . 2008-01-24 21:47 d——– C:\Program Files\Java
2008-01-24 21:41 . 2008-01-24 21:41 d——– C:\Program Files\Common Files\Java
2008-01-24 20:49 . 2008-01-24 22:24 102,664 –a—— C:\WINDOWS\system32\drivers\tmcomm.sys
2008-01-24 20:46 . 2008-01-26 22:56 d——– C:\WINDOWS\system32\HouseCall 6.6
2008-01-20 12:56 . 2008-01-20 12:56 d——– C:\Documents and Settings\brett\Application Data\Symantec
2008-01-19 23:37 . 2008-01-19 23:39 d——– C:\Program Files\Apple Software Update
2008-01-19 23:37 . 2008-01-19 23:37 d——– C:\Documents and Settings\All Users\Application Data\Apple
2008-01-18 22:59 . 2008-02-07 19:35 d——– C:\Program Files\Common Files\Symantec Shared
2008-01-18 20:40 . 2008-01-18 20:40 d——– C:\WINDOWS\system32\bits
2008-01-18 20:40 . 2007-03-29 07:56 7,168 —–c— C:\WINDOWS\system32\dllcache\bitsprx4.dll
2008-01-18 20:40 . 2007-03-29 07:56 7,168 –a—— C:\WINDOWS\system32\bitsprx4.dll
2008-01-17 21:15 . 2008-01-17 21:15 d——– C:\Documents and Settings\All Users\Application Data\Grisoft
2008-01-17 17:11 . 2008-01-17 17:11 406 –a—— C:\WINDOWS\system32\ioloBootDefrag.cfg
2008-01-17 17:05 . 2007-07-30 19:19 207,736 –a—— C:\WINDOWS\system32\muweb.dll
2008-01-17 16:45 . 2008-01-17 16:45 d——– C:\Documents and Settings\LocalService\Application Data\iolo
2008-01-17 16:38 . 2008-01-17 16:38 74,703 –a—— C:\WINDOWS\system32\mfc45.dll
2008-01-17 16:32 . 2008-01-17 17:10 d——– C:\Documents and Settings\brett\Application Data\iolo
2008-01-17 16:32 . 2008-01-17 17:10 d——– C:\Documents and Settings\All Users\Application Data\iolo
2008-01-17 15:41 . 2006-04-27 17:49 288,417 –a—— C:\WINDOWS\system32\SrchSTS.exe
2008-01-17 15:41 . 2003-06-05 21:13 53,248 –a—— C:\WINDOWS\system32\Process.exe
2008-01-17 15:41 . 2004-07-31 18:50 51,200 –a—— C:\WINDOWS\system32\dumphive.exe
2008-01-17 12:36 . 2008-01-17 15:56 d——– C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-01-17 12:25 . 2008-01-17 12:25 d——– C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-01-15 22:52 . 2008-01-15 22:52 224 –a—— C:\WINDOWS\system32\9B13A86D.plf
2008-01-15 22:49 . 2008-02-07 19:59 d——– C:\Program Files\XoftSpySE
2008-01-15 22:48 . 2008-01-15 22:48 d——– C:\Documents and Settings\All Users\Application Data\Downloaded Installations
2008-01-13 08:23 . 2008-01-13 08:23 d–hs—- C:\Documents and Settings\LocalService\UserData
2008-01-12 17:57 . 2008-01-12 17:57 145 –a—— C:\WINDOWS\system32\winver.bat

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-02 15:30 ——— d—–w C:\Program Files\Symantec
2008-01-27 15:22 ——— d—–w C:\Program Files\Lavasoft
2008-01-27 15:22 ——— d—–w C:\Documents and Settings\brett\Application Data\Lavasoft
2008-01-27 05:02 ——— d—–w C:\Documents and Settings\All Users\Application Data\Symantec
2008-01-27 04:08 ——— d—–w C:\Program Files\Microsoft ActiveSync
2008-01-17 22:04 15,360 —-a-w C:\WINDOWS\system32\ctfmon.exe
2008-01-17 21:11 ——— d—–w C:\Program Files\QuickTime
2008-01-13 00:35 ——— d—–w C:\Program Files\Lexmark Fax Solutions
2008-01-13 00:35 ——— d—–w C:\Program Files\Lexmark 4300 Series
2007-12-14 16:32 12,632 —-a-w C:\WINDOWS\system32\lsdelete.exe
2007-05-24 18:58 249,856 —-a-w C:\WINDOWS\inf\WG511v2\InsDrv2k.exe
2006-12-04 15:38 53,248 —-a-w C:\WINDOWS\inf\WG511v2\snetcfg.exe
2006-12-04 15:38 265,984 —-a-w C:\WINDOWS\inf\WG511v2\WG511v2XP.sys
2006-12-04 15:38 249,856 —-a-w C:\WINDOWS\inf\WG511v2\InsDrvlh.exe
2006-12-04 15:38 212,992 —-a-w C:\WINDOWS\inf\WG511v2\CopyWHQLDriver.exe
2006-12-04 15:38 21,376 —-a-w C:\WINDOWS\inf\WG511v2\wlndis51.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-01-17 17:04 15360]
"H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\wcescomm .exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe" [ ]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, wowfx.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^NETGEAR WG511v2 Smart Wizard.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\NETGEAR WG511v2 Smart Wizard.lnk
backup=C:\WINDOWS\pss\NETGEAR WG511v2 Smart Wizard.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^SMC2862W-G 54Mbps WLAN Monitor.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\SMC2862W-G 54Mbps WLAN Monitor.lnk
backup=C:\WINDOWS\pss\SMC2862W-G 54Mbps WLAN Monitor.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
–a—— 2008-01-12 21:38 39792 C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avp]
C:\WINDOWS\TEMP\winE0.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp]
–a—— 2008-01-26 13:33 51048 C:\Program Files\Common Files\Symantec Shared\ccApp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
–a—— 2008-01-17 17:04 15360 C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DiskeeperSystray]
–a—— 2008-01-19 09:31 180312 C:\Program Files\Executive Software\Diskeeper\DkIcon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EzPrint]
–a—— 2008-01-12 21:12 94208 C:\Program Files\Lexmark 4300 Series\ezprint.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FaxCenterServer]
–a—— 2008-01-12 21:39 299008 C:\Program Files\Lexmark Fax Solutions\fm3032.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H/PC Connection Agent]
–a—— 2008-01-26 22:39 1697280 C:\PROGRA~1\MI3AA1~1\wcescomm.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Load]
C:\WINDOWS\system32\ljjif.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\lxcemon.exe]
–a—— 2008-01-12 21:11 192512 C:\Program Files\Lexmark 4300 Series\lxcemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\smgr]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\vptray]
C:\PROGRA~1\SYMANT~1\VPTray.exe

R3 CBEN5;Xircom CardBus Ethernet 10/100 Adapter family Driver;C:\WINDOWS\system32\DRIVERS\cben5.sys [2001-08-17 07:13]
R3 Maestro;ESS Maestro2E Audio Driver (WDM);C:\WINDOWS\system32\drivers\essm2e.sys [2002-06-03 09:20]
S3 SymIM;Symantec Network Security Intermediate Filter Service;C:\WINDOWS\system32\DRIVERS\SymIM.sys []
S3 SymIMMP;SymIMMP;C:\WINDOWS\system32\DRIVERS\SymIM.sys []
S3 WlanUIG;SMC 802.11g 2862W-G Driver;C:\WINDOWS\system32\DRIVERS\2862w.sys [2004-04-06 11:52]

.
Contents of the 'Scheduled Tasks' folder
"2008-02-02 15:23:39 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-02-08 01:15:37 C:\WINDOWS\Tasks\XoftSpySE 2.job"
- C:\Program Files\XoftSpySE\XoftSpy.exe
"2008-01-27 16:29:03 C:\WINDOWS\Tasks\XoftSpySE.job"
- C:\Program Files\XoftSpySE\XoftSpy.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-07 22:12:19
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-02-07 22:13:25
ComboFix-quarantined-files.txt 2008-02-08 03:13:03
ComboFix2.txt 2008-02-08 00:54:24
ComboFix3.txt 2008-02-07 23:11:01
ComboFix4.txt 2008-02-02 15:57:39
.
2008-01-20 10:17:29 — E O F —

the second one

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:14:56 PM, on 2/7/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\atievxx.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\Executive Software\Diskeeper\DkService.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm .exe"
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_03\bin\npjpi150_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_03\bin\npjpi150_03.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.5.0) - http://javadl-esd.sun.com/update/1.5.0/jin…indows-i586.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\Diskeeper\DkService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE

–
End of file - 3074 bytes

my computer did not do anything the privacy setting has stayed the same and no error messages! still runs a little slow but, slow is okay

LDTate

Post #8February 8, 2008, 3:24 AM UTC

Open notepad and copy/paste the text in the quotebox below into it:

File::
C:\WINDOWS\TEMP\winE0.exe
C:\WINDOWS\system32\ljjif.exe

Registry::
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders" = msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avp]

Save this as Save this as "CFScript"

[external image: Posted Image]

Drag CFScript.txt into ComboFix.exe

Then post the results log and a new HijackThis log.

Click HERE Click the Download Now and Save, Install, Update and run a full scan.

Empty Recycle Bin

Reboot and "copy/paste" a new log file into this thread.
Also please describe how your computer behaves at the moment

notsosmart

Post #9February 8, 2008, 3:36 AM UTC

here ya go…the next two

ComboFix 08-02.05.3 - brett 2008-02-07 22:30:23.5 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.99 [GMT -5:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\brett\Desktop\CFScript.txt
* Created a new restore point

FILE
C:\WINDOWS\system32\ljjif.exe
C:\WINDOWS\TEMP\winE0.exe
.

((((((((((((((((((((((((( Files Created from 2008-01-08 to 2008-02-08 )))))))))))))))))))))))))))))))
.

2008-02-07 22:07 . 2004-08-04 07:00 388,608 –a—— C:\kmd.exe
2008-02-02 11:24 . 2008-02-02 11:24 d——– C:\Program Files\Trend Micro
2008-02-02 09:56 . 2004-08-04 07:00 260,272 -r-hs—- C:\cmldr
2008-01-27 10:19 . 2008-01-27 10:27 d——– C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-01-27 10:16 . 2008-01-27 10:16 d——– C:\Program Files\Common Files\Wise Installation Wizard
2008-01-26 23:44 . 2008-01-26 23:44 d——– C:\Program Files\Symantec_Client_Security
2008-01-25 16:01 . 2008-01-25 16:01 1,580 –a—— C:\WINDOWS\system32\tmp.reg
2008-01-25 16:00 . 2007-09-05 23:22 289,144 –a—— C:\WINDOWS\system32\VCCLSID.exe
2008-01-25 16:00 . 2007-12-20 23:11 81,920 –a—— C:\WINDOWS\system32\IEDFix.exe
2008-01-25 16:00 . 2007-10-03 23:36 25,600 –a—— C:\WINDOWS\system32\WS2Fix.exe
2008-01-25 07:34 . 2008-01-25 07:34 11 –a—— C:\AuResult.ini
2008-01-24 22:24 . 2008-01-26 12:03 d——– C:\Documents and Settings\brett\.housecall6.6
2008-01-24 22:23 . 2008-01-24 22:23 d——– C:\WINDOWS\Sun
2008-01-24 21:48 . 2005-04-13 03:48 49,265 –a—— C:\WINDOWS\system32\jpicpl32.cpl
2008-01-24 21:43 . 2008-01-24 21:47 d——– C:\Program Files\Java
2008-01-24 21:41 . 2008-01-24 21:41 d——– C:\Program Files\Common Files\Java
2008-01-24 20:49 . 2008-01-24 22:24 102,664 –a—— C:\WINDOWS\system32\drivers\tmcomm.sys
2008-01-24 20:46 . 2008-01-26 22:56 d——– C:\WINDOWS\system32\HouseCall 6.6
2008-01-20 12:56 . 2008-01-20 12:56 d——– C:\Documents and Settings\brett\Application Data\Symantec
2008-01-19 23:37 . 2008-01-19 23:39 d——– C:\Program Files\Apple Software Update
2008-01-19 23:37 . 2008-01-19 23:37 d——– C:\Documents and Settings\All Users\Application Data\Apple
2008-01-18 22:59 . 2008-02-07 19:35 d——– C:\Program Files\Common Files\Symantec Shared
2008-01-18 20:40 . 2008-01-18 20:40 d——– C:\WINDOWS\system32\bits
2008-01-18 20:40 . 2007-03-29 07:56 7,168 —–c— C:\WINDOWS\system32\dllcache\bitsprx4.dll
2008-01-18 20:40 . 2007-03-29 07:56 7,168 –a—— C:\WINDOWS\system32\bitsprx4.dll
2008-01-17 21:15 . 2008-01-17 21:15 d——– C:\Documents and Settings\All Users\Application Data\Grisoft
2008-01-17 17:11 . 2008-01-17 17:11 406 –a—— C:\WINDOWS\system32\ioloBootDefrag.cfg
2008-01-17 17:05 . 2007-07-30 19:19 207,736 –a—— C:\WINDOWS\system32\muweb.dll
2008-01-17 16:45 . 2008-01-17 16:45 d——– C:\Documents and Settings\LocalService\Application Data\iolo
2008-01-17 16:38 . 2008-01-17 16:38 74,703 –a—— C:\WINDOWS\system32\mfc45.dll
2008-01-17 16:32 . 2008-01-17 17:10 d——– C:\Documents and Settings\brett\Application Data\iolo
2008-01-17 16:32 . 2008-01-17 17:10 d——– C:\Documents and Settings\All Users\Application Data\iolo
2008-01-17 15:41 . 2006-04-27 17:49 288,417 –a—— C:\WINDOWS\system32\SrchSTS.exe
2008-01-17 15:41 . 2003-06-05 21:13 53,248 –a—— C:\WINDOWS\system32\Process.exe
2008-01-17 15:41 . 2004-07-31 18:50 51,200 –a—— C:\WINDOWS\system32\dumphive.exe
2008-01-17 12:36 . 2008-01-17 15:56 d——– C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-01-17 12:25 . 2008-01-17 12:25 d——– C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-01-15 22:52 . 2008-01-15 22:52 224 –a—— C:\WINDOWS\system32\9B13A86D.plf
2008-01-15 22:49 . 2008-02-07 19:59 d——– C:\Program Files\XoftSpySE
2008-01-15 22:48 . 2008-01-15 22:48 d——– C:\Documents and Settings\All Users\Application Data\Downloaded Installations
2008-01-13 08:23 . 2008-01-13 08:23 d–hs—- C:\Documents and Settings\LocalService\UserData
2008-01-12 17:57 . 2008-01-12 17:57 145 –a—— C:\WINDOWS\system32\winver.bat

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-02 15:30 ——— d—–w C:\Program Files\Symantec
2008-01-27 15:22 ——— d—–w C:\Program Files\Lavasoft
2008-01-27 15:22 ——— d—–w C:\Documents and Settings\brett\Application Data\Lavasoft
2008-01-27 05:02 ——— d—–w C:\Documents and Settings\All Users\Application Data\Symantec
2008-01-27 04:08 ——— d—–w C:\Program Files\Microsoft ActiveSync
2008-01-17 22:04 15,360 —-a-w C:\WINDOWS\system32\ctfmon.exe
2008-01-17 21:11 ——— d—–w C:\Program Files\QuickTime
2008-01-13 00:35 ——— d—–w C:\Program Files\Lexmark Fax Solutions
2008-01-13 00:35 ——— d—–w C:\Program Files\Lexmark 4300 Series
2007-12-14 16:32 12,632 —-a-w C:\WINDOWS\system32\lsdelete.exe
2007-05-24 18:58 249,856 —-a-w C:\WINDOWS\inf\WG511v2\InsDrv2k.exe
2006-12-04 15:38 53,248 —-a-w C:\WINDOWS\inf\WG511v2\snetcfg.exe
2006-12-04 15:38 265,984 —-a-w C:\WINDOWS\inf\WG511v2\WG511v2XP.sys
2006-12-04 15:38 249,856 —-a-w C:\WINDOWS\inf\WG511v2\InsDrvlh.exe
2006-12-04 15:38 212,992 —-a-w C:\WINDOWS\inf\WG511v2\CopyWHQLDriver.exe
2006-12-04 15:38 21,376 —-a-w C:\WINDOWS\inf\WG511v2\wlndis51.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-01-17 17:04 15360]
"H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\wcescomm .exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe" [ ]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, wowfx.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^NETGEAR WG511v2 Smart Wizard.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\NETGEAR WG511v2 Smart Wizard.lnk
backup=C:\WINDOWS\pss\NETGEAR WG511v2 Smart Wizard.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^SMC2862W-G 54Mbps WLAN Monitor.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\SMC2862W-G 54Mbps WLAN Monitor.lnk
backup=C:\WINDOWS\pss\SMC2862W-G 54Mbps WLAN Monitor.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
–a—— 2008-01-12 21:38 39792 C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp]
–a—— 2008-01-26 13:33 51048 C:\Program Files\Common Files\Symantec Shared\ccApp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
–a—— 2008-01-17 17:04 15360 C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DiskeeperSystray]
–a—— 2008-01-19 09:31 180312 C:\Program Files\Executive Software\Diskeeper\DkIcon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EzPrint]
–a—— 2008-01-12 21:12 94208 C:\Program Files\Lexmark 4300 Series\ezprint.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FaxCenterServer]
–a—— 2008-01-12 21:39 299008 C:\Program Files\Lexmark Fax Solutions\fm3032.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H/PC Connection Agent]
–a—— 2008-01-26 22:39 1697280 C:\PROGRA~1\MI3AA1~1\wcescomm.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Load]
C:\WINDOWS\system32\ljjif.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\lxcemon.exe]
–a—— 2008-01-12 21:11 192512 C:\Program Files\Lexmark 4300 Series\lxcemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\smgr]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\vptray]
C:\PROGRA~1\SYMANT~1\VPTray.exe

R3 CBEN5;Xircom CardBus Ethernet 10/100 Adapter family Driver;C:\WINDOWS\system32\DRIVERS\cben5.sys [2001-08-17 07:13]
R3 Maestro;ESS Maestro2E Audio Driver (WDM);C:\WINDOWS\system32\drivers\essm2e.sys [2002-06-03 09:20]
S3 SymIM;Symantec Network Security Intermediate Filter Service;C:\WINDOWS\system32\DRIVERS\SymIM.sys []
S3 SymIMMP;SymIMMP;C:\WINDOWS\system32\DRIVERS\SymIM.sys []
S3 WlanUIG;SMC 802.11g 2862W-G Driver;C:\WINDOWS\system32\DRIVERS\2862w.sys [2004-04-06 11:52]

.
Contents of the 'Scheduled Tasks' folder
"2008-02-02 15:23:39 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-02-08 01:15:37 C:\WINDOWS\Tasks\XoftSpySE 2.job"
- C:\Program Files\XoftSpySE\XoftSpy.exe
"2008-01-27 16:29:03 C:\WINDOWS\Tasks\XoftSpySE.job"
- C:\Program Files\XoftSpySE\XoftSpy.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-07 22:32:33
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-02-07 22:33:38
ComboFix-quarantined-files.txt 2008-02-08 03:33:21
ComboFix2.txt 2008-02-08 03:13:27
ComboFix3.txt 2008-02-08 00:54:24
ComboFix4.txt 2008-02-07 23:11:01
ComboFix5.txt 2008-02-02 15:57:39
.
2008-01-20 10:17:29 — E O F —

second log……

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:36:08 PM, on 2/7/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\atievxx.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\Executive Software\Diskeeper\DkService.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm .exe"
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_03\bin\npjpi150_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_03\bin\npjpi150_03.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.5.0) - http://javadl-esd.sun.com/update/1.5.0/jin…indows-i586.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\Diskeeper\DkService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE

–
End of file - 3041 bytes

LDTate

Post #10February 8, 2008, 3:39 AM UTC

Click "Start"> "Run"> type in Regedit tap Enter Key

Make sure "My Computer" is highlighted

Click "Edit"> "Find"
Type in wowfx.dll tap Enter Key.
Right Click on the file if found and select "Delete"

Tap the "F3" Key to find the next entry of the file. Continue using the "F3" Key until it's finished searching.

Close Regedit.

Let me know if that file was found.

Empty Recycle Bin

Reboot and "copy/paste" a new HijackThis log file into this thread.
Also please describe how your computer behaves at the moment.

notsosmart

Post #11February 8, 2008, 4:41 AM UTC

ran scan and these viruses/threats were found… catchme2008-02-02 - trojan horse bho.czj ctfmon.exe.tmp.vir - virus found lop bfbuieif.dll.vir - trojan horse dropper dqimfwhb.dll.vir - virus found lop kejoduao.dll.vir - virus found lop trlvibjw.dll.vir - virus found lop urspm.exe.vir - trojan horse dropper vcsmgwch.dll.vir - virus found lop ygzvcxdn.dll.vir - trojan horse generic9 of course all in qoobox\quarantine\c\windows\system32\then whatever the file name above is… said there were 9 files healed…not sure if that means anything…. 5 moved to vault and 4 deleted..

notsosmart

Post #12February 8, 2008, 4:49 AM UTC

nothing in recycle bin to empty…. found 4 wowfx.dll will post a new list momentarily when computer reboots… still running slow

notsosmart

Post #13February 8, 2008, 5:07 AM UTC

and here is the log…

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:56:22 PM, on 2/7/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\atievxx.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\Executive Software\Diskeeper\DkService.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\rundll32.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm .exe"
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_03\bin\npjpi150_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_03\bin\npjpi150_03.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.5.0) - http://javadl-esd.sun.com/update/1.5.0/jin…indows-i586.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\Diskeeper\DkService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE

–
End of file - 3853 bytes

LDTate

Post #14February 8, 2008, 9:43 PM UTC

1.Click Start > Settings > Control Panel.
2.Next, open Add/Remove Programs and remove if listed:
Symantec\LiveUpdate
Ad-Aware 2007

Reboot and "copy/paste" a new HijackThis log file into this thread.

Also please describe how your computer behaves at the moment.

notsosmart

Post #15February 9, 2008, 1:46 AM UTC

the privacy setting did not move, for once…
running a scan…
symantec was already off, took off live update and ad-adware was already off…

here is the new hijack

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:45:43 PM, on 2/8/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\atievxx.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\Executive Software\Diskeeper\DkService.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\Grisoft\AVG7\avgw.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm .exe"
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_03\bin\npjpi150_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_03\bin\npjpi150_03.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.5.0) - http://javadl-esd.sun.com/update/1.5.0/jin…indows-i586.cab
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\Diskeeper\DkService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

–
End of file - 3329 bytes

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] W32.TRATS!INF ....VUNDO IS GONE BUT, metajuan stil

✨ Ask AI

Ask AI