Spyware / Malware / Virus Removal

[Resolved] Infected with 2 Trojan horses and a virus

10 min read

Looking for the outcome? Ask AI

dimsh2000 Topic Starter

Post #1February 21, 2008, 5:46 AM UTC last edited February 21, 2008, 9:50 PM UTC

Hey Guys,

I'm a new member and I need some help. I recently ran an AVG scan and found this:
-Trojan horse Downloader.Generic6.AGKV
-Trojan horse Generic9.AGKV
-Virus found Lop

I need some help removing these from my computer. Here is the HijackThis file:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:41:54 PM, on 2/20/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16609)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Grisoft\AVG7\avgcc.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\AIM6\aim6.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Common Files\AOL\Loader\aolload.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\COMODO\Firewall\cfp.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Grisoft\AVG7\avgwb.dat
C:\Program Files\Grisoft\AVG7\avgvv.exe
C:\Program Files\DC++\DCPlusPlus.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Users\Dmitriy\Desktop\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…n&pf=laptop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…n&pf=laptop
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBho.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\UIBHO.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [HP Health Check Scheduler] C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [WAWifiMessage] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [MSConfig] "C:\Windows\system32\msconfig.exe" /auto
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\COMODO\Firewall\cfp.exe" -s
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [MSServer] rundll32.exe C:\Users\Dmitriy\AppData\Local\Temp\jkhii.dll,#1
O4 - HKCU\..\Run: [cmds] rundll32.exe C:\Users\Dmitriy\AppData\Local\Temp\xxyaw.dll,c
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - Startup: hott notes 4.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O18 - Protocol: bw+0 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw+0s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: bwg0 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwg0s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: offline-8876480 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\Windows\system32\guard32.dll
O20 - Winlogon Notify: avgwlntf - C:\Windows\SYSTEM32\avgwlntf.dll
O20 - Winlogon Notify: GoToAssist - C:\Program Files\Citrix\GoToAssist\480\G2AWinLogon.dll (file missing)
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG7 Resident Shield Service (AvgCoreSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLSched.exe
O23 - Service: COMODO Firewall Pro Helper Service (cmdAgent) - COMODO - C:\Program Files\COMODO\Firewall\cmdagent.exe
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
O23 - Service: dlbc_device - - C:\Windows\system32\dlbccoms.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: GoToAssist - Citrix Online, a division of Citrix Systems, Inc. - C:\Program Files\Citrix\GoToAssist\480\g2aservice.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: OpcEnum - Unknown owner - C:\Windows\system32\OpcEnum.exe (file missing)
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: SolidWorks Licensing Service - SolidWorks - C:\Program Files\Common Files\SolidWorks Shared\Service\SolidWorksLicensing.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe

Thank you,
Dmitriy

anyone?

IndiGenus

Post #2February 23, 2008, 12:34 AM UTC

Hi Dmitriy and welcome to the forums.

My name is Dave. I would be glad to take a look at your log and help you with solving any malware problems. HijackThis logs can sometimes take a while to research so please be patient and I'd be grateful if you would note the following:

I will working be on your Malware issues, this may or may not, solve other issues you have with your machine.
The fixes are specific to your problem and should only be used for this issue on this machine.
Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
It's often worth reading through these instructions and printing them for ease of reference.
If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
Please reply to this thread. Do not start a new topic.
I recommend that you make a backup of any data that you have created, such as documents, pictures, music, ect… before we begin the fix.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Please download ComboFix by sUBs from HERE or HERE

You must download it to and run it from your Desktop
Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.
Right click on combofix.exe and select Run as administrator, then follow the prompts.
When finished, it will produce a log. Please save that log to post in your next reply along with a fresh HJT log
Re-enable all the programs that were disabled during the running of ComboFix..

Note:
Do not mouse-click combofix's window while it is running. That may cause it to stall.

CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

dimsh2000

Post #3February 23, 2008, 11:59 PM UTC

ComboFix Log:

ComboFix 08-02-24.2 - Dmitriy 2008-02-23 15:31:14.1 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.1.1033.18.940 [GMT -8:00]
Running from: C:\Users\[removed]\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Windows\system32\x64
H:\Autorun.inf

.
((((((((((((((((((((((((( Files Created from 2008-01-24 to 2008-02-24 )))))))))))))))))))))))))))))))
.

2008-02-22 18:31 . 2008-02-22 18:31 d——– C:\Users\All Users\Avg7
2008-02-22 18:31 . 2008-02-22 18:31 d——– C:\ProgramData\Avg7
2008-02-22 17:16 . 2008-02-22 17:16 d——– C:\Program Files\C@B
2008-02-21 19:32 . 2008-02-21 19:32 d——– C:\Program Files\iTunes
2008-02-21 19:29 . 2008-02-21 19:30 d——– C:\Program Files\QuickTime
2008-02-21 19:06 . 2008-02-21 19:06 d——– C:\Program Files\Lavasoft
2008-02-20 22:50 . 2008-02-21 19:55 d——– C:\Windows\Internet Logs
2008-02-20 09:40 . 2008-02-22 18:34 d——– C:\Users\Dmitriy\AppData\Roaming\Comodo
2008-02-20 09:40 . 2008-02-22 18:34 d——– C:\Program Files\COMODO
2008-02-20 09:40 . 2008-02-21 20:04 139,008 –a—— C:\Windows\System32\guard32.dll
2008-02-18 15:04 . 2008-02-18 15:04 d——– C:\Program Files\Dell Photo Printer 720
2008-02-18 15:03 . 2007-01-22 08:49 344,064 –a—— C:\Windows\System32\dlbccoin.dll
2008-02-18 15:03 . 2005-10-05 12:19 40,960 –a—— C:\Windows\System32\dlbcvs.dll
2008-02-14 21:44 . 2008-02-21 19:08 d——– C:\Users\All Users\Lavasoft
2008-02-14 21:44 . 2008-02-21 19:08 d——– C:\ProgramData\Lavasoft
2008-02-14 20:20 . 2008-02-14 20:20 d——– C:\Program Files\Runtime Software
2008-02-14 19:24 . 2008-02-19 00:17 d——– C:\Users\Dmitriy\AppData\Roaming\Uniblue
2008-02-14 19:11 . 2007-10-09 15:59 4,702,208 –a—— C:\Windows\RtHDVCpl.exe
2008-02-14 19:11 . 2007-08-31 14:36 2,087,936 –a—— C:\Windows\System32\RtkAPO.dll
2008-02-14 19:11 . 2007-10-09 15:49 1,970,712 –a—— C:\Windows\System32\drivers\RTKVHDA.sys
2008-02-14 19:11 . 2007-07-26 17:06 1,191,936 –a—— C:\Windows\RtlUpd.exe
2008-02-14 19:11 . 2007-09-20 16:30 584,704 –a—— C:\Windows\System32\RtkPgExt.dll
2008-02-14 19:11 . 2007-07-06 10:04 532,480 –a—— C:\Windows\System32\RTSndMgr.cpl
2008-02-14 19:11 . 2007-07-25 08:33 135,168 –a—— C:\Windows\System32\SRSWOW.dll
2008-02-14 19:11 . 2007-10-09 10:46 25,600 –a—— C:\Windows\System32\RtkCoInst.dll
2008-02-14 19:07 . 2008-02-14 19:07 d——– C:\Program Files\Fingerprint Sensor
2008-02-14 19:02 . 2007-07-25 12:48 172,032 –a—— C:\Windows\System32\rixdicon.dll
2008-02-14 19:02 . 2007-08-08 20:42 45,568 –a—— C:\Windows\System32\drivers\rimmptsk.sys
2008-02-14 19:02 . 2007-07-30 10:42 43,008 –a—— C:\Windows\System32\drivers\rimsptsk.sys
2008-02-14 19:02 . 2007-07-30 11:54 38,400 –a—— C:\Windows\System32\drivers\rixdptsk.sys
2008-02-13 00:22 . 2008-02-13 00:22 613,888 –a—— C:\Windows\System32\wpd_ci.dll
2008-02-13 00:22 . 2008-02-13 00:22 224,824 –a—— C:\Windows\System32\clfs.sys
2008-02-13 00:22 . 2008-02-13 00:22 221,696 –a—— C:\Windows\System32\umpnpmgr.dll
2008-02-13 00:22 . 2008-02-13 00:22 194,560 –a—— C:\Windows\System32\WebClnt.dll
2008-02-13 00:22 . 2008-02-13 00:22 110,080 –a—— C:\Windows\System32\drivers\mrxdav.sys
2008-02-13 00:22 . 2008-02-13 00:22 101,888 –a—— C:\Windows\System32\drvinst.exe
2008-02-13 00:22 . 2008-02-13 00:22 19,456 –a—— C:\Windows\System32\cfgmgr32.dll
2008-02-13 00:18 . 2008-02-13 00:18 3,504,696 –a—— C:\Windows\System32\ntkrnlpa.exe
2008-02-13 00:18 . 2008-02-13 00:18 3,470,392 –a—— C:\Windows\System32\ntoskrnl.exe
2008-02-13 00:18 . 2008-02-13 00:18 154,624 –a—— C:\Windows\System32\drivers\nwifi.sys
2008-02-13 00:18 . 2008-02-13 00:18 109,624 –a—— C:\Windows\System32\drivers\ataport.sys
2008-02-13 00:18 . 2008-02-13 00:18 45,112 –a—— C:\Windows\System32\drivers\pciidex.sys
2008-02-13 00:18 . 2008-02-13 00:18 21,560 –a—— C:\Windows\System32\drivers\atapi.sys
2008-02-13 00:18 . 2008-02-13 00:18 15,928 –a—— C:\Windows\System32\drivers\pciide.sys
2008-02-13 00:17 . 2008-02-13 00:17 4,247,552 –a—— C:\Windows\System32\GameUXLegacyGDFs.dll
2008-02-13 00:17 . 2008-02-13 00:17 1,686,528 –a—— C:\Windows\System32\gameux.dll
2008-02-13 00:17 . 2008-02-13 00:17 803,328 –a—— C:\Windows\System32\drivers\tcpip.sys
2008-02-13 00:17 . 2008-02-13 00:17 216,632 –a—— C:\Windows\System32\drivers\netio.sys
2008-02-13 00:17 . 2008-02-13 00:17 167,424 –a—— C:\Windows\System32\tcpipcfg.dll
2008-02-13 00:17 . 2008-02-13 00:17 24,064 –a—— C:\Windows\System32\netcfg.exe
2008-02-13 00:17 . 2008-02-13 00:17 22,016 –a—— C:\Windows\System32\netiougc.exe
2008-02-12 23:59 . 2008-02-13 00:00 1,831,424 –a—— C:\Windows\System32\inetcpl.cpl
2008-02-12 23:59 . 2008-02-12 23:59 56,320 –a—— C:\Windows\System32\iesetup.dll
2008-02-12 23:59 . 2008-02-12 23:59 26,624 –a—— C:\Windows\System32\ieUnatt.exe
2008-02-12 23:57 . 2008-02-12 23:57 1,244,672 –a—— C:\Windows\System32\mcmde.dll
2008-02-11 19:53 . 2008-02-11 19:53 dr——- C:\Users\Dmitriy\Videos
2008-02-07 02:27 . 2004-02-11 14:37 203,976 –a—— C:\Windows\System32\RICHTX32.OCX
2008-02-07 02:26 . 2008-02-07 02:26 645,120 –a—— C:\Windows\System32\config.gms
2008-02-07 01:41 . 2008-02-07 01:41 d——– C:\Program Files\MATLAB
2008-01-31 23:13 . 2008-01-31 23:13 90,112 –a—— C:\Windows\System32\QuickTimeVR.qtx
2008-01-31 23:13 . 2008-01-31 23:13 57,344 –a—— C:\Windows\System32\QuickTime.qts
2008-01-25 16:18 . 2008-01-25 16:18 d——– C:\Windows\System32\electricsheep-cache
2008-01-25 16:18 . 2008-01-25 16:18 48,456 –a—— C:\Windows\System32\UninstallElectricSheep.exe
2008-01-24 19:29 . 2008-01-24 19:29 d——– C:\Program Files\K-Lite Codec Pack
2008-01-24 19:29 . 2008-01-18 21:19 607,744 –a—— C:\Windows\System32\x264vfw.dll
2008-01-24 19:29 . 2007-09-04 17:56 164,352 –a—— C:\Windows\System32\unrar.dll
2008-01-24 19:29 . 2007-12-24 13:49 7,680 –a—— C:\Windows\System32\ff_vfw.dll
2008-01-24 19:29 . 2007-07-10 17:10 547 –a—— C:\Windows\System32\ff_vfw.dll.manifest

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-23 23:27 ——— d—–w C:\Users\Dmitriy\AppData\Roaming\Skype
2008-02-22 03:32 ——— d—–w C:\Program Files\iPod
2008-02-22 01:36 ——— d—–w C:\Program Files\Symantec
2008-02-20 06:24 ——— d—–w C:\Users\Dmitriy\AppData\Roaming\LimeWire
2008-02-19 11:48 ——— d—–w C:\Program Files\Common Files\DVDVIDEOSOFT
2008-02-15 05:10 ——— d—–w C:\Users\Dmitriy\AppData\Roaming\BitTorrent
2008-02-15 04:36 ——— d—–w C:\Program Files\Common Files\Symantec Shared
2008-02-15 04:30 ——— d—–w C:\ProgramData\Symantec
2008-02-15 03:16 ——— d—–w C:\ProgramData\Viewpoint
2008-02-15 03:11 319,456 —-a-w C:\Windows\DIFxAPI.dll
2008-02-15 03:11 ——— d—–w C:\Program Files\Realtek
2008-02-15 03:02 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-02-14 18:09 ——— d—–w C:\Program Files\Common Files\Adobe
2008-02-13 08:18 ——— d—–w C:\ProgramData\Microsoft Help
2008-02-13 08:17 537,600 —-a-w C:\Windows\AppPatch\AcLayers.dll
2008-02-13 08:17 449,536 —-a-w C:\Windows\AppPatch\AcSpecfc.dll
2008-02-13 08:17 2,144,256 —-a-w C:\Windows\AppPatch\AcGenral.dll
2008-02-13 08:17 173,056 —-a-w C:\Windows\AppPatch\AcXtrnal.dll
2008-02-13 08:00 824,832 —-a-w C:\Windows\System32\wininet.dll
2008-02-13 08:00 52,736 —-a-w C:\Windows\AppPatch\iebrshim.dll
2008-02-13 03:04 ——— d—–w C:\Program Files\SolidWorks Installation Manager
2008-02-13 03:02 ——— d—–w C:\Program Files\SolidWorks
2008-02-13 03:02 ——— d—–w C:\Program Files\Common Files\SolidWorks Shared
2008-02-13 02:51 ——— d—–w C:\Users\Dmitriy\AppData\Roaming\sldIM
2008-01-20 08:04 ——— d—–w C:\ProgramData\Roxio
2008-01-19 11:45 ——— d—–w C:\Users\Dmitriy\AppData\Roaming\hott notes 4
2008-01-19 11:45 ——— d—–w C:\Program Files\Hott Notes 4
2008-01-19 01:02 ——— d—–w C:\Program Files\Windows Sidebar
2008-01-19 01:02 ——— d—–w C:\Program Files\Windows Mail
2008-01-18 11:01 211,000 —-a-w C:\Windows\system32\drivers\volsnap.sys
2008-01-18 11:01 11,776 —-a-w C:\Windows\System32\sbunattend.exe
2008-01-18 11:01 1,060,920 —-a-w C:\Windows\system32\drivers\ntfs.sys
2008-01-15 17:54 10,537 —-a-w C:\Windows\system32\drivers\COH_Mon.cat
2008-01-15 13:28 706 —-a-w C:\Windows\system32\drivers\COH_Mon.inf
2008-01-13 02:32 23,904 —-a-w C:\Windows\system32\drivers\COH_Mon.sys
2007-12-31 21:19 ——— d—–w C:\Program Files\KVS Availability Tool
2007-12-25 02:21 ——— d—–w C:\Users\Dmitriy\AppData\Roaming\InstallShield
2007-12-13 11:10 9,728 —-a-w C:\Windows\System32\LAPRXY.DLL
2007-12-13 11:10 223,232 —-a-w C:\Windows\System32\WMASF.DLL
2007-12-13 11:10 1,327,104 —-a-w C:\Windows\System32\quartz.dll
2007-10-05 00:02 60,968 —-a-w C:\Users\Dmitriy\GoToAssistDownloadHelper.exe
2007-09-23 06:20 174 –sha-w C:\Program Files\desktop.ini
2007-09-22 06:44 0 —-a-w C:\Users\Dmitriy\AppData\Roaming\wklnhst.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-18 03:01 1232896]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-09-13 12:31 22880040]
"Aim6"="C:\Program Files\AIM6\aim6.exe" [2007-10-04 07:20 50528]
"cmds"="C:\Users\Dmitriy\AppData\Local\Temp\xxyaw.dll" [2008-02-19 00:40 323072]
"1cf95e9d"="C:\Users\Dmitriy\AppData\Local\Temp\yqvkxdyf.dll" [2008-02-22 22:32 84544]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2007-09-22 21:35 1006264]
"SMSERIAL"="C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe" [2007-01-16 22:34 634880]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2007-09-15 02:50 1021224]
"RtHDVCpl"="RtHDVCpl.exe" [2007-10-09 15:59 4702208 C:\Windows\RtHDVCpl.exe]
"IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2007-02-12 06:37 174872]
"QPService"="C:\Program Files\HP\QuickPlay\QPService.exe" [2007-04-23 17:11 176128]
"QlbCtrl"="C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-02-13 10:38 159744]
"HP Health Check Scheduler"="C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2007-03-12 10:54 50696]
"hpWirelessAssistant"="C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-03-01 12:18 472776]
"WAWifiMessage"="C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [2007-01-10 15:12 317128]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"HP Software Update"="C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe" [2007-05-08 15:24 54840]
"SynTPStart"="C:\Program Files\Synaptics\SynTP\SynTPStart.exe" [2007-09-15 02:29 102400]
"MSConfig"="C:\Windows\system32\msconfig.exe" [2006-11-02 01:45 222208]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-01-31 23:13 385024]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-01-15 03:22 267048]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"="%WINDIR%\SMINST\launcher.exe" [ ]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist]
C:\Program Files\Citrix\GoToAssist\480\G2AWinLogon.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^AutoCAD Startup Accelerator.lnk]
path=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\AutoCAD Startup Accelerator.lnk
backup=C:\Windows\pss\AutoCAD Startup Accelerator.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Logitech Desktop Messenger.lnk]
path=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Logitech Desktop Messenger.lnk
backup=C:\Windows\pss\Logitech Desktop Messenger.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Logitech SetPoint.lnk]
path=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Logitech SetPoint.lnk
backup=C:\Windows\pss\Logitech SetPoint.lnk.CommonStartup
backupExtension=.CommonStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
–a—— 2008-01-11 22:16 39792 C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6]
–a—— 2007-10-04 07:20 50528 C:\Program Files\AIM6\aim6.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ArcSoft Connection Service]
–a—— 2007-07-17 13:05 64000 C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp]
–a—— 2007-01-10 03:59 115816 c:\Program Files\Common Files\Symantec Shared\ccApp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
–a—— 2007-08-24 07:00 33648 C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
–a—— 2007-08-24 19:54 154136 C:\Windows\system32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPAdvisor]
–a—— 2007-03-20 14:23 1773568 C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
–a—— 2007-08-24 19:54 141848 C:\Windows\system32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
–a—— 2008-01-15 03:22 267048 C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Kernel and Hardware Abstraction Layer]
–a—— 2006-07-19 11:03 94208 C:\Windows\KHALMNPR.Exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LDM]
–a—— 2007-09-22 21:28 36864 C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Hardware Abstraction Layer]
–a—— 2006-07-19 11:03 94208 C:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
–a—— 2007-08-24 19:54 129560 C:\Windows\system32\igfxpers.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE]
–a—— 2007-04-09 04:23 200704 C:\Program Files\PowerISO\PWRISOVM.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
–a—— 2008-01-31 23:13 385024 C:\Program Files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StxTrayMenu]
–a—— 2007-01-04 12:56 76904 C:\Program Files\Seagate\SystemTray\FreeAgentLauncher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Symantec PIF AlertEng]
–a—— 2007-11-28 19:51 583048 C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
–a—— 2007-10-01 15:00 185632 C:\Program Files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Uniblue SpeedUpMyPC]
C:\Program Files\Uniblue\SpeedUpMyPC 3\StartSUMP2.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{89DC532D-0B87-4083-9E66-35374E7A9632}"= C:\Program Files\HP\QuickPlay\QP.exe:Quick Play|Desc=Quick Play
"{6A259ADB-8F8D-4F89-9925-C3F6C0DA4D12}"= C:\Program Files\HP\QuickPlay\QPService.exe:Quick Play Resident Program|Desc=Quick Play Resident Program
"{5EE3F5EA-0642-4C43-9AD4-49EAC66BD446}"= UDP:C:\Program Files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{6757E914-0C82-43B3-AA41-AA6A598F47D1}"= TCP:C:\Program Files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{D11EF961-E5FA-4337-8C11-0ED294265533}"= UDP:C:\Program Files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{DC089583-958B-434C-A0E8-DA2A297BDFBE}"= TCP:C:\Program Files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{7664F1D8-7E0A-4B7F-9A47-6260494F268F}"= UDP:C:\Program Files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{D8AC4554-5D94-40FB-9FC7-F726227A9AA2}"= TCP:C:\Program Files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{932D1B89-5998-4D95-A8A5-AF4313EF2420}"= UDP:C:\Program Files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{624E0E95-3724-4DD5-94A1-AAFA049B966F}"= TCP:C:\Program Files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"TCP Query User{47086039-B824-4D8B-A305-3D317F3B411F}C:\program files\filezilla client\filezilla.exe"= UDP:C:\program files\filezilla client\filezilla.exe:FileZilla FTP Client|Desc=FileZilla FTP Client
"UDP Query User{48EF2789-EDD4-4B6F-B54A-EE7EFEB60EF0}C:\program files\filezilla client\filezilla.exe"= TCP:C:\program files\filezilla client\filezilla.exe:FileZilla FTP Client|Desc=FileZilla FTP Client
"TCP Query User{4647F99C-EAC6-48FF-8B9B-F3F1E1B9837C}C:\program files\tftpd32\tftpd32.exe"= UDP:C:\program files\tftpd32\tftpd32.exe:TFTP server|Desc=TFTP server
"UDP Query User{CCCB9423-FE10-4997-8EDB-D87C4B7FDAD3}C:\program files\tftpd32\tftpd32.exe"= TCP:C:\program files\tftpd32\tftpd32.exe:TFTP server|Desc=TFTP server
"{E5492AF0-139D-4916-85F1-F8CD667B951A}"= UDP:C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:Logitech Desktop Messenger
"{34A2B740-F101-4335-98CC-DE6C514BABAD}"= TCP:C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:Logitech Desktop Messenger
"{B8282523-A65C-4F89-AD93-DE54EFF029F4}"= UDP:C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:Logitech Desktop Messenger
"{5C09C3CD-0A35-4331-9766-2661C2F924EB}"= TCP:C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:Logitech Desktop Messenger
"TCP Query User{B707437B-488C-473E-922C-24A5490CC015}C:\program files\logitech\desktop messenger\8876480\program\logitechdesktopmessenger.exe"= UDP:C:\program files\logitech\desktop messenger\8876480\program\logitechdesktopmessenger.exe:Logitech Desktop Messenger|Desc=Logitech Desktop Messenger
"UDP Query User{539F8B48-C3FF-4A45-B9B9-DF03AF22EED9}C:\program files\logitech\desktop messenger\8876480\program\logitechdesktopmessenger.exe"= TCP:C:\program files\logitech\desktop messenger\8876480\program\logitechdesktopmessenger.exe:Logitech Desktop Messenger|Desc=Logitech Desktop Messenger
"{4C62D3E9-3C72-49C5-811D-F946CE64390D}"= UDP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire
"{814B8A8A-8F85-401B-8247-C4A448C1B8E4}"= TCP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire
"{7ADDD979-31EB-4C0E-81A4-EC2935CCD89C}"= TCP:6004|C:\Program Files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{4B4DA0E3-C9AA-41D6-B334-585864B21A8D}"= UDP:C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{9D4F9CA8-E0F0-485B-A7CA-6E53AEAEA3D9}"= TCP:C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{ECA08870-B2AB-49E5-A569-79A59F081E22}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{9B69140F-0111-47F1-96B5-7BDD7CB3E4BB}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"TCP Query User{7D2F2EC3-9E57-4C16-9A33-63516668C0ED}C:\program files\skype\phone\skype.exe"= Disabled:UDP:C:\program files\skype\phone\skype.exe:Skype. Take a deep breath |Desc=Skype. Take a deep breath
"UDP Query User{46FFCCAE-8C14-430B-BAFD-68FD605E74D2}C:\program files\skype\phone\skype.exe"= Disabled:TCP:C:\program files\skype\phone\skype.exe:Skype. Take a deep breath |Desc=Skype. Take a deep breath
"{A3BBF49D-3DB6-4C5A-AE16-D06BEBDC87A1}"= UDP:C:\Program Files\BitTorrent\bittorrent.exe:BitTorrent
"{894839D7-9DAD-47DD-87A2-D82180472F86}"= TCP:C:\Program Files\BitTorrent\bittorrent.exe:BitTorrent
"{127BB0EF-AD42-4F38-B658-8C1FEF0507A2}"= UDP:C:\Windows\System32\dlbccoms.exe:Lexmark Communications System
"{5270C1A0-0A85-4CE4-A013-280577D2FBAA}"= TCP:C:\Windows\System32\dlbccoms.exe:Lexmark Communications System
"{55AA844F-8092-4DC2-9041-0DF95D292815}"= UDP:C:\Windows\System32\spool\drivers\w32x86\3\dlbcpswx.exe:Printer Status Window
"{9BD05A3C-04A2-448B-A548-3CC64D875938}"= TCP:C:\Windows\System32\spool\drivers\w32x86\3\dlbcpswx.exe:Printer Status Window
"{96AB85BB-52BD-437E-B04A-C8E13F65A044}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{6034BD42-5CA4-47C1-AF3A-8058155DEFBC}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\EarthLink TotalAccess\TaskPanl.exe"= C:\Program Files\EarthLink TotalAccess\TaskPanl.exe:*:Enabled:Earthlink
"C:\Program Files\BitTorrent\bittorrent.exe"= C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent

R1 IDSvix86;Symantec Intrusion Prevention Driver;C:\PROGRA~2\Symantec\DEFINI~1\SymcData\idsdefs\20071122.002\IDSvix86.sys [2007-11-06 08:07]
R2 cvintdrv;cvintdrv;C:\Windows\system32\drivers\cvintdrv.sys [2007-02-21 10:00]
R2 dlbc_device;dlbc_device;C:\Windows\system32\dlbccoms.exe [2007-02-07 16:26]
R3 igfx;igfx;C:\Windows\system32\DRIVERS\igdkmd32.sys [2007-08-24 19:39]
R3 ManyCam;ManyCam Virtual Webcam, WDM Video Capture Driver;C:\Windows\system32\DRIVERS\ManyCam.sys [2007-03-22 04:17]
R3 NETw4v32;Intel® Wireless WiFi Link Adapter Driver for Windows Vista 32 Bit;C:\Windows\system32\DRIVERS\NETw4v32.sys [2007-06-21 11:51]
R3 RTL8169;Realtek 8169 NT Driver;C:\Windows\system32\DRIVERS\Rtlh86.sys [2007-03-05 13:28]
R3 SYMNDISV;SYMNDISV;C:\Windows\system32\Drivers\SYMNDISV.SYS [2007-10-30 19:55]
S3 BCM43XV;Broadcom Extensible 802.11 Network Adapter Driver;C:\Windows\system32\DRIVERS\bcmwl6.sys [2006-11-01 23:30]
S3 GoToAssist;GoToAssist;"C:\Program Files\Citrix\GoToAssist\480\g2aservice.exe" Start=service []
S3 SaiH0461;SaiH0461;C:\Windows\system32\DRIVERS\SaiH0461.sys [2006-08-08 09:25]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
\shell\AutoRun\command - E:\Setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
\shell\AutoRun\command - F:\swlauncher.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G]
\shell\AutoRun\command - G:\swlauncher.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\H]
\shell\AutoRun\command - "H:\Install FreeAgent Tools.exe" /run

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{23ec10b2-91ff-11dc-8a64-001b247da0e7}]
\shell\AutoRun\command - "H:\Install FreeAgent Tools.exe" /run

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2e79cb85-6925-11dc-b2a9-806e6f6e6963}]
\shell\AutoRun\command - E:\Setup.exe

*Newly Created Service* - COMHOST
.
Contents of the 'Scheduled Tasks' folder
"2008-02-24 23:35:42 C:\Windows\Tasks\User_Feed_Synchronization-{DCD8360D-CDA0-4901-90A9-0B853D2B75D3}.job"
- C:\Windows\system32\msfeedssync.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-24 15:37:18
Windows 6.0.6000 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

PROCESS: C:\Windows\Explorer.exe [6.00.6000.16549]
-> C:\Users\Dmitriy\AppData\Local\Temp\yqvkxdyf.dll
-> C:\Users\Dmitriy\AppData\Local\Temp\xxyaw.dll
.
Completion time: 2008-02-24 15:38:10
ComboFix-quarantined-files.txt 2008-02-24 23:38:08
.
2008-02-20 17:32:42 — E O F —

HJT Log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:57:16 PM, on 2/24/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16609)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\AIM6\aim6.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Dmitriy\Desktop\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…n&pf;=laptop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…n&pf;=laptop
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBho.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [HP Health Check Scheduler] C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [WAWifiMessage] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [MSConfig] "C:\Windows\system32\msconfig.exe" /auto
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [cmds] rundll32.exe C:\Users\Dmitriy\AppData\Local\Temp\xxyaw.dll,c
O4 - HKCU\..\Run: [1cf95e9d] rundll32.exe "C:\Users\Dmitriy\AppData\Local\Temp\yqvkxdyf.dll",b
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Startup: hott notes 4.lnk = ?
O8 - Extra context menu item: E&xport; to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end; to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O18 - Protocol: bw+0 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw+0s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: bwg0 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwg0s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: offline-8876480 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs:
O20 - Winlogon Notify: GoToAssist - C:\Program Files\Citrix\GoToAssist\480\G2AWinLogon.dll (file missing)
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLSched.exe
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
O23 - Service: dlbc_device - - C:\Windows\system32\dlbccoms.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: GoToAssist - Citrix Online, a division of Citrix Systems, Inc. - C:\Program Files\Citrix\GoToAssist\480\g2aservice.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Unknown owner - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE (file missing)
O23 - Service: OpcEnum - Unknown owner - C:\Windows\system32\OpcEnum.exe (file missing)
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: SolidWorks Licensing Service - SolidWorks - C:\Program Files\Common Files\SolidWorks Shared\Service\SolidWorksLicensing.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe

–
End of file - 21398 bytes

IndiGenus

Post #4February 24, 2008, 1:43 AM UTC

1. Please open Notepad

Click Start , then Run
Type notepad .exe in the Run Box.

2. Now copy/paste the entire content of the codebox below into the Notepad window:

File::
C:\Users\Dmitriy\AppData\Local\Temp\xxyaw.dll
C:\Users\Dmitriy\AppData\Local\Temp\yqvkxdyf.dll

Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"cmds"=-
"1cf95e9d"=-

3. Save the above as CFScript.txt

4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

[external image: Posted Image]

5. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:

Combofix.txt
A new HijackThis log.

dimsh2000

Post #5February 24, 2008, 2:37 AM UTC

ComboFix.txt:

ComboFix 08-02-24.2 - Dmitriy 2008-02-23 18:25:14.2 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.1.1033.18.906 [GMT -8:00]
Running from: C:\Users\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Users\Dmitriy\Desktop\CFScript.txt
* Created a new restore point

FILE ::
C:\Users\Dmitriy\AppData\Local\Temp\xxyaw.dll
C:\Users\Dmitriy\AppData\Local\Temp\yqvkxdyf.dll
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Users\Dmitriy\AppData\Local\Temp\xxyaw.dll
C:\Users\Dmitriy\AppData\Local\Temp\yqvkxdyf.dll

.
((((((((((((((((((((((((( Files Created from 2008-01-24 to 2008-02-24 )))))))))))))))))))))))))))))))
.

2008-02-22 18:31 . 2008-02-22 18:31 d——– C:\Users\All Users\Avg7
2008-02-22 18:31 . 2008-02-22 18:31 d——– C:\ProgramData\Avg7
2008-02-22 17:16 . 2008-02-22 17:16 d——– C:\Program Files\C@B
2008-02-21 19:32 . 2008-02-21 19:32 d——– C:\Program Files\iTunes
2008-02-21 19:29 . 2008-02-21 19:30 d——– C:\Program Files\QuickTime
2008-02-21 19:06 . 2008-02-21 19:06 d——– C:\Program Files\Lavasoft
2008-02-20 22:50 . 2008-02-21 19:55 d——– C:\Windows\Internet Logs
2008-02-20 09:40 . 2008-02-22 18:34 d——– C:\Users\Dmitriy\AppData\Roaming\Comodo
2008-02-20 09:40 . 2008-02-22 18:34 d——– C:\Program Files\COMODO
2008-02-20 09:40 . 2008-02-21 20:04 139,008 –a—— C:\Windows\System32\guard32.dll
2008-02-18 15:04 . 2008-02-18 15:04 d——– C:\Program Files\Dell Photo Printer 720
2008-02-18 15:03 . 2007-01-22 08:49 344,064 –a—— C:\Windows\System32\dlbccoin.dll
2008-02-18 15:03 . 2005-10-05 12:19 40,960 –a—— C:\Windows\System32\dlbcvs.dll
2008-02-14 21:44 . 2008-02-21 19:08 d——– C:\Users\All Users\Lavasoft
2008-02-14 21:44 . 2008-02-21 19:08 d——– C:\ProgramData\Lavasoft
2008-02-14 20:20 . 2008-02-14 20:20 d——– C:\Program Files\Runtime Software
2008-02-14 19:24 . 2008-02-19 00:17 d——– C:\Users\Dmitriy\AppData\Roaming\Uniblue
2008-02-14 19:11 . 2007-10-09 15:59 4,702,208 –a—— C:\Windows\RtHDVCpl.exe
2008-02-14 19:11 . 2007-08-31 14:36 2,087,936 –a—— C:\Windows\System32\RtkAPO.dll
2008-02-14 19:11 . 2007-10-09 15:49 1,970,712 –a—— C:\Windows\System32\drivers\RTKVHDA.sys
2008-02-14 19:11 . 2007-07-26 17:06 1,191,936 –a—— C:\Windows\RtlUpd.exe
2008-02-14 19:11 . 2007-09-20 16:30 584,704 –a—— C:\Windows\System32\RtkPgExt.dll
2008-02-14 19:11 . 2007-07-06 10:04 532,480 –a—— C:\Windows\System32\RTSndMgr.cpl
2008-02-14 19:11 . 2007-07-25 08:33 135,168 –a—— C:\Windows\System32\SRSWOW.dll
2008-02-14 19:11 . 2007-10-09 10:46 25,600 –a—— C:\Windows\System32\RtkCoInst.dll
2008-02-14 19:07 . 2008-02-14 19:07 d——– C:\Program Files\Fingerprint Sensor
2008-02-14 19:02 . 2007-07-25 12:48 172,032 –a—— C:\Windows\System32\rixdicon.dll
2008-02-14 19:02 . 2007-08-08 20:42 45,568 –a—— C:\Windows\System32\drivers\rimmptsk.sys
2008-02-14 19:02 . 2007-07-30 10:42 43,008 –a—— C:\Windows\System32\drivers\rimsptsk.sys
2008-02-14 19:02 . 2007-07-30 11:54 38,400 –a—— C:\Windows\System32\drivers\rixdptsk.sys
2008-02-13 00:22 . 2008-02-13 00:22 613,888 –a—— C:\Windows\System32\wpd_ci.dll
2008-02-13 00:22 . 2008-02-13 00:22 224,824 –a—— C:\Windows\System32\clfs.sys
2008-02-13 00:22 . 2008-02-13 00:22 221,696 –a—— C:\Windows\System32\umpnpmgr.dll
2008-02-13 00:22 . 2008-02-13 00:22 194,560 –a—— C:\Windows\System32\WebClnt.dll
2008-02-13 00:22 . 2008-02-13 00:22 110,080 –a—— C:\Windows\System32\drivers\mrxdav.sys
2008-02-13 00:22 . 2008-02-13 00:22 101,888 –a—— C:\Windows\System32\drvinst.exe
2008-02-13 00:22 . 2008-02-13 00:22 19,456 –a—— C:\Windows\System32\cfgmgr32.dll
2008-02-13 00:18 . 2008-02-13 00:18 3,504,696 –a—— C:\Windows\System32\ntkrnlpa.exe
2008-02-13 00:18 . 2008-02-13 00:18 3,470,392 –a—— C:\Windows\System32\ntoskrnl.exe
2008-02-13 00:18 . 2008-02-13 00:18 154,624 –a—— C:\Windows\System32\drivers\nwifi.sys
2008-02-13 00:18 . 2008-02-13 00:18 109,624 –a—— C:\Windows\System32\drivers\ataport.sys
2008-02-13 00:18 . 2008-02-13 00:18 45,112 –a—— C:\Windows\System32\drivers\pciidex.sys
2008-02-13 00:18 . 2008-02-13 00:18 21,560 –a—— C:\Windows\System32\drivers\atapi.sys
2008-02-13 00:18 . 2008-02-13 00:18 15,928 –a—— C:\Windows\System32\drivers\pciide.sys
2008-02-13 00:17 . 2008-02-13 00:17 4,247,552 –a—— C:\Windows\System32\GameUXLegacyGDFs.dll
2008-02-13 00:17 . 2008-02-13 00:17 1,686,528 –a—— C:\Windows\System32\gameux.dll
2008-02-13 00:17 . 2008-02-13 00:17 803,328 –a—— C:\Windows\System32\drivers\tcpip.sys
2008-02-13 00:17 . 2008-02-13 00:17 216,632 –a—— C:\Windows\System32\drivers\netio.sys
2008-02-13 00:17 . 2008-02-13 00:17 167,424 –a—— C:\Windows\System32\tcpipcfg.dll
2008-02-13 00:17 . 2008-02-13 00:17 24,064 –a—— C:\Windows\System32\netcfg.exe
2008-02-13 00:17 . 2008-02-13 00:17 22,016 –a—— C:\Windows\System32\netiougc.exe
2008-02-12 23:59 . 2008-02-13 00:00 1,831,424 –a—— C:\Windows\System32\inetcpl.cpl
2008-02-12 23:59 . 2008-02-12 23:59 56,320 –a—— C:\Windows\System32\iesetup.dll
2008-02-12 23:59 . 2008-02-12 23:59 26,624 –a—— C:\Windows\System32\ieUnatt.exe
2008-02-12 23:57 . 2008-02-12 23:57 1,244,672 –a—— C:\Windows\System32\mcmde.dll
2008-02-11 19:53 . 2008-02-11 19:53 dr——- C:\Users\Dmitriy\Videos
2008-02-07 02:27 . 2004-02-11 14:37 203,976 –a—— C:\Windows\System32\RICHTX32.OCX
2008-02-07 02:26 . 2008-02-07 02:26 645,120 –a—— C:\Windows\System32\config.gms
2008-02-07 01:41 . 2008-02-07 01:41 d——– C:\Program Files\MATLAB
2008-01-31 23:13 . 2008-01-31 23:13 90,112 –a—— C:\Windows\System32\QuickTimeVR.qtx
2008-01-31 23:13 . 2008-01-31 23:13 57,344 –a—— C:\Windows\System32\QuickTime.qts
2008-01-25 16:18 . 2008-01-25 16:18 d——– C:\Windows\System32\electricsheep-cache
2008-01-25 16:18 . 2008-01-25 16:18 48,456 –a—— C:\Windows\System32\UninstallElectricSheep.exe
2008-01-24 19:29 . 2008-01-24 19:29 d——– C:\Program Files\K-Lite Codec Pack
2008-01-24 19:29 . 2008-01-18 21:19 607,744 –a—— C:\Windows\System32\x264vfw.dll
2008-01-24 19:29 . 2007-09-04 17:56 164,352 –a—— C:\Windows\System32\unrar.dll
2008-01-24 19:29 . 2007-12-24 13:49 7,680 –a—— C:\Windows\System32\ff_vfw.dll
2008-01-24 19:29 . 2007-07-10 17:10 547 –a—— C:\Windows\System32\ff_vfw.dll.manifest

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-24 02:24 ——— d—–w C:\Users\Dmitriy\AppData\Roaming\Skype
2008-02-22 03:32 ——— d—–w C:\Program Files\iPod
2008-02-22 01:36 ——— d—–w C:\Program Files\Symantec
2008-02-20 06:24 ——— d—–w C:\Users\Dmitriy\AppData\Roaming\LimeWire
2008-02-19 11:48 ——— d—–w C:\Program Files\Common Files\DVDVIDEOSOFT
2008-02-15 05:10 ——— d—–w C:\Users\Dmitriy\AppData\Roaming\BitTorrent
2008-02-15 04:36 ——— d—–w C:\Program Files\Common Files\Symantec Shared
2008-02-15 04:30 ——— d—–w C:\ProgramData\Symantec
2008-02-15 03:16 ——— d—–w C:\ProgramData\Viewpoint
2008-02-15 03:11 319,456 —-a-w C:\Windows\DIFxAPI.dll
2008-02-15 03:11 ——— d—–w C:\Program Files\Realtek
2008-02-15 03:02 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-02-14 18:09 ——— d—–w C:\Program Files\Common Files\Adobe
2008-02-13 08:18 ——— d—–w C:\ProgramData\Microsoft Help
2008-02-13 08:17 537,600 —-a-w C:\Windows\AppPatch\AcLayers.dll
2008-02-13 08:17 449,536 —-a-w C:\Windows\AppPatch\AcSpecfc.dll
2008-02-13 08:17 2,144,256 —-a-w C:\Windows\AppPatch\AcGenral.dll
2008-02-13 08:17 173,056 —-a-w C:\Windows\AppPatch\AcXtrnal.dll
2008-02-13 08:00 824,832 —-a-w C:\Windows\System32\wininet.dll
2008-02-13 08:00 52,736 —-a-w C:\Windows\AppPatch\iebrshim.dll
2008-02-13 03:04 ——— d—–w C:\Program Files\SolidWorks Installation Manager
2008-02-13 03:02 ——— d—–w C:\Program Files\SolidWorks
2008-02-13 03:02 ——— d—–w C:\Program Files\Common Files\SolidWorks Shared
2008-02-13 02:51 ——— d—–w C:\Users\Dmitriy\AppData\Roaming\sldIM
2008-01-20 08:04 ——— d—–w C:\ProgramData\Roxio
2008-01-19 11:45 ——— d—–w C:\Users\Dmitriy\AppData\Roaming\hott notes 4
2008-01-19 11:45 ——— d—–w C:\Program Files\Hott Notes 4
2008-01-19 01:02 ——— d—–w C:\Program Files\Windows Sidebar
2008-01-19 01:02 ——— d—–w C:\Program Files\Windows Mail
2008-01-18 11:01 211,000 —-a-w C:\Windows\system32\drivers\volsnap.sys
2008-01-18 11:01 11,776 —-a-w C:\Windows\System32\sbunattend.exe
2008-01-18 11:01 1,060,920 —-a-w C:\Windows\system32\drivers\ntfs.sys
2008-01-15 17:54 10,537 —-a-w C:\Windows\system32\drivers\COH_Mon.cat
2008-01-15 13:28 706 —-a-w C:\Windows\system32\drivers\COH_Mon.inf
2008-01-13 02:32 23,904 —-a-w C:\Windows\system32\drivers\COH_Mon.sys
2007-12-31 21:19 ——— d—–w C:\Program Files\KVS Availability Tool
2007-12-25 02:21 ——— d—–w C:\Users\Dmitriy\AppData\Roaming\InstallShield
2007-12-13 11:10 9,728 —-a-w C:\Windows\System32\LAPRXY.DLL
2007-12-13 11:10 223,232 —-a-w C:\Windows\System32\WMASF.DLL
2007-12-13 11:10 1,327,104 —-a-w C:\Windows\System32\quartz.dll
2007-10-05 00:02 60,968 —-a-w C:\Users\Dmitriy\GoToAssistDownloadHelper.exe
2007-09-23 06:20 174 –sha-w C:\Program Files\desktop.ini
2007-09-22 06:44 0 —-a-w C:\Users\Dmitriy\AppData\Roaming\wklnhst.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-18 03:01 1232896]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-09-13 12:31 22880040]
"Aim6"="C:\Program Files\AIM6\aim6.exe" [2007-10-04 07:20 50528]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2007-09-22 21:35 1006264]
"SMSERIAL"="C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe" [2007-01-16 22:34 634880]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2007-09-15 02:50 1021224]
"RtHDVCpl"="RtHDVCpl.exe" [2007-10-09 15:59 4702208 C:\Windows\RtHDVCpl.exe]
"IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2007-02-12 06:37 174872]
"QPService"="C:\Program Files\HP\QuickPlay\QPService.exe" [2007-04-23 17:11 176128]
"QlbCtrl"="C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-02-13 10:38 159744]
"HP Health Check Scheduler"="C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2007-03-12 10:54 50696]
"hpWirelessAssistant"="C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-03-01 12:18 472776]
"WAWifiMessage"="C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [2007-01-10 15:12 317128]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"HP Software Update"="C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe" [2007-05-08 15:24 54840]
"SynTPStart"="C:\Program Files\Synaptics\SynTP\SynTPStart.exe" [2007-09-15 02:29 102400]
"MSConfig"="C:\Windows\system32\msconfig.exe" [2006-11-02 01:45 222208]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-01-31 23:13 385024]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-01-15 03:22 267048]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"="%WINDIR%\SMINST\launcher.exe" [ ]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist]
C:\Program Files\Citrix\GoToAssist\480\G2AWinLogon.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^AutoCAD Startup Accelerator.lnk]
path=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\AutoCAD Startup Accelerator.lnk
backup=C:\Windows\pss\AutoCAD Startup Accelerator.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Logitech Desktop Messenger.lnk]
path=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Logitech Desktop Messenger.lnk
backup=C:\Windows\pss\Logitech Desktop Messenger.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Logitech SetPoint.lnk]
path=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Logitech SetPoint.lnk
backup=C:\Windows\pss\Logitech SetPoint.lnk.CommonStartup
backupExtension=.CommonStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
–a—— 2008-01-11 22:16 39792 C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6]
–a—— 2007-10-04 07:20 50528 C:\Program Files\AIM6\aim6.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ArcSoft Connection Service]
–a—— 2007-07-17 13:05 64000 C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp]
–a—— 2007-01-10 03:59 115816 c:\Program Files\Common Files\Symantec Shared\ccApp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
–a—— 2007-08-24 07:00 33648 C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
–a—— 2007-08-24 19:54 154136 C:\Windows\system32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPAdvisor]
–a—— 2007-03-20 14:23 1773568 C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
–a—— 2007-08-24 19:54 141848 C:\Windows\system32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
–a—— 2008-01-15 03:22 267048 C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Kernel and Hardware Abstraction Layer]
–a—— 2006-07-19 11:03 94208 C:\Windows\KHALMNPR.Exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LDM]
–a—— 2007-09-22 21:28 36864 C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Hardware Abstraction Layer]
–a—— 2006-07-19 11:03 94208 C:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
–a—— 2007-08-24 19:54 129560 C:\Windows\system32\igfxpers.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE]
–a—— 2007-04-09 04:23 200704 C:\Program Files\PowerISO\PWRISOVM.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
–a—— 2008-01-31 23:13 385024 C:\Program Files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StxTrayMenu]
–a—— 2007-01-04 12:56 76904 C:\Program Files\Seagate\SystemTray\FreeAgentLauncher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Symantec PIF AlertEng]
–a—— 2007-11-28 19:51 583048 C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
–a—— 2007-10-01 15:00 185632 C:\Program Files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Uniblue SpeedUpMyPC]
C:\Program Files\Uniblue\SpeedUpMyPC 3\StartSUMP2.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{89DC532D-0B87-4083-9E66-35374E7A9632}"= C:\Program Files\HP\QuickPlay\QP.exe:Quick Play|Desc=Quick Play
"{6A259ADB-8F8D-4F89-9925-C3F6C0DA4D12}"= C:\Program Files\HP\QuickPlay\QPService.exe:Quick Play Resident Program|Desc=Quick Play Resident Program
"{5EE3F5EA-0642-4C43-9AD4-49EAC66BD446}"= UDP:C:\Program Files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{6757E914-0C82-43B3-AA41-AA6A598F47D1}"= TCP:C:\Program Files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{D11EF961-E5FA-4337-8C11-0ED294265533}"= UDP:C:\Program Files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{DC089583-958B-434C-A0E8-DA2A297BDFBE}"= TCP:C:\Program Files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{7664F1D8-7E0A-4B7F-9A47-6260494F268F}"= UDP:C:\Program Files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{D8AC4554-5D94-40FB-9FC7-F726227A9AA2}"= TCP:C:\Program Files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{932D1B89-5998-4D95-A8A5-AF4313EF2420}"= UDP:C:\Program Files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{624E0E95-3724-4DD5-94A1-AAFA049B966F}"= TCP:C:\Program Files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"TCP Query User{47086039-B824-4D8B-A305-3D317F3B411F}C:\program files\filezilla client\filezilla.exe"= UDP:C:\program files\filezilla client\filezilla.exe:FileZilla FTP Client|Desc=FileZilla FTP Client
"UDP Query User{48EF2789-EDD4-4B6F-B54A-EE7EFEB60EF0}C:\program files\filezilla client\filezilla.exe"= TCP:C:\program files\filezilla client\filezilla.exe:FileZilla FTP Client|Desc=FileZilla FTP Client
"TCP Query User{4647F99C-EAC6-48FF-8B9B-F3F1E1B9837C}C:\program files\tftpd32\tftpd32.exe"= UDP:C:\program files\tftpd32\tftpd32.exe:TFTP server|Desc=TFTP server
"UDP Query User{CCCB9423-FE10-4997-8EDB-D87C4B7FDAD3}C:\program files\tftpd32\tftpd32.exe"= TCP:C:\program files\tftpd32\tftpd32.exe:TFTP server|Desc=TFTP server
"{E5492AF0-139D-4916-85F1-F8CD667B951A}"= UDP:C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:Logitech Desktop Messenger
"{34A2B740-F101-4335-98CC-DE6C514BABAD}"= TCP:C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:Logitech Desktop Messenger
"{B8282523-A65C-4F89-AD93-DE54EFF029F4}"= UDP:C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:Logitech Desktop Messenger
"{5C09C3CD-0A35-4331-9766-2661C2F924EB}"= TCP:C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:Logitech Desktop Messenger
"TCP Query User{B707437B-488C-473E-922C-24A5490CC015}C:\program files\logitech\desktop messenger\8876480\program\logitechdesktopmessenger.exe"= UDP:C:\program files\logitech\desktop messenger\8876480\program\logitechdesktopmessenger.exe:Logitech Desktop Messenger|Desc=Logitech Desktop Messenger
"UDP Query User{539F8B48-C3FF-4A45-B9B9-DF03AF22EED9}C:\program files\logitech\desktop messenger\8876480\program\logitechdesktopmessenger.exe"= TCP:C:\program files\logitech\desktop messenger\8876480\program\logitechdesktopmessenger.exe:Logitech Desktop Messenger|Desc=Logitech Desktop Messenger
"{4C62D3E9-3C72-49C5-811D-F946CE64390D}"= UDP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire
"{814B8A8A-8F85-401B-8247-C4A448C1B8E4}"= TCP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire
"{7ADDD979-31EB-4C0E-81A4-EC2935CCD89C}"= TCP:6004|C:\Program Files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{4B4DA0E3-C9AA-41D6-B334-585864B21A8D}"= UDP:C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{9D4F9CA8-E0F0-485B-A7CA-6E53AEAEA3D9}"= TCP:C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{ECA08870-B2AB-49E5-A569-79A59F081E22}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{9B69140F-0111-47F1-96B5-7BDD7CB3E4BB}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"TCP Query User{7D2F2EC3-9E57-4C16-9A33-63516668C0ED}C:\program files\skype\phone\skype.exe"= Disabled:UDP:C:\program files\skype\phone\skype.exe:Skype. Take a deep breath |Desc=Skype. Take a deep breath
"UDP Query User{46FFCCAE-8C14-430B-BAFD-68FD605E74D2}C:\program files\skype\phone\skype.exe"= Disabled:TCP:C:\program files\skype\phone\skype.exe:Skype. Take a deep breath |Desc=Skype. Take a deep breath
"{A3BBF49D-3DB6-4C5A-AE16-D06BEBDC87A1}"= UDP:C:\Program Files\BitTorrent\bittorrent.exe:BitTorrent
"{894839D7-9DAD-47DD-87A2-D82180472F86}"= TCP:C:\Program Files\BitTorrent\bittorrent.exe:BitTorrent
"{127BB0EF-AD42-4F38-B658-8C1FEF0507A2}"= UDP:C:\Windows\System32\dlbccoms.exe:Lexmark Communications System
"{5270C1A0-0A85-4CE4-A013-280577D2FBAA}"= TCP:C:\Windows\System32\dlbccoms.exe:Lexmark Communications System
"{55AA844F-8092-4DC2-9041-0DF95D292815}"= UDP:C:\Windows\System32\spool\drivers\w32x86\3\dlbcpswx.exe:Printer Status Window
"{9BD05A3C-04A2-448B-A548-3CC64D875938}"= TCP:C:\Windows\System32\spool\drivers\w32x86\3\dlbcpswx.exe:Printer Status Window
"{96AB85BB-52BD-437E-B04A-C8E13F65A044}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{6034BD42-5CA4-47C1-AF3A-8058155DEFBC}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\EarthLink TotalAccess\TaskPanl.exe"= C:\Program Files\EarthLink TotalAccess\TaskPanl.exe:*:Enabled:Earthlink
"C:\Program Files\BitTorrent\bittorrent.exe"= C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent

R1 IDSvix86;Symantec Intrusion Prevention Driver;C:\PROGRA~2\Symantec\DEFINI~1\SymcData\idsdefs\20071122.002\IDSvix86.sys [2007-11-06 08:07]
R2 cvintdrv;cvintdrv;C:\Windows\system32\drivers\cvintdrv.sys [2007-02-21 10:00]
R2 dlbc_device;dlbc_device;C:\Windows\system32\dlbccoms.exe [2007-02-07 16:26]
R3 igfx;igfx;C:\Windows\system32\DRIVERS\igdkmd32.sys [2007-08-24 19:39]
R3 ManyCam;ManyCam Virtual Webcam, WDM Video Capture Driver;C:\Windows\system32\DRIVERS\ManyCam.sys [2007-03-22 04:17]
R3 NETw4v32;Intel® Wireless WiFi Link Adapter Driver for Windows Vista 32 Bit;C:\Windows\system32\DRIVERS\NETw4v32.sys [2007-06-21 11:51]
R3 RTL8169;Realtek 8169 NT Driver;C:\Windows\system32\DRIVERS\Rtlh86.sys [2007-03-05 13:28]
R3 SYMNDISV;SYMNDISV;C:\Windows\system32\Drivers\SYMNDISV.SYS [2007-10-30 19:55]
S3 BCM43XV;Broadcom Extensible 802.11 Network Adapter Driver;C:\Windows\system32\DRIVERS\bcmwl6.sys [2006-11-01 23:30]
S3 GoToAssist;GoToAssist;"C:\Program Files\Citrix\GoToAssist\480\g2aservice.exe" Start=service []
S3 SaiH0461;SaiH0461;C:\Windows\system32\DRIVERS\SaiH0461.sys [2006-08-08 09:25]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
\shell\AutoRun\command - E:\Setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
\shell\AutoRun\command - F:\swlauncher.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G]
\shell\AutoRun\command - G:\swlauncher.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\H]
\shell\AutoRun\command - "H:\Install FreeAgent Tools.exe" /run

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{23ec10b2-91ff-11dc-8a64-001b247da0e7}]
\shell\AutoRun\command - "H:\Install FreeAgent Tools.exe" /run

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2e79cb85-6925-11dc-b2a9-806e6f6e6963}]
\shell\AutoRun\command - E:\Setup.exe

*Newly Created Service* - COMHOST
.
Contents of the 'Scheduled Tasks' folder
"2008-02-25 00:00:18 C:\Windows\Tasks\User_Feed_Synchronization-{DCD8360D-CDA0-4901-90A9-0B853D2B75D3}.job"
- C:\Windows\system32\msfeedssync.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-23 18:29:50
Windows 6.0.6000 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-02-23 18:30:36
ComboFix-quarantined-files.txt 2008-02-24 02:30:35
ComboFix2.txt 2008-02-24 23:38:11
.
2008-02-20 17:32:42 — E O F —

HijackThis Log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:34:39 PM, on 2/23/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16609)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\AIM6\aim6.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Users\Dmitriy\Desktop\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…n&pf;=laptop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…n&pf;=laptop
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBho.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [HP Health Check Scheduler] C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [WAWifiMessage] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [MSConfig] "C:\Windows\system32\msconfig.exe" /auto
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Startup: hott notes 4.lnk = ?
O8 - Extra context menu item: E&xport; to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end; to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O18 - Protocol: bw+0 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw+0s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: bwg0 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwg0s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0s - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: offline-8876480 - {B9352824-2BE2-4F97-9AFA-B7AC62935224} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs:
O20 - Winlogon Notify: GoToAssist - C:\Program Files\Citrix\GoToAssist\480\G2AWinLogon.dll (file missing)
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLSched.exe
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
O23 - Service: dlbc_device - - C:\Windows\system32\dlbccoms.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: GoToAssist - Citrix Online, a division of Citrix Systems, Inc. - C:\Program Files\Citrix\GoToAssist\480\g2aservice.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Unknown owner - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE (file missing)
O23 - Service: OpcEnum - Unknown owner - C:\Windows\system32\OpcEnum.exe (file missing)
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: SolidWorks Licensing Service - SolidWorks - C:\Program Files\Common Files\SolidWorks Shared\Service\SolidWorksLicensing.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe

–
End of file - 21144 bytes

IndiGenus

Post #6February 24, 2008, 3:09 AM UTC

Hi,

Looks better, how's it running?

Download CCleaner

CCleaner Setup and Usage

1. Before first use, check under Options, Advanced, and UNCHECK "Only delete files in Windows Temp folder older than 48 hours".
2. A pop up box will appear advising this process will permanently delete files from your system.
3. Then select the items you wish to clean up. (See Note 1 below)

In the Windows Tab:
Clean all entries in the "Internet Explorer". If you prefer to keep your cookies, uncheck the Cookies entry. Deleting cookies will require re-entry of user names and passwords
on next visit to sites that require users log in.
Clean all the entries in the "Windows Explorer" section.
Clean all entries in the "System" section.
Clean all entries in the "Advanced" section.
Clean any others that you choose.
In the Applications Tab:
Clean all (optionally, except cookies) in the Firefox/Mozilla section if you use it.
Clean all in the Opera section if you use it.
Clean Sun Java in the Internet Section. ==> Important: See Note 2 below before proceeding
Clean any others that you choose.
4. Then click the "Run Cleaner" button and it will scan and clean your system.
Click exit.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Please do an online scan with Kaspersky WebScanner

You need to use Internet Explorer for this scan.

Click on Kaspersky Online Scanner and click Accept

You will be prompted to install an ActiveX component from Kaspersky, Click Yes.

The program will launch and then begin downloading the latest definition files:
Once the files have been downloaded click on NEXT
Now click on Scan Settings
In the scan settings make that the following are selected:
- Scan using the following Anti-Virus database:
Extended (if available otherwise Standard)
- Scan Options:
Scan Archives
Scan Mail Bases
Click OK
Now under select a target to scan:Select My Computer
This will program will start and scan your system.
The scan will take a while so be patient and let it run.
Once the scan is complete it will display if your system has been infected.
- Now click on the Save as Text button:
Save the file to your desktop.
Copy and paste that information in your next post.

dimsh2000

Post #7February 24, 2008, 9:27 AM UTC

Hello, Most of the problems are now gone, so thank you very much for that. After the last post, I've gotten a few pop-ups and my computer has been acting a bit slow. I ran the Kaspersky scan and here are the results: ——————————————————————————- KASPERSKY ONLINE SCANNER REPORT Sunday, February 24, 2008 1:25:40 AM Operating System: Microsoft Windows Vista Home Edition, (Build 6000) Kaspersky Online Scanner version: 5.0.98.0 Kaspersky Anti-Virus database last update: 24/02/2008 Kaspersky Anti-Virus database records: 577471 ——————————————————————————- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: C:\ D:\ E:\ H:\ Scan Statistics: Total number of scanned objects: 369172 Number of viruses found: 1 Number of infected objects: 1 Number of suspicious objects: 0 Duration of the scan process: 03:37:09 Infected Object Name / Virus Name / Last Action C:\boot\bcd Object is locked skipped C:\boot\BCD.LOG Object is locked skipped C:\Program Files\Common Files\Symantec Shared\EENGINE\EPERSIST.DAT Object is locked skipped C:\Program Files\InstallShield Installation Information\{45D707E9-F3C4-11D9-A373-0050BAE317E1}\setup.ilg Object is locked skipped C:\ProgramData\CyberLink\TinyDB\EPGSignal Object is locked skipped C:\ProgramData\CyberLink\TinyDB\Schedule Object is locked skipped C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f99af782fe51d72140e83392c2600a4f_cc8ce0f3-4b0c-4af8-9ebc-b741288d6f9f Object is locked skipped C:\ProgramData\Symantec\Common Client\settings.bak Object is locked skipped C:\ProgramData\Symantec\Common Client\settings.dat Object is locked skipped C:\ProgramData\Symantec\SPBBC\BBConfig.log Object is locked skipped C:\ProgramData\Symantec\SPBBC\BBDebug.log Object is locked skipped C:\ProgramData\Symantec\SPBBC\BBDetect.log Object is locked skipped C:\ProgramData\Symantec\SPBBC\BBNotify.log Object is locked skipped C:\ProgramData\Symantec\SPBBC\BBRefr.log Object is locked skipped C:\ProgramData\Symantec\SPBBC\BBSetCfg.log Object is locked skipped C:\ProgramData\Symantec\SPBBC\BBSetCfg2.log Object is locked skipped C:\ProgramData\Symantec\SPBBC\BBSetDev.log Object is locked skipped C:\ProgramData\Symantec\SPBBC\BBSetLoc.log Object is locked skipped C:\ProgramData\Symantec\SPBBC\BBSetUsr.log Object is locked skipped C:\ProgramData\Symantec\SPBBC\BBStHash.log Object is locked skipped C:\ProgramData\Symantec\SPBBC\BBValid.log Object is locked skipped C:\ProgramData\Symantec\SPBBC\SPPolicy.log Object is locked skipped C:\ProgramData\Symantec\SPBBC\SPStart.log Object is locked skipped C:\ProgramData\Symantec\SPBBC\SPStop.log Object is locked skipped C:\ProgramData\Symantec\SRTSP\SrtErEvt.log Object is locked skipped C:\ProgramData\Symantec\SRTSP\SrtETmp\14F636AE.TMP Object is locked skipped C:\ProgramData\Symantec\SRTSP\SrtETmp\23366503.TMP Object is locked skipped C:\ProgramData\Symantec\SRTSP\SrtMoEvt.log Object is locked skipped C:\ProgramData\Symantec\SRTSP\SrtNvEvt.log Object is locked skipped C:\ProgramData\Symantec\SRTSP\SrtScEvt.log Object is locked skipped C:\ProgramData\Symantec\SRTSP\SrtTxFEvt.log Object is locked skipped C:\ProgramData\Symantec\SRTSP\SrtViEvt.log Object is locked skipped C:\QooBox\Quarantine\C\Users\Dmitriy\AppData\Local\Temp\yqvkxdyf.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.ixe skipped C:\System.sav\util\App.Evt Object is locked skipped C:\System.sav\util\Sec.Evt Object is locked skipped C:\System.sav\util\Sys.Evt Object is locked skipped C:\Users\Dmitriy\AppData\Local\AOL OCP\AIM\Storage\All Users\localStorage\common.cls Object is locked skipped C:\Users\Dmitriy\AppData\Local\AOL OCP\AIM\Storage\data\dimshjuice69\localStorage\common.cls Object is locked skipped C:\Users\Dmitriy\AppData\Local\Microsoft\Feeds Cache\index.dat Object is locked skipped C:\Users\Dmitriy\AppData\Local\Microsoft\Internet Explorer\MSIMGSIZ.DAT Object is locked skipped C:\Users\Dmitriy\AppData\Local\Microsoft\Windows\Explorer\thumbcache_1024.db Object is locked skipped C:\Users\Dmitriy\AppData\Local\Microsoft\Windows\Explorer\thumbcache_256.db Object is locked skipped C:\Users\Dmitriy\AppData\Local\Microsoft\Windows\Explorer\thumbcache_32.db Object is locked skipped C:\Users\Dmitriy\AppData\Local\Microsoft\Windows\Explorer\thumbcache_96.db Object is locked skipped C:\Users\Dmitriy\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db Object is locked skipped C:\Users\Dmitriy\AppData\Local\Microsoft\Windows\Explorer\thumbcache_sr.db Object is locked skipped C:\Users\Dmitriy\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat Object is locked skipped C:\Users\Dmitriy\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.dat Object is locked skipped C:\Users\Dmitriy\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Users\Dmitriy\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped C:\Users\Dmitriy\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.dat Object is locked skipped C:\Users\Dmitriy\AppData\Local\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Users\Dmitriy\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG1 Object is locked skipped C:\Users\Dmitriy\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG2 Object is locked skipped C:\Users\Dmitriy\AppData\Local\Microsoft\Windows\UsrClass.dat{2e79cc88-6925-11dc-b2a9-001b247da0e7}.TM.blf Object is locked skipped C:\Users\Dmitriy\AppData\Local\Microsoft\Windows\UsrClass.dat{2e79cc88-6925-11dc-b2a9-001b247da0e7}.TMContainer00000000000000000001.regtrans-ms Object is locked skipped C:\Users\Dmitriy\AppData\Local\Microsoft\Windows\UsrClass.dat{2e79cc88-6925-11dc-b2a9-001b247da0e7}.TMContainer00000000000000000002.regtrans-ms Object is locked skipped C:\Users\Dmitriy\AppData\Local\Microsoft\Windows Sidebar\Settings.ini Object is locked skipped C:\Users\Dmitriy\AppData\Local\Temp\IMGF00A.tmp Object is locked skipped C:\Users\Dmitriy\AppData\Local\Temp\Low\~DFAB8A.tmp Object is locked skipped C:\Users\Dmitriy\AppData\Local\Temp\Low\~DFAB97.tmp Object is locked skipped C:\Users\Dmitriy\AppData\Roaming\acccore\nss\cert8.db Object is locked skipped C:\Users\Dmitriy\AppData\Roaming\acccore\nss\key3.db Object is locked skipped C:\Users\Dmitriy\AppData\Roaming\Microsoft\Windows\Cookies\index.dat Object is locked skipped C:\Users\Dmitriy\AppData\Roaming\Microsoft\Windows\Cookies\Low\index.dat Object is locked skipped C:\Users\Dmitriy\AppData\Roaming\Skype\dmitriy.shapiro\call256.dbb Object is locked skipped C:\Users\Dmitriy\AppData\Roaming\Skype\dmitriy.shapiro\callmember256.dbb Object is locked skipped C:\Users\Dmitriy\AppData\Roaming\Skype\dmitriy.shapiro\chat256.dbb Object is locked skipped C:\Users\Dmitriy\AppData\Roaming\Skype\dmitriy.shapiro\chat512.dbb Object is locked skipped C:\Users\Dmitriy\AppData\Roaming\Skype\dmitriy.shapiro\chatmember256.dbb Object is locked skipped C:\Users\Dmitriy\AppData\Roaming\Skype\dmitriy.shapiro\chatmsg1024.dbb Object is locked skipped C:\Users\Dmitriy\AppData\Roaming\Skype\dmitriy.shapiro\chatmsg2048.dbb Object is locked skipped C:\Users\Dmitriy\AppData\Roaming\Skype\dmitriy.shapiro\chatmsg256.dbb Object is locked skipped C:\Users\Dmitriy\AppData\Roaming\Skype\dmitriy.shapiro\chatmsg512.dbb Object is locked skipped C:\Users\Dmitriy\AppData\Roaming\Skype\dmitriy.shapiro\chatsync\5a\5a976fa383937ffa.dat Object is locked skipped C:\Users\Dmitriy\AppData\Roaming\Skype\dmitriy.shapiro\contactgroup256.dbb Object is locked skipped C:\Users\Dmitriy\AppData\Roaming\Skype\dmitriy.shapiro\dyncontent\bundle.dat Object is locked skipped C:\Users\Dmitriy\AppData\Roaming\Skype\dmitriy.shapiro\index2.dat Object is locked skipped C:\Users\Dmitriy\AppData\Roaming\Skype\dmitriy.shapiro\profile16384.dbb Object is locked skipped C:\Users\Dmitriy\AppData\Roaming\Skype\dmitriy.shapiro\transfer256.dbb Object is locked skipped C:\Users\Dmitriy\AppData\Roaming\Skype\dmitriy.shapiro\transfer512.dbb Object is locked skipped C:\Users\Dmitriy\AppData\Roaming\Skype\dmitriy.shapiro\user1024.dbb Object is locked skipped C:\Users\Dmitriy\AppData\Roaming\Skype\dmitriy.shapiro\user16384.dbb Object is locked skipped C:\Users\Dmitriy\AppData\Roaming\Skype\dmitriy.shapiro\user4096.dbb Object is locked skipped C:\Users\Dmitriy\AppData\Roaming\Skype\dmitriy.shapiro\voicemail256.dbb Object is locked skipped C:\Users\Dmitriy\Music\iTunes\iTunes Library.itl Object is locked skipped C:\Users\Dmitriy\ntuser.dat Object is locked skipped C:\Users\Dmitriy\ntuser.dat.LOG1 Object is locked skipped C:\Users\Dmitriy\ntuser.dat.LOG2 Object is locked skipped C:\Users\Dmitriy\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TM.blf Object is locked skipped C:\Users\Dmitriy\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000001.regtrans-ms Object is locked skipped C:\Users\Dmitriy\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000002.regtrans-ms Object is locked skipped C:\Windows\Debug\PASSWD.LOG Object is locked skipped C:\Windows\Debug\sam.log Object is locked skipped C:\Windows\Debug\WIA\wiatrace.log Object is locked skipped C:\Windows\Installer\MSI4CD9.tmp Object is locked skipped C:\Windows\Installer\MSIF8EC.tmp Object is locked skipped C:\Windows\Logs\CBS\CBS.log Object is locked skipped C:\Windows\Logs\CBS\CBS.persist.log Object is locked skipped C:\Windows\Logs\DPX\setupact.log Object is locked skipped C:\Windows\Logs\DPX\setuperr.log Object is locked skipped C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe.config Object is locked skipped C:\Windows\panther\diagerr.xml Object is locked skipped C:\Windows\panther\diagwrn.xml Object is locked skipped C:\Windows\panther\setupact.log Object is locked skipped C:\Windows\panther\setuperr.log Object is locked skipped C:\Windows\panther\UnattendGC\diagerr.xml Object is locked skipped C:\Windows\panther\UnattendGC\diagwrn.xml Object is locked skipped C:\Windows\panther\UnattendGC\setupact.log Object is locked skipped C:\Windows\panther\UnattendGC\setuperr.log Object is locked skipped C:\Windows\security\database\secedit.sdb Object is locked skipped C:\Windows\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 Object is locked skipped C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 Object is locked skipped C:\Windows\System32\catroot2\edb.log Object is locked skipped C:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb Object is locked skipped C:\Windows\System32\catroot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb Object is locked skipped C:\Windows\System32\config\COMPONENTS Object is locked skipped C:\Windows\System32\config\COMPONENTS.LOG1 Object is locked skipped C:\Windows\System32\config\COMPONENTS.LOG2 Object is locked skipped C:\Windows\System32\config\DEFAULT Object is locked skipped C:\Windows\System32\config\DEFAULT.LOG1 Object is locked skipped C:\Windows\System32\config\DEFAULT.LOG2 Object is locked skipped C:\Windows\System32\config\SAM Object is locked skipped C:\Windows\System32\config\SAM.LOG1 Object is locked skipped C:\Windows\System32\config\SAM.LOG2 Object is locked skipped C:\Windows\System32\config\SECURITY Object is locked skipped C:\Windows\System32\config\SECURITY.LOG1 Object is locked skipped C:\Windows\System32\config\SECURITY.LOG2 Object is locked skipped C:\Windows\System32\config\SOFTWARE Object is locked skipped C:\Windows\System32\config\SOFTWARE.LOG1 Object is locked skipped C:\Windows\System32\config\SOFTWARE.LOG2 Object is locked skipped C:\Windows\System32\config\SYSTEM Object is locked skipped C:\Windows\System32\config\SYSTEM.LOG1 Object is locked skipped C:\Windows\System32\config\SYSTEM.LOG2 Object is locked skipped C:\Windows\System32\config\TxR\{250834B7-750C-494d-BDC3-DA86B6E2101B}.TM.blf Object is locked skipped C:\Windows\System32\config\TxR\{250834B7-750C-494d-BDC3-DA86B6E2101B}.TMContainer00000000000000000001.regtrans-ms Object is locked skipped C:\Windows\System32\config\TxR\{250834B7-750C-494d-BDC3-DA86B6E2101B}.TMContainer00000000000000000002.regtrans-ms Object is locked skipped C:\Windows\System32\config\TxR\{250834B7-750C-494d-BDC3-DA86B6E2101B}.TMContainer00000000000000000003.regtrans-ms Object is locked skipped C:\Windows\System32\config\TxR\{250834B7-750C-494d-BDC3-DA86B6E2101B}.TMContainer00000000000000000004.regtrans-ms Object is locked skipped C:\Windows\System32\config\TxR\{44ce6291-e0f5-11dc-9c1e-001b247da0e7}.TxR.0.regtrans-ms Object is locked skipped C:\Windows\System32\config\TxR\{44ce6291-e0f5-11dc-9c1e-001b247da0e7}.TxR.1.regtrans-ms Object is locked skipped C:\Windows\System32\config\TxR\{44ce6291-e0f5-11dc-9c1e-001b247da0e7}.TxR.2.regtrans-ms Object is locked skipped C:\Windows\System32\config\TxR\{44ce6291-e0f5-11dc-9c1e-001b247da0e7}.TxR.blf Object is locked skipped C:\Windows\System32\drivers\sptd.sys Object is locked skipped C:\Windows\System32\LogFiles\Scm\SCM.EVM Object is locked skipped C:\Windows\System32\LogFiles\WUDF\WUDFTrace.etl Object is locked skipped C:\Windows\System32\restore\MachineGuid.txt Object is locked skipped C:\Windows\System32\spool\SpoolerETW.etl Object is locked skipped C:\Windows\System32\sysprep\Panther\diagerr.xml Object is locked skipped C:\Windows\System32\sysprep\Panther\diagwrn.xml Object is locked skipped C:\Windows\System32\sysprep\Panther\setupact.log Object is locked skipped C:\Windows\System32\sysprep\Panther\setuperr.log Object is locked skipped C:\Windows\System32\wbem\AutoRecover\2B8B1A8B0ACD3EE28B421D3918DC1F29.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\3460B7617E0429A960E481B197F238A3.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\8A94AF24F162D580E3D9889344A3A317.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\E478A5DB75C9721E744C05D78DBACFD3.mof Object is locked skipped C:\Windows\System32\wbem\Logs\WMITracing.log Object is locked skipped C:\Windows\System32\wbem\repository\INDEX.BTR Object is locked skipped C:\Windows\System32\wbem\repository\MAPPING1.MAP Object is locked skipped C:\Windows\System32\wbem\repository\MAPPING2.MAP Object is locked skipped C:\Windows\System32\wbem\repository\OBJECTS.DATA Object is locked skipped C:\Windows\System32\winevt\Logs\Application.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\DFS Replication.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\HardwareEvents.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Internet Explorer.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Key Management Service.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Media Center.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-Bits-Client%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-Diagnostics-Networking%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-DiskDiagnosticDataCollector%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-DriverFrameworks-UserMode%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-Help%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-International%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-WHEA.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-LanguagePackSetup%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-MUI%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-NetworkAccessProtection%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-ParentalControls%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-ReadyBoost%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-ReliabilityAnalysisComponent%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-Resource-Exhaustion-Resolver%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-Resource-Leak-Diagnostic%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-RestartManager%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-TaskScheduler%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-UAC%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-WindowsUpdateClient%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-WLAN-AutoConfig%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\ODiag.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\OSession.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Security.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Setup.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\System.evtx Object is locked skipped C:\Windows\Tasks\SCHEDLGU.TXT Object is locked skipped C:\Windows\WindowsUpdate.log Object is locked skipped C:\Windows\winsxs\x86_microsoft-windows-n..n_service_datastore_31bf3856ad364e35_6.0.6000.16386_none_cef7ceb03914a67f\dnary.xsd Object is locked skipped Scan process completed.

IndiGenus

Post #8February 24, 2008, 4:06 PM UTC

All Kaspersky found was in the combofix quarantine folder. Are you still getting pop ups? Also, have you disabled your Firewall?

dimsh2000

Post #9February 24, 2008, 10:38 PM UTC

Everything seems to be working fine now and I'm not getting any pop-ups. Should I delete the file in the quarantine folder? My firewall is currently enabled.

IndiGenus

Post #10February 24, 2008, 10:53 PM UTC

Glad to hear it's running better

This will remove that file and do a nice job of cleaning things up here.

Time for some housekeeping

Click START then RUN
Now type Combofix /u in the runbox and click OK. Note the space between the X and the U, it needs to be there.
[external image: Posted Image]

The above procedure will:

Delete the following:
- ComboFix and its associated files and folders.
- VundoFix backups, if present
- The C:\Deckard folder, if present
- The C:_OtMoveIt folder, if present
Reset the clock settings.
Hide file extensions, if required.
Hide System/Hidden files, if required.
Reset System Restore.

~~~~~~~~~~~~~~~~~~~~~~~~~~

Now that you are clean here are some suggestions.

How do I protect myself from infection?
Can you tell me how I got infected?

dimsh2000

Post #11February 24, 2008, 11:00 PM UTC

Alright everything looks good now. Thank you for all of your help!

IndiGenus

Post #12February 24, 2008, 11:19 PM UTC

You're quite welcome

IndiGenus

Post #13March 6, 2008, 7:38 PM UTC

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] Infected with 2 Trojan horses and a virus

✨ Ask AI

Ask AI