[Closed] Infected: ads.k8l.info, duplicate Ati2evxx.exe, adware a

Hi there…

I came across this forum during a frantic, late-night/early morning search for ways to figure out what's going on in the mysterious machine that is my computer. Yesterday afternoon my internet connection slowed down and started to freeze up sporadically. I ran a scan with AVG and quarrantined/deleted what it found. However, when I started using the internet again I noticed that a large number of websites I had not visited kept appearing in the log in time with each 'mini-freeze.'

No pop-ups or new windows were opening to these sites, but when I checked the 'properties' of each link it said I had visited the site 7 times or more with the last visit being logged as the actual time I was looking at the link, but I'd never even seen another window open. Most of the links in the history look like this::

http://ads.k8l.info/media/servlet/view/dyn…TTC=1&GNW;=0


There also seems to be a duplicate Ati2evxx.exe running.

I tried Windows CleanUp and then tried another scan with Combofix. Still nothing….but here is the log…..




ComboFix 08-02-14.1 - claudia 2008-02-13 23:32:55.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.514 [GMT -5:00]
Running from: C:\Documents and Settings\[removed]\Local
Settings\Temporary Internet Files\Content.IE5\FDC0OTTB\ComboFix[1].exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE
INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions)))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\claudia\Application Data\MCROSO~1
C:\Documents and Settings\claudia\Application Data\MCROSO~1\M?crosoft\
C:\Program Files\web buying
C:\Program Files\web buying\v1.8.8\wbuninst.exe
C:\WINDOWS\cookies.ini
C:\WINDOWS\mrofinu572.exe
C:\WINDOWS\system32\ac1
C:\WINDOWS\system32\bszip.dll
C:\WINDOWS\system32\khffcdb.dll
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\nGpxx01
C:\WINDOWS\system32\nGpxx01\nGpxx011065.exe
C:\WINDOWS\system32\pac.txt
C:\WINDOWS\system32\pkwgkqim.ini

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services)))))))))))))))))))))))))))))))))))))))))))))))))

.
——-\nm


((((((((((((((((((((((((( Files Created from 2008-01-14 to 2008-02-14 )))))))))))))))))))))))))))))))
.

2008-02-13 20:28 . 2008-02-13 20:28 d——– C:\WINDOWS\system32\wd11
2008-02-13 20:28 . 2008-02-13 20:33 d——– C:\WINDOWS\system32\vb6
2008-02-13 20:28 . 2008-02-13 20:28 d——– C:\WINDOWS\system32\kp9
2008-02-13 20:28 . 2008-02-13 20:28 d——– C:\WINDOWS\system32\bk5
2008-01-24 11:26 . 2008-01-24 11:26 d——– C:\ProgramFiles\Microsoft Works
2008-01-24 11:25 . 2008-01-24 11:25 d——– C:\Program Files\MSBuild
2008-01-24 11:23 . 2008-01-24 11:23 d——– C:\ProgramFiles\Microsoft.NET
2008-01-24 11:16 . 2008-02-13 17:31 d——– C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-01-24 09:26 . 2007-04-09 13:23 28,040 –a—— C:\WINDOWS\system32\mdimon.dll
2008-01-24 09:18 . 2008-01-24 09:18 dr-h—– C:\MSOCache
2008-01-24 09:05 . 2007-07-30 19:19 271,224 –a—— C:\WINDOWS\system32\mucltui.dll
2008-01-24 09:05 . 2007-07-3019:19 30,072 –a—— C:\WINDOWS\system32\mucltui.dll.mui
2008-01-22 16:16 . 2008-01-22 16:16 d——– C:\Documents and Settings\claudia\Application Data\Grisoft
2008-01-22 16:16 . 2007-05-30 07:10 10,872 –a—— C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-01-22 15:36 . 2008-01-22 18:34 d——– C:\QUARANTINE
2008-01-22 14:18 . 2008-01-22 14:18 d——– C:\Documents and Settings\Administrator\Application Data\AVG7
2008-01-22 12:46 . 2008-01-22 12:46 d——– C:\Documents and Settings\LocalService\Application Data\AVG7
2008-01-22 12:46 . 2008-02-13 23:08 d——– C:\Documents and Settings\claudia\Application Data\AVG7
2008-01-22 12:45 . 2008-01-22 16:16 d——– C:\Documents and Settings\All Users\Application Data\Grisoft
2008-01-22 12:45 . 2008-01-22 16:19 d——– C:\Documents and Settings\All Users\Application Data\avg7
2008-01-22 09:40 . 2008-01-22 10:12 158,208 –a—— C:\WINDOWS\system32\dllcache\msconfig.exe
2008-01-22 09:34 . 2008-01-22 09:34 d——– C:\Program Files\CleanUp!
2008-01-22 09:32 . 2008-01-24 08:56 d——– C:\Program Files\SUPERAntiSpyware
2008-01-22 09:32 . 2008-01-24 08:57 d——– C:\Documents and Settings\claudia\Application Data\SUPERAntiSpyware.com
2008-01-22 09:32 . 2008-01-22 09:32 d——– C:\Documents and
Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-01-21 16:49 . 2008-01-24 09:00 d——– C:\VundoFix Backups
2008-01-21 16:49 . 2008-01-24 08:56 d——– C:\Program Files\Common Files\Wise Installation Wizard
2008-01-21 16:25 . 2008-01-21 16:26 d——– C:\WINDOWS\ERUNT
2008-01-21 16:25 . 2008-02-13 23:31 d——– C:\sdfix
2008-01-21 16:23 . 2008-01-22 09:35 d——– C:\Program Files\RogueRemover FREE
2008-01-21 16:20 . 2008-01-21 16:21 2,604 –a—— C:\WINDOWS\system32\tmp.reg
2008-01-21 13:51 . 2006-11-17 03:06 1,495,552 –a—— C:\WINDOWS\system32\epoPGPsdk.dll
2008-01-21 13:30 . 2008-01-21 13:30 d——– C:\Program
Files\Common Files\Cisco Systems
2008-01-21 13:28 . 2008-01-21 13:48 d——– C:\Program Files\Common Files\Network Associates
2008-01-21 13:28 . 2008-01-24 08:55 d——– C:\Documents and Settings\All Users\Application Data\Network Associates
2008-01-19 23:49 . 2008-02-13 21:37 d——– C:\Temp

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-21 18:37 ——— d—–w C:\Documents and
Settings\claudia\Application Data\U3
2008-01-21 18:25 ——— d—–w C:\Program Files\CA
2008-01-20 04:55 ——— d—–w C:\Program Files\QuickTime
2008-01-20 04:55 ——— d—–w C:\Program Files\Picasa2
2008-01-20 04:55 ——— d—–w C:\Program Files\DellSupport
2007-12-20 20:40 ——— d—–w C:\Documents and Settings\All Users\Application Data\Dell
2007-12-18 09:51 179,584 —-a-w C:\WINDOWS\system32\drivers\mrxdav.sys
2005-12-23 00:48 54,008 —-a-w C:\Documents and Settings\claudia\Application Data\GDIPFONTCACHEV1.DAT
2006-09-13 05:17 1,500,575 –sha-w C:\WINDOWS\system32\hhkmp.bak1
2006-09-14 05:21 1,510,641 –sha-w C:\WINDOWS\system32\hhkmp.bak2
.

—-a-w		   416,256 2008-01-22 19:59:35  C:\Program Files\Grisoft\AVG7\avgcc .exe
—-a-w		   145,920 2008-01-22 19:17:59  C:\Program Files\Grisoft\AVG7\avgw .exe

((((((((((((((((((((((((((((((((((((( Reg Loading Points))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper
Objects\{2688d190-652e-4674-906f-703cf0f86bea}]
C:\WINDOWS\system32\uqwoirk.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper
Objects\{FB51306D-FBFC-40A0-9405-F5336C7889AC}]
2008-02-07 20:07 217088 –a—— C:\Program Files\Windows Media
Player\vaxula89104.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [ ]
"Uaol"="C:\DOCUME~1\claudia\APPLIC~1\MCROSO~1\chkntfs.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [ ]
"IntelZeroConfig"="C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" [ ]
"IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [ ]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-01-22 16:19 579072]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware
7.5\avgas.exe" [2007-06-11 04:25 6731312]
"MMTray"="C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe" [ ]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-01-22 16:19 219136]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_LOCAL_MACHINE\software\microsoft\windows
nt\currentversion\winlogon\notify\gebxurp]
gebxurp.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start
Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Start
Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start
Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
path=C:\Documents and Settings\All Users\Start
Menu\Programs\Startup\Adobe Reader Synchronizer.lnk
backup=C:\WINDOWS\pss\Adobe Reader Synchronizer.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start
Menu^Programs^Startup^Digital Line Detect.lnk]
path=C:\Documents and Settings\All Users\Start
Menu\Programs\Startup\Digital Line Detect.lnk
backup=C:\WINDOWS\pss\Digital Line Detect.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start
Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start
Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupreg\AdobeUpdater]
C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Apoint]
C:\Program Files\Apoint\Apoint.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupreg\Corel Photo Downloader]
C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupreg\Dell QuickSet]
C:\Program Files\Dell\QuickSet\quickset.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupreg\DellSupport]
C:\Program Files\DellSupport\DSAgnt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupreg\DellTransferAgent]
C:\Documents and Settings\All Users\Application
Data\Dell\TransferAgent\TransferAgent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dla]
C:\WINDOWS\system32\dla\tfswctrl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupreg\DVDLauncher]
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray]
C:\WINDOWS\ehome\ehtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupreg\f44d1563]
C:\WINDOWS\system32\miqkgwkp.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupreg\HostManager]
C:\Program Files\Common Files\AOL\1153535609\ee\AOLHostManager.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MimBoot]
C:\PROGRA~1\MUSICM~1\MUSICM~3\mimboot.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MMTray]
C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupreg\NI.UWA6P_0001_N91M1807]
C:\WINDOWS\Downloaded Program
Files\CONFLICT.3\UWA6P_0001_N91M1807NetInstaller.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupreg\Picasa Media Detector]
C:\Program Files\Picasa2\PicasaMediaDetector.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupreg\TkBellExe]
C:\Program Files\Common Files\Real\Update_OB\realsched.exe

R2 LogWatch;Event Log Watch;"C:\Program
Files\CA\SharedComponents\CA_LIC\LogWatNT.exe" [2003-08-21 08:42]
S3 CA_LIC_CLNT;CA License Client;"C:\Program
Files\CA\SharedComponents\CA_LIC\lic98rmt.exe" [2003-08-21 08:42]
S3 CA_LIC_SRVR;CA License Server;"C:\Program
Files\CA\SharedComponents\CA_LIC\lic98rmtd.exe" [2003-08-21 08:42]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}]
\Shell\AutoRun\command - E:\setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{57d76eba-6c9d-11dc-9de4-001422e5d080}]
\Shell\AutoRun\command - E:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{88b999ce-2524-11dc-9ddd-001422e5d080}]
\Shell\AutoRun\command - E:\Autorun.exe /run
\Shell\Shell00\Command - E:\Autorun.exe /run
\Shell\Shell01\Command - E:\Autorun.exe /action
\Shell\Shell02\Command - E:\Autorun.exe /uninstall

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by
Gmer, http://www.gmer.net
Rootkit scan 2008-02-13 23:38:18
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
———————— Other Running Processes ————————
.
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Netscape Internet Service\ncupdatesvc.exe
C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\ehome\mcrdsvc.exe
C:\WINDOWS\system32\imapi.exe
C:\WINDOWS\system32\dllhost.exe
.
**************************************************************************
.
Completion time: 2008-02-13 23:41:55 - machine was rebooted
ComboFix-quarantined-files.txt 2008-02-14 04:41:52
.
2008-02-13 22:33:05 — E O F —




So…please help? Save my computer?????

ComboFix 08-02-24.2 - claudia 2008-02-24 2:08:54.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.642 [GMT -5:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\Windows Media Player\vaxula89104.dll

.
((((((((((((((((((((((((( Files Created from 2008-01-24 to 2008-02-24 )))))))))))))))))))))))))))))))
.

2008-02-13 20:28 . 2008-02-13 20:28 d——– C:\WINDOWS\system32\wd11
2008-02-13 20:28 . 2008-02-13 20:33 d——– C:\WINDOWS\system32\vb6
2008-02-13 20:28 . 2008-02-13 20:28 d——– C:\WINDOWS\system32\kp9
2008-02-13 20:28 . 2008-02-13 20:28 d——– C:\WINDOWS\system32\bk5
2008-01-24 11:26 . 2008-01-24 11:26 d——– C:\Program Files\Microsoft Works
2008-01-24 11:25 . 2008-01-24 11:25 d——– C:\Program Files\MSBuild
2008-01-24 11:23 . 2008-01-24 11:23 d——– C:\Program Files\Microsoft.NET
2008-01-24 11:16 . 2008-02-13 17:31 d——– C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-01-24 09:26 . 2007-04-09 13:23 28,040 –a—— C:\WINDOWS\system32\mdimon.dll
2008-01-24 09:18 . 2008-01-24 09:18 dr-h—– C:\MSOCache
2008-01-24 09:05 . 2007-07-30 19:19 271,224 –a—— C:\WINDOWS\system32\mucltui.dll
2008-01-24 09:05 . 2007-07-30 19:19 30,072 –a—— C:\WINDOWS\system32\mucltui.dll.mui

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-14 04:08 ——— d—–w C:\Documents and Settings\claudia\Application Data\AVG7
2008-01-27 07:45 3,766 –sha-w C:\WINDOWS\system32\KGyGaAvL.sys
2008-01-24 13:57 ——— d—–w C:\Documents and Settings\claudia\Application Data\SUPERAntiSpyware.com
2008-01-24 13:56 ——— d—–w C:\Program Files\SUPERAntiSpyware
2008-01-24 13:56 ——— d—–w C:\Program Files\Common Files\Wise Installation Wizard
2008-01-24 13:55 ——— d—–w C:\Documents and Settings\All Users\Application Data\Network Associates
2008-01-22 21:19 ——— d—–w C:\Documents and Settings\All Users\Application Data\avg7
2008-01-22 21:16 ——— d—–w C:\Documents and Settings\claudia\Application Data\Grisoft
2008-01-22 21:16 ——— d—–w C:\Documents and Settings\All Users\Application Data\Grisoft
2008-01-22 19:18 ——— d—–w C:\Documents and Settings\Administrator\Application Data\AVG7
2008-01-22 17:46 ——— d—–w C:\Documents and Settings\LocalService\Application Data\AVG7
2008-01-22 15:12 158,208 —-a-w C:\WINDOWS\system32\dllcache\msconfig.exe
2008-01-22 15:12 158,208 —-a-w C:\WINDOWS\pchealth\helpctr\binaries\MSConfig.exe
2008-01-22 14:35 ——— d—–w C:\Program Files\RogueRemover FREE
2008-01-22 14:34 ——— d—–w C:\Program Files\CleanUp!
2008-01-22 14:32 ——— d—–w C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-01-21 18:48 ——— d—–w C:\Program Files\Common Files\Network Associates
2008-01-21 18:37 ——— d—–w C:\Documents and Settings\claudia\Application Data\U3
2008-01-21 18:30 ——— d—–w C:\Program Files\Common Files\Cisco Systems
2008-01-21 18:25 ——— d—–w C:\Program Files\CA
2008-01-20 04:55 ——— d—–w C:\Program Files\QuickTime
2008-01-20 04:55 ——— d—–w C:\Program Files\Picasa2
2008-01-20 04:55 ——— d—–w C:\Program Files\DellSupport
2008-01-11 05:53 44,544 —-a-w C:\WINDOWS\system32\dllcache\pngfilt.dll
2007-12-19 23:01 347,136 —-a-w C:\WINDOWS\system32\dllcache\dxtmsft.dll
2007-12-18 09:51 179,584 ——w C:\WINDOWS\system32\dllcache\mrxdav.sys
2007-12-08 05:21 3,592,192 —-a-w C:\WINDOWS\system32\dllcache\mshtml.dll
2007-12-06 11:01 625,664 ——w C:\WINDOWS\system32\dllcache\iexplore.exe
2007-12-06 11:00 70,656 ——w C:\WINDOWS\system32\dllcache\ie4uinit.exe
2007-12-06 11:00 13,824 ——w C:\WINDOWS\system32\dllcache\ieudinit.exe
2007-12-06 04:59 161,792 ——w C:\WINDOWS\system32\dllcache\ieakui.dll
2007-12-04 18:38 550,912 —-a-w C:\WINDOWS\system32\oleaut32.dll
2007-12-04 18:38 550,912 ——w C:\WINDOWS\system32\dllcache\oleaut32.dll
2005-12-23 00:48 54,008 —-a-w C:\Documents and Settings\claudia\Application Data\GDIPFONTCACHEV1.DAT
2006-09-13 05:17 1,500,575 –sha-w C:\WINDOWS\system32\hhkmp.bak1
2006-09-14 05:21 1,510,641 –sha-w C:\WINDOWS\system32\hhkmp.bak2
.

—-a-w		   416,256 2008-01-22 19:59:35  C:\Program Files\Grisoft\AVG7\avgcc .exe
—-a-w		   145,920 2008-01-22 19:17:59  C:\Program Files\Grisoft\AVG7\avgw .exe

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2688d190-652e-4674-906f-703cf0f86bea}]
C:\WINDOWS\system32\uqwoirk.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [ ]
"Uaol"="C:\DOCUME~1\claudia\APPLIC~1\MCROSO~1\chkntfs.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [ ]
"IntelZeroConfig"="C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" [ ]
"IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [ ]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-01-22 16:19 579072]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 04:25 6731312]
"MMTray"="C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe" [ ]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-01-22 16:19 219136]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\gebxurp]
gebxurp.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk
backup=C:\WINDOWS\pss\Adobe Reader Synchronizer.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk
backup=C:\WINDOWS\pss\Digital Line Detect.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeUpdater]
C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Apoint]
C:\Program Files\Apoint\Apoint.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Corel Photo Downloader]
C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Dell QuickSet]
C:\Program Files\Dell\QuickSet\quickset.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupport]
C:\Program Files\DellSupport\DSAgnt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellTransferAgent]
C:\Documents and Settings\All Users\Application Data\Dell\TransferAgent\TransferAgent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dla]
C:\WINDOWS\system32\dla\tfswctrl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDLauncher]
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray]
C:\WINDOWS\ehome\ehtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\f44d1563]
C:\WINDOWS\system32\miqkgwkp.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager]
C:\Program Files\Common Files\AOL\1153535609\ee\AOLHostManager.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MimBoot]
C:\PROGRA~1\MUSICM~1\MUSICM~3\mimboot.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MMTray]
C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NI.UWA6P_0001_N91M1807]
C:\WINDOWS\Downloaded Program Files\CONFLICT.3\UWA6P_0001_N91M1807NetInstaller.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Picasa Media Detector]
C:\Program Files\Picasa2\PicasaMediaDetector.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
C:\Program Files\Common Files\Real\Update_OB\realsched.exe

R2 LogWatch;Event Log Watch;"C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe" [2003-08-21 08:42]
S3 CA_LIC_CLNT;CA License Client;"C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmt.exe" [2003-08-21 08:42]
S3 CA_LIC_SRVR;CA License Server;"C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmtd.exe" [2003-08-21 08:42]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}]
\Shell\AutoRun\command - E:\setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{57d76eba-6c9d-11dc-9de4-001422e5d080}]
\Shell\AutoRun\command - E:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{88b999ce-2524-11dc-9ddd-001422e5d080}]
\Shell\AutoRun\command - E:\Autorun.exe /run
\Shell\Shell00\Command - E:\Autorun.exe /run
\Shell\Shell01\Command - E:\Autorun.exe /action
\Shell\Shell02\Command - E:\Autorun.exe /uninstall

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-24 02:10:53
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-02-24 2:11:31
ComboFix-quarantined-files.txt 2008-02-24 07:11:16
ComboFix2.txt 2008-02-14 04:41:55
.
2008-02-13 22:33:05 — E O F —









________________________________________________________________________________
____




AVG Anti-Spyware - Scan Report
———————————————————

+ Created at: 1:23:24 AM 2/24/2008

+ Scan result:



C:\Documents and Settings\claudia\Cookies\claudia@2o7[2].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\claudia\Cookies\claudia@sixapart.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\claudia\Cookies\claudia@advertising[2].txt -> TrackingCookie.Advertising : Cleaned.
C:\Documents and Settings\claudia\Cookies\claudia@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned.
C:\Documents and Settings\claudia\Cookies\claudia@casalemedia[2].txt -> TrackingCookie.Casalemedia : Cleaned.
C:\Documents and Settings\claudia\Cookies\claudia@doubleclick[2].txt -> TrackingCookie.Doubleclick : Cleaned.
C:\Documents and Settings\claudia\Cookies\[removed][1].txt -> TrackingCookie.Euroclick : Cleaned.
C:\Documents and Settings\claudia\Cookies\claudia@mediaplex[1].txt -> TrackingCookie.Mediaplex : Cleaned.
C:\Documents and Settings\claudia\Cookies\claudia@overture[1].txt -> TrackingCookie.Overture : Cleaned.
C:\Documents and Settings\claudia\Cookies\claudia@statcounter[1].txt -> TrackingCookie.Statcounter : Cleaned.
C:\Documents and Settings\claudia\Cookies\claudia@tacoda[1].txt -> TrackingCookie.Tacoda : Cleaned.
C:\Documents and Settings\claudia\Cookies\claudia@tribalfusion[1].txt -> TrackingCookie.Tribalfusion : Cleaned.
C:\Documents and Settings\claudia\Cookies\[removed][1].txt -> TrackingCookie.Yieldmanager : Cleaned.


::Report end